mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-10 15:09:00 +02:00
Garry TanandClaude Fable 5
2398fb7295
The evidence/review-log/hook fixtures inherited global commit.gpgsign, so fixture commits called the operator's gpg-agent — which fails with "Cannot allocate memory" under parallel shard load, breaking test SETUP (not the code under test). All fixture git invocations now pass -c commit.gpgsign=false -c tag.gpgsign=false. Hermetic repos, no pinentry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
287 lines
12 KiB
TypeScript
287 lines
12 KiB
TypeScript
import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
|
|
import { execSync, spawnSync } from 'child_process';
|
|
import * as fs from 'fs';
|
|
import * as path from 'path';
|
|
import * as os from 'os';
|
|
|
|
const ROOT = path.resolve(import.meta.dir, '..');
|
|
const EVIDENCE = path.join(ROOT, 'bin', 'gstack-evidence');
|
|
|
|
let gstackHome: string;
|
|
let repoDir: string;
|
|
|
|
function git(args: string) {
|
|
execSync(`git -c user.email=t@test -c user.name=t -c commit.gpgsign=false -c tag.gpgsign=false ${args}`, { cwd: repoDir, encoding: 'utf-8', timeout: 10000 });
|
|
}
|
|
|
|
function run(args: string[], opts: { cwd?: string } = {}): { status: number; stdout: string; stderr: string } {
|
|
const r = spawnSync(EVIDENCE, args, {
|
|
cwd: opts.cwd ?? repoDir,
|
|
env: { ...process.env, GSTACK_HOME: gstackHome },
|
|
encoding: 'utf-8',
|
|
timeout: 60000,
|
|
maxBuffer: 16 * 1024 * 1024, // the truncation test streams 3MB through the wrapper
|
|
});
|
|
return { status: r.status ?? 1, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
|
|
}
|
|
|
|
function ledgerFile(): string {
|
|
const found: string[] = [];
|
|
const walk = (d: string) => {
|
|
if (!fs.existsSync(d)) return;
|
|
for (const e of fs.readdirSync(d, { withFileTypes: true })) {
|
|
const p = path.join(d, e.name);
|
|
if (e.isDirectory()) walk(p);
|
|
else if (e.name.endsWith('-evidence.jsonl')) found.push(p);
|
|
}
|
|
};
|
|
walk(path.join(gstackHome, 'projects'));
|
|
expect(found.length).toBeGreaterThan(0);
|
|
return found[0];
|
|
}
|
|
|
|
function records(): any[] {
|
|
return fs
|
|
.readFileSync(ledgerFile(), 'utf-8')
|
|
.trim()
|
|
.split('\n')
|
|
.map((l) => JSON.parse(l));
|
|
}
|
|
|
|
beforeEach(() => {
|
|
gstackHome = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-evidence-home-'));
|
|
repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-evidence-repo-'));
|
|
git('init -q -b main');
|
|
fs.writeFileSync(path.join(repoDir, 'src.txt'), 'v1\n');
|
|
fs.writeFileSync(path.join(repoDir, '.gitignore'), 'scratch.txt\n');
|
|
git('add src.txt .gitignore');
|
|
git('commit -q -m init');
|
|
});
|
|
|
|
afterEach(() => {
|
|
fs.rmSync(gstackHome, { recursive: true, force: true });
|
|
fs.rmSync(repoDir, { recursive: true, force: true });
|
|
});
|
|
|
|
describe('gstack-evidence run', () => {
|
|
test('records a complete evidence record and propagates exit 0', () => {
|
|
const r = run(['run', '--label', 'tests', '--', 'echo ok']);
|
|
expect(r.status).toBe(0);
|
|
expect(r.stdout).toContain('ok');
|
|
expect(r.stderr).toContain('recorded label=tests exit=0');
|
|
const rec = records().pop();
|
|
expect(rec.label).toBe('tests');
|
|
expect(rec.command).toBe('echo ok');
|
|
expect(rec.cmd_sha256).toMatch(/^[0-9a-f]{64}$/);
|
|
expect(rec.exit).toBe(0);
|
|
expect(typeof rec.duration_s).toBe('number');
|
|
expect(rec.commit).toMatch(/^[0-9a-f]{40}$/);
|
|
expect(rec.tree).toMatch(/^[0-9a-f]{40}$/);
|
|
expect(rec.wtree).toMatch(/^[0-9a-f]{40}$/);
|
|
expect(typeof rec.dirty).toBe('boolean');
|
|
expect(fs.existsSync(rec.log_path)).toBe(true);
|
|
expect(fs.readFileSync(rec.log_path, 'utf-8')).toContain('ok');
|
|
});
|
|
|
|
test('propagates a failing exit code and records it', () => {
|
|
const r = run(['run', '--label', 'tests', '--', 'exit 3']);
|
|
expect(r.status).toBe(3);
|
|
expect(records().pop().exit).toBe(3);
|
|
});
|
|
|
|
test('spawn failure (ENOENT, argv-direct form) records and propagates 127', () => {
|
|
const r = run(['run', '--label', 'tests', '--', '/nonexistent-gstack-binary', 'arg']);
|
|
expect(r.status).toBe(127);
|
|
expect(records().pop().exit).toBe(127);
|
|
});
|
|
|
|
test('TRANSPARENCY: ledger failure never breaks the command (append-failure injection)', () => {
|
|
// Point GSTACK_HOME somewhere mkdir cannot succeed.
|
|
const r = spawnSync(EVIDENCE, ['run', '--label', 'tests', '--', 'echo still-ran'], {
|
|
cwd: repoDir,
|
|
env: { ...process.env, GSTACK_HOME: '/dev/null/nope' },
|
|
encoding: 'utf-8',
|
|
timeout: 60000,
|
|
});
|
|
expect(r.status).toBe(0);
|
|
expect(r.stdout).toContain('still-ran');
|
|
expect(r.stderr).toContain('warning');
|
|
});
|
|
|
|
test('ledger and log files are 0600', () => {
|
|
run(['run', '--label', 'tests', '--', 'echo ok']);
|
|
const rec = records().pop();
|
|
expect(fs.statSync(ledgerFile()).mode & 0o777).toBe(0o600);
|
|
expect(fs.statSync(rec.log_path).mode & 0o777).toBe(0o600);
|
|
});
|
|
|
|
test('two rapid runs get distinct log files (collision-safe exclusive open)', () => {
|
|
run(['run', '--label', 'tests', '--', 'echo one']);
|
|
run(['run', '--label', 'tests', '--', 'echo two']);
|
|
const [a, b] = records().slice(-2);
|
|
expect(a.log_path).not.toBe(b.log_path);
|
|
});
|
|
|
|
test('log truncates at 2MB with a marker; exit code unaffected', () => {
|
|
const r = run(['run', '--label', 