mirror of
https://github.com/elder-plinius/OBLITERATUS.git
synced 2026-08-17 16:37:30 +02:00
100 lines
3.4 KiB
Python
100 lines
3.4 KiB
Python
"""Tests for software-only conditional evidence freshness policy."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
from scripts import check_conditional_policy
|
|
|
|
|
|
ROOT = Path(__file__).parents[1]
|
|
SHA = "0123456789abcdef0123456789abcdef01234567"
|
|
OLD_SHA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
|
|
|
|
|
def _write_evidence(path: Path, gate: str, *, git_sha: str = SHA, status: str = "passed") -> None:
|
|
path.write_text(
|
|
json.dumps({
|
|
"schema_version": 1,
|
|
"gate": gate,
|
|
"status": status,
|
|
"git_sha": git_sha,
|
|
}),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
|
|
def test_software_evidence_accepts_exact_candidate_sha(tmp_path):
|
|
_write_evidence(tmp_path / "network-services.json", "network-services")
|
|
|
|
assert check_conditional_policy.validate_evidence(
|
|
ROOT / "ci" / "conditional-test-policy.json",
|
|
tmp_path,
|
|
candidate_sha=SHA,
|
|
required_gates=["network-services"],
|
|
) == []
|
|
|
|
|
|
def test_software_evidence_rejects_stale_failed_or_mismatched_records(tmp_path):
|
|
_write_evidence(tmp_path / "network-services.json", "wrong-gate", git_sha=OLD_SHA)
|
|
_write_evidence(tmp_path / "operator-ui.json", "operator-ui", status="failed")
|
|
|
|
errors = check_conditional_policy.validate_evidence(
|
|
ROOT / "ci" / "conditional-test-policy.json",
|
|
tmp_path,
|
|
candidate_sha=SHA,
|
|
required_gates=["network-services", "operator-ui"],
|
|
)
|
|
|
|
assert "conditional evidence network-services records gate 'wrong-gate'" in errors
|
|
assert (
|
|
"conditional evidence network-services git_sha "
|
|
f"'{OLD_SHA}' does not match candidate {SHA}"
|
|
) in errors
|
|
assert "conditional evidence operator-ui did not pass: 'failed'" in errors
|
|
|
|
|
|
def test_maintainer_exception_only_allows_sha_mismatch(tmp_path):
|
|
_write_evidence(tmp_path / "external-evaluation.json", "external-evaluation", git_sha=OLD_SHA)
|
|
|
|
assert check_conditional_policy.validate_evidence(
|
|
ROOT / "ci" / "conditional-test-policy.json",
|
|
tmp_path,
|
|
candidate_sha=SHA,
|
|
required_gates=["external-evaluation"],
|
|
stale_exception_reason="Gate reviewed against equivalent conditional surface.",
|
|
stale_exception_issue="https://github.com/elder-plinius/OBLITERATUS/issues/123",
|
|
) == []
|
|
|
|
|
|
def test_exception_requires_reason_and_issue_url(tmp_path):
|
|
_write_evidence(tmp_path / "external-evaluation.json", "external-evaluation", git_sha=OLD_SHA)
|
|
|
|
errors = check_conditional_policy.validate_evidence(
|
|
ROOT / "ci" / "conditional-test-policy.json",
|
|
tmp_path,
|
|
candidate_sha=SHA,
|
|
required_gates=["external-evaluation"],
|
|
stale_exception_reason="reviewed",
|
|
)
|
|
|
|
assert (
|
|
"stale evidence exception requires a non-empty reason and an OBLITERATUS issue URL"
|
|
) in errors
|
|
assert (
|
|
"conditional evidence external-evaluation git_sha "
|
|
f"'{OLD_SHA}' does not match candidate {SHA}"
|
|
) in errors
|
|
|
|
|
|
def test_evidence_freshness_does_not_make_hardware_lanes_mandatory(tmp_path):
|
|
_write_evidence(tmp_path / "cuda-runtime.json", "cuda-runtime")
|
|
|
|
assert check_conditional_policy.validate_evidence(
|
|
ROOT / "ci" / "conditional-test-policy.json",
|
|
tmp_path,
|
|
candidate_sha=SHA,
|
|
required_gates=["cuda-runtime"],
|
|
) == ["hardware or credential gate is not software-only: cuda-runtime"]
|