aaronrene / overseer-kit public
test_post_land_sync_security.py python
108 lines 3.3 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 23 hours ago
1 """Security tier §PLS.10 — no force/clobber argv, muse-only zero argv, fail-closed refs."""
2
3 from __future__ import annotations
4
5 from pathlib import Path
6
7 import pytest
8
9 from tests.support import FakeGitRunner, gh_merged_runner, pls_config
10 from tools.close_ritual.pr_land import run_pr_land
11 from tools.close_ritual.post_land_sync import run_post_land_sync
12
13 KIT_ROOT = Path(__file__).resolve().parent.parent.parent
14
15 FORBIDDEN_FRAGMENTS = ("--force", "reset", "--hard", "clean", "-fd", "--auto", "stash")
16
17
18 @pytest.mark.parametrize(
19 "porcelain, branch",
20 [
21 ("", "main"),
22 ("", "feat/pls-sec"),
23 (" M dirty.md\n", "main"),
24 (" M dirty.md\n", "feat/pls-sec"),
25 ],
26 )
27 def test_call_log_never_contains_force_or_clobber(
28 repo_root: Path, porcelain: str, branch: str
29 ) -> None:
30 git = FakeGitRunner(porcelain=porcelain, branch=branch)
31 run_post_land_sync(
32 repo_root=repo_root,
33 regime="git-only",
34 remote="origin",
35 main_branch="main",
36 git_runner=git,
37 )
38 for call in git.calls:
39 for fragment in FORBIDDEN_FRAGMENTS:
40 assert fragment not in call, f"forbidden {fragment!r} in {call}"
41
42
43 def test_muse_only_fixture_zero_git_and_gh_argv_from_sync(repo_root: Path) -> None:
44 git = FakeGitRunner()
45 gh_calls: list[list[str]] = []
46 gh = gh_merged_runner()
47
48 def recording_gh(cmd: list[str]):
49 gh_calls.append(list(cmd))
50 return gh(cmd)
51
52 result = run_pr_land(
53 "5",
54 authorization="operator: muse-only security",
55 runner=recording_gh,
56 sleep_fn=lambda _s: None,
57 repo_root=repo_root,
58 config=pls_config(repo_root, "config-muse-only.yaml"),
59 git_runner=git,
60 )
61 assert result.post_land_sync["status"] == "regime_skipped"
62 assert git.calls == []
63 # gh argv comes only from the merge path itself, never from the sync helper.
64 assert all(call[:2] in (["gh", "pr"],) for call in gh_calls)
65 merge_calls = [c for c in gh_calls if c[:3] == ["gh", "pr", "merge"]]
66 assert all("--auto" not in c for c in merge_calls)
67
68
69 @pytest.mark.parametrize(
70 "remote, main_branch",
71 [
72 ("--upload-pack=/tmp/evil", "main"),
73 ("origin", "--force"),
74 ("origin", "main branch"),
75 ("origin\n", "main"),
76 ("", "main"),
77 ("origin", ""),
78 ],
79 )
80 def test_metacharacter_refs_fail_closed_with_zero_git_argv(
81 repo_root: Path, remote: str, main_branch: str
82 ) -> None:
83 git = FakeGitRunner()
84 report = run_post_land_sync(
85 repo_root=repo_root,
86 regime="git-only",
87 remote=remote,
88 main_branch=main_branch,
89 git_runner=git,
90 )
91 assert report.status == "failed"
92 assert git.calls == []
93
94
95 def test_refuse_blind_auto_merge_policy_still_holds(repo_root: Path) -> None:
96 tiers = (KIT_ROOT / "policy" / "tiers.yaml").read_text(encoding="utf-8")
97 assert "refuse_blind_auto_merge: true" in tiers
98 # PrLandResult.auto_merge stays False even through a synced land.
99 result = run_pr_land(
100 "5",
101 authorization="operator: policy check",
102 runner=gh_merged_runner(),
103 sleep_fn=lambda _s: None,
104 repo_root=repo_root,
105 config=pls_config(repo_root),
106 git_runner=FakeGitRunner(branch="main"),
107 )
108 assert result.auto_merge is False
File History 1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 23 hours ago