mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-28 07:32:14 +02:00
v1.90.0.0 feat: make browser cookie imports explicit and safe (#2964)
* fix(browse): prepare reliable cookie import wave for validation * ci: sequence quality and behavior for validation branch * fix(browse): isolate Windows qualification and preserve native diagnostics * test(browse): cover cookie workflow quality and isolate Windows user paths * test(browse): trace native member startup and initialize fresh folders * fix(browse): keep Windows member stdin alive through EOF * fix(browse): latch native timeouts and compare contained Edge startup * test(browse): verify native version metadata and actual Windows argv * test(browse): qualify Dia import on isolated macOS CI * fix(browse): require picker origin for session mutations * fix(browse): bound credential reads through stream completion * test(browse): inspect owned Windows process arguments natively * test(evals): preserve passing coverage during cookie repair reruns * test(browse): isolate Dia qualification in a fresh macOS account * test(browse): pass bounded integer timeouts to native Mac probes * test(browse): distinguish Windows profile initialization from containment * test(browse): await descendant pipe readiness before parent exit * test(browse): initialize and restore isolated macOS Keychain state * test(browse): initialize Windows fixture folders before qualification * test(ci): pin the same Node runtime across Windows checks * test(browse): distinguish native macOS browser preflight stages * test(browse): isolate Windows descendant console lifetime * test(browse): preserve native receipts and identify fixture lock holders * test(browse): prepare dependency resolution before native Mac worker startup * test(ci): include lock and close checks in native diagnostics * test(browse): preserve native owner probe stages and subprocess deadlines * fix(browse): classify Chromium profile-in-use exit precisely * test(browse): retain Mac qualification evidence through cleanup failures * test(browse): bound Mac fixture paths and retire its owned user domain * test(browse): accept vanished fixture entries without weakening cleanup * test(browse): identify probe-created macOS user domains safely * test(browse): observe Mac user domains without targeting them first * test(browse): use passive fresh-user ownership throughout Mac qualification * test(browse): distinguish profile and registered-home Keychain lookups * test(browse): qualify Dia under one registered account home * test(browse): identify Dia startup and owned process-group failures * test(browse): classify bounded Dia startup diagnostics without leaking output * fix(test): preserve native Mac sandboxing and reap owned browser children * fix(browse): preserve Chromium sandboxing for native profile imports * test(browse): inspect signed Mach-O architecture without launching Xcode tools * test(browse): sample pending Dia startup and reap on all cleanup paths * test(browse): compare protected Dia launches in fresh Bun and Node accounts * test(browse): inspect isolated Mac GUI readiness without browser access * v1.90.0.0 fix: bind cookie picker actions to their document * test: validate cookie guards and fit nested launch fixtures * ci: configure the bundled Chromium sandbox helper * fix(browse): classify Playwright authentication timeouts * test: retain bounded Windows lifecycle diagnostics * test(cso): reuse bounded NTFS precision candidates * test(review): handle explicit preservation choices safely * test(browse): remove owned fixture directories with explicit primitives * test(review): distinguish descriptive reuse from edit commitments * test: admit only the approved unscored cookie workflow refusal * test: keep the Office Hours judge mock export-complete * fix: keep dependency-free CI planners independent of the model SDK * test: observe the exact holder after a native fixture unlink failure * fix: start seeded PTY observations at owned readiness * test: acquire identity-bound Windows deletion admission before profile resets * test: preserve qualified Git index bits without authorizing mutations
This commit is contained in:
Garry Tan
@@ -1,5 +1,5 @@
|
||||
import { expect, test } from 'bun:test';
|
||||
import { readFileSync, writeFileSync, mkdtempSync, mkdirSync, rmSync } from 'node:fs';
|
||||
import { readFileSync, writeFileSync, mkdtempSync, mkdirSync, rmSync, chmodSync } from 'node:fs';
|
||||
import { resolve, join } from 'node:path';
|
||||
import { tmpdir } from 'node:os';
|
||||
import { spawnSync } from 'node:child_process';
|
||||
@@ -102,3 +102,66 @@ test.skipIf(!Bun.which('jq'))('the actual comment separates reused evidence, ret
