James MaesandGPT-6
ae7d93328f
Closes #18 Co-Authored-By: GPT-6 <codex@openai.com> Signed-off-by: James Maes <jmaes@dmdbrands.com>
56 lines
2.0 KiB
Bash
56 lines
2.0 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
setup() {
|
|
export PROJECT_DIR="${BATS_TEST_DIRNAME}/.."
|
|
export WORK="${BATS_TEST_TMPDIR}/work"
|
|
node "${BATS_TEST_DIRNAME}/fixtures/npm-audit/build-fixture.cjs" "${WORK}"
|
|
mkdir -p "${WORK}/bin"
|
|
cat > "${WORK}/bin/npm" <<'MOCK'
|
|
#!/usr/bin/env bash
|
|
if [[ "$1" == view ]]; then printf '"%s"\n' "${LATEST_VERSION:-3.0.3}"; exit 0; fi
|
|
if [[ "$*" == *--omit=dev* ]]; then cat production.json; exit 0; fi
|
|
cat full.json
|
|
exit "${MOCK_AUDIT_STATUS:-1}"
|
|
MOCK
|
|
chmod +x "${WORK}/bin/npm"
|
|
export PATH="${WORK}/bin:${PATH}"
|
|
cd "${WORK}"
|
|
}
|
|
|
|
@test "accepts only the registered advisory and its propagated development findings" {
|
|
run bash "${PROJECT_DIR}/src/scripts/node_audit.sh"
|
|
[ "$status" -eq 0 ]
|
|
[[ "$output" == *"Accepted EX-0008"* ]]
|
|
}
|
|
|
|
@test "fails closed for expired, invalid, unrelated, mixed, critical and runtime findings" {
|
|
for scenario in expired invalid-date different mixed critical production runtime-path different-version unknown-chain cycle counts registry-error; do
|
|
node "${BATS_TEST_DIRNAME}/fixtures/npm-audit/build-fixture.cjs" "$WORK" "$scenario"
|
|
run bash "${PROJECT_DIR}/src/scripts/node_audit.sh"
|
|
if [ "$status" -eq 0 ]; then echo "Unexpected acceptance: $scenario"; return 1; fi
|
|
done
|
|
}
|
|
|
|
@test "a new upstream release requires reassessment" {
|
|
export LATEST_VERSION=3.0.4
|
|
run bash "${PROJECT_DIR}/src/scripts/node_audit.sh"
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"New braces release available"* ]]
|
|
}
|
|
|
|
@test "malformed reports and unexpected audit exit codes fail closed" {
|
|
export MOCK_AUDIT_STATUS=2
|
|
run bash "${PROJECT_DIR}/src/scripts/node_audit.sh"
|
|
[ "$status" -ne 0 ]
|
|
printf 'invalid json' > full.json
|
|
run bash "${PROJECT_DIR}/src/scripts/node_audit.sh"
|
|
[ "$status" -ne 0 ]
|
|
}
|
|
|
|
@test "repositories without exceptions retain their existing audit gate" {
|
|
rm .npm-audit-exceptions.json
|
|
run bash "${PROJECT_DIR}/src/scripts/node_audit.sh"
|
|
[ "$status" -eq 1 ]
|
|
[[ "$output" == *"npm audit found high/critical"* ]]
|
|
}
|