aaronrene / overseer-kit public
test_governance_sync_security.py python
71 lines 2.6 KB
Raw
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 54 days ago
1 """Security tests for governance-sync (§8 security tier)."""
2
3 from __future__ import annotations
4
5 from pathlib import Path
6
7 import pytest
8
9 from cli.kit_root import kit_root
10 from tests.support import FIXTURES, fail, ok, make_runner, run_cli, write_config
11 from tools.governance_hygiene.engine import _commit_message
12 from tools.governance_hygiene.types import DriftReport
13
14
15 def test_commit_message_has_no_hardcoded_repo_sha() -> None:
16 drift = DriftReport(
17 d1_handover_vs_git="drifted",
18 d2_anchor_vs_canonical="aligned",
19 d3_queue_vs_merged="aligned",
20 )
21 message = _commit_message("abcdef1234567890", drift, ("vcs-table",), None)
22 assert "abcdef1" in message
23 assert "deadbeef" not in message
24 assert "cdd669f" not in message
25
26
27 def test_gh_auth_failure_fails_closed(tmp_path: Path) -> None:
28 write_config(tmp_path, "config-git-only.yaml")
29 docs = tmp_path / "docs"
30 docs.mkdir(parents=True, exist_ok=True)
31 (docs / "OVERSEER-HANDOVER.md").write_text(
32 (FIXTURES / "governance-handover-drift.md").read_text(encoding="utf-8"),
33 encoding="utf-8",
34 )
35 (docs / "ROADMAP.md").write_text(
36 (FIXTURES / "governance-roadmap-drift.md").read_text(encoding="utf-8"),
37 encoding="utf-8",
38 )
39 runner = make_runner(
40 {
41 "git rev-parse --abbrev-ref HEAD": ok("main"),
42 "git status --porcelain": ok(""),
43 "git rev-parse origin/main": ok("cafebabe"),
44 "gh pr list": fail("not authenticated", 1),
45 }
46 )
47 handover = tmp_path / "docs" / "OVERSEER-HANDOVER.md"
48 before = handover.read_text(encoding="utf-8")
49 code = run_cli(["governance-sync"], cwd=tmp_path, runner=runner, kit=kit_root())
50 assert code == 2
51 assert handover.read_text(encoding="utf-8") == before
52
53
54 def test_muse_only_never_invokes_git(tmp_path: Path) -> None:
55 write_config(tmp_path, "config-muse-only.yaml")
56 docs = tmp_path / "docs"
57 docs.mkdir(parents=True, exist_ok=True)
58 (docs / "MUSEHUB-OVERSEER-HANDOVER.md").write_text("# handover\n", encoding="utf-8")
59 (docs / "MUSEHUB-ROADMAP.md").write_text("# roadmap\n\n## Build queue\n", encoding="utf-8")
60 root = str(tmp_path.resolve())
61 runner = make_runner(
62 {
63 f"muse -C {root} branch --show-current": ok("main"),
64 f"muse -C {root} status --porcelain": ok(""),
65 f"muse -C {root} rev-parse main": ok('{"commit_id": "sha256:abc"}'),
66 }
67 )
68 code = run_cli(["governance-sync"], cwd=tmp_path, runner=runner, kit=kit_root())
69 assert code in {0, 2}
70 assert not any("git " in call[0] for call in runner.calls)
71 assert not any("gh " in call[0] for call in runner.calls)
File History 1 commit
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 54 days ago