|
||||
expect(text).toContain('receive no PR-pass credit');
|
||||
expect(comment).not.toContain('diff-selected gate census');
|
||||
});
|
||||
|
||||
test.skipIf(!Bun.which('jq') || !Bun.which('bash'))('comment consumes verified final counts without running repository code and fails closed without them', () => {
|
||||
const job = paid.jobs['slices-comment'];
|
||||
expect(job.permissions).toMatchObject({ 'pull-requests': 'write' });
|
||||
expect(JSON.stringify(job.steps)).not.toMatch(/actions\/checkout|setup-bun|bun run|npm |node /);
|
||||
const upload = paid.jobs['slices-report'].steps.find((step: any) => step.with?.name === 'report-verdict');
|
||||
expect(upload.with.path.trim().split('\n')).toEqual(['/tmp/report.txt', '/tmp/paid-report/collector-outcomes.json']);
|
||||
expect(job.steps.find((step: any) => step.with?.name === 'report-verdict').with.path).toBe('/tmp/verdict');
|
||||
const root = mkdtempSync(join(tmpdir(), 'ci-comment-'));
|
||||
const paidDir = join(root, 'paid-report');
|
||||
const verdictDir = join(root, 'verdict');
|
||||
const binDir = join(root, 'bin');
|
||||
mkdirSync(paidDir); mkdirSync(verdictDir); mkdirSync(binDir);
|
||||
writeFileSync(join(binDir, 'gh'), '#!/bin/sh\ncase "$*" in *--jq*) exit 0;; esac\nfor arg do case "$arg" in body=*) printf "%s\\n" "${arg#body=}";; esac; done\n');
|
||||
chmodSync(join(binDir, 'gh'), 0o755);
|
||||
writeFileSync(join(binDir, 'bc'), '#!/bin/sh\nread -r expression\n[ "$expression" = "0 + 0" ] && printf "0\\n"\n');
|
||||
chmodSync(join(binDir, 'bc'), 0o755);
|
||||
writeFileSync(join(paidDir, 'manifest.json'), JSON.stringify({ profile: 'pr', selection: { e2e: [], judges: [] } }));
|
||||
writeFileSync(join(paidDir, 'judge.json'), JSON.stringify({ total_tests: 2, tier: 'llm-judge', shard: 1,
|
||||
tests: [{ name: 'manual', passed: false, manual_review: { unverified: true } },
|
||||
{ name: 'reused', passed: true, execution: 'reused' }], flaky_retries: [] }));
|
||||
const summary = { version: 1, files: [{ file: 'judge.json', tier: 'llm-judge', shard: 1, cost: 0,
|
||||
total: 2, passed: 1, failed: 0, manual_accepted: 1, executed: 1, reused: 1, attempts: 2, flaky: 0 }],
|
||||
totals: { total: 2, passed: 1, failed: 0, manual_accepted: 1, executed: 1, reused: 1, attempts: 2, flaky: 0 } };
|
||||
mkdirSync(join(verdictDir, 'paid-report'));
|
||||
const summaryPath = join(verdictDir, 'paid-report/collector-outcomes.json');
|
||||
const script = (job.steps.find((step: any) => step.name === 'Post PR comment').run as string)
|
||||
.replaceAll('/tmp/paid-report', paidDir).replaceAll('/tmp/verdict', verdictDir)
|
||||
.replaceAll('${{ github.repository }}', 'garrytan/gstack')
|
||||
.replaceAll('${{ github.event.pull_request.number }}', '123');
|
||||
const check = spawnSync('bash', ['-n', '-c', script], { cwd: root, encoding: 'utf8', timeout: 5000 });
|
||||
expect(check.status, check.stderr).toBe(0);
|
||||
const run = () => spawnSync('bash', ['-e', '-c', script], { cwd: root,
|
||||
env: { ...process.env, PATH: `${binDir}:${process.env.PATH}`, RECONCILE_EXIT: '0' },
|
||||
encoding: 'utf8', timeout: 5000 });
|
||||
try {
|
||||
writeFileSync(summaryPath, JSON.stringify(summary));
|
||||
const verified = run();
|
||||
expect(verified.status, verified.stderr).toBe(0);
|
||||
expect(verified.stdout).toContain('⚠ MANUAL ACCEPTED (unscored)');
|
||||
expect(verified.stdout).toContain('1 automated passed / 2 final results');
|
||||
expect(verified.stdout).toContain('0 failed, 1 manual accepted');
|
||||
|
||||
const unrelatedFailure = { ...summary, files: [{ ...summary.files[0], total: 3, failed: 1,
|
||||
executed: 2, attempts: 3 }], totals: { ...summary.totals, total: 3, failed: 1,
|
||||
executed: 2, attempts: 3 } };
|
||||
writeFileSync(summaryPath, JSON.stringify(unrelatedFailure));
|
||||
const red = run();
|
||||
expect(red.status, red.stderr).toBe(0);
|
||||
expect(red.stdout).toContain('❌ FAIL');
|
||||
expect(red.stdout).toContain('1 failed, 1 manual accepted');
|
||||
|
||||
writeFileSync(summaryPath, JSON.stringify({ ...summary, totals: { ...summary.totals, manual_accepted: 2 } }));
|
||||
const tampered = run();
|
||||
expect(tampered.status, tampered.stderr).toBe(0);
|
||||
expect(tampered.stdout).toContain('manual acceptance unavailable/unverified');
|
||||
expect(tampered.stdout).not.toContain('⚠ MANUAL ACCEPTED (unscored)');
|
||||
rmSync(summaryPath);
|
||||
const absent = run();
|
||||
expect(absent.status, absent.stderr).toBe(0);
|
||||
expect(absent.stdout).toContain('manual acceptance unavailable/unverified');
|
||||
} finally { rmSync(root, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user