f80498513e
Add strict Python and checked JavaScript tooling, explicit source-scope checks and real rejection probes to CI. Preserve existing runtime behavior and document the limited bundle and test portability changes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex GPT-6 <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>
108 lines
4.2 KiB
Python
108 lines
4.2 KiB
Python
# Copyright 2026 Kingsrook, LLC
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
"""Exercise the exact CI guards using synthetic evidence only."""
|
|
|
|
import contextlib
|
|
import copy
|
|
import importlib.util
|
|
import io
|
|
import json
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from types import ModuleType
|
|
from typing import Any, override
|
|
|
|
sys.dont_write_bytecode = True
|
|
|
|
|
|
def load(name: str) -> ModuleType:
|
|
"""Load the real sibling guard for synthetic evidence tests."""
|
|
spec = importlib.util.spec_from_file_location(name, Path(__file__).with_name(name + ".py"))
|
|
assert spec is not None and spec.loader is not None
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
codeql = load("check-codeql-sarif")
|
|
|
|
|
|
class SarifTests(unittest.TestCase):
|
|
"""Reject incomplete SARIF evidence and preserve severity enforcement."""
|
|
|
|
@override
|
|
def setUp(self) -> None:
|
|
"""Create isolated synthetic evidence with cleanup after each test."""
|
|
self.temporary = tempfile.TemporaryDirectory()
|
|
self.addCleanup(self.temporary.cleanup)
|
|
self.directory = Path(self.temporary.name)
|
|
self.report: dict[str, Any] = {"version": "2.1.0", "runs": [{"tool": {"driver": {"name": "CodeQL", "rules": [{"id": "synthetic", "properties": {"security-severity": "8.0"}}]}}, "results": []}]}
|
|
|
|
def save(self, report: object) -> None:
|
|
"""Write the test body as SARIF without validating it first."""
|
|
(self.directory / "java.sarif").write_text(json.dumps(report), encoding="utf-8")
|
|
|
|
def test_clean_report_with_zero_findings_passes(self) -> None:
|
|
"""Verify clean report with zero findings passes."""
|
|
self.save(self.report)
|
|
self.assertFalse(codeql.check(self.directory, "java-kotlin", 7))
|
|
|
|
def test_missing_report_or_wrong_language_fails(self) -> None:
|
|
"""Verify missing report or wrong language fails."""
|
|
with self.assertRaises(ValueError):
|
|
codeql.check(self.directory, "java-kotlin", 7)
|
|
self.save(self.report)
|
|
with self.assertRaises(ValueError):
|
|
codeql.check(self.directory, "csharp", 7)
|
|
|
|
def test_empty_or_malformed_report_fails(self) -> None:
|
|
"""Verify empty or malformed report fails."""
|
|
for text in ["", "{", "null", "[]"]:
|
|
with self.subTest(text=text):
|
|
(self.directory / "java.sarif").write_text(text)
|
|
with self.assertRaises((ValueError, AttributeError)):
|
|
codeql.check(self.directory, "java-kotlin", 7)
|
|
|
|
def test_missing_runs_tool_rules_or_results_fails(self) -> None:
|
|
"""Verify missing runs tool rules or results fails."""
|
|
variants: list[dict[str, Any]] = [{"version": "2.1.0"}, {"version": "2.1.0", "runs": []}]
|
|
for field in ["tool", "results"]:
|
|
bad = copy.deepcopy(self.report)
|
|
del bad["runs"][0][field]
|
|
variants.append(bad)
|
|
bad = copy.deepcopy(self.report)
|
|
bad["runs"][0]["tool"]["driver"]["rules"] = []
|
|
variants.append(bad)
|
|
for bad in variants:
|
|
with self.subTest(report=bad):
|
|
self.save(bad)
|
|
with self.assertRaises(ValueError):
|
|
codeql.check(self.directory, "java-kotlin", 7)
|
|
|
|
def test_high_finding_blocks_and_unknown_rule_fails(self) -> None:
|
|
"""Verify high finding blocks and unknown rule fails."""
|
|
self.report["runs"][0]["results"] = [{"ruleId": "synthetic"}]
|
|
self.save(self.report)
|
|
with contextlib.redirect_stdout(io.StringIO()):
|
|
self.assertTrue(codeql.check(self.directory, "java-kotlin", 7))
|
|
self.report["runs"][0]["results"] = [{"ruleId": "missing"}]
|
|
self.save(self.report)
|
|
with self.assertRaises(ValueError):
|
|
codeql.check(self.directory, "java-kotlin", 7)
|
|
|
|
def test_failed_invocation_and_invalid_threshold_fail(self) -> None:
|
|
"""Verify failed invocation and invalid threshold fail."""
|
|
self.report["runs"][0]["invocations"] = [{"executionSuccessful": False}]
|
|
self.save(self.report)
|
|
with self.assertRaises(ValueError):
|
|
codeql.check(self.directory, "java-kotlin", 7)
|
|
with self.assertRaises(ValueError):
|
|
codeql.check(self.directory, "java-kotlin", float("nan"))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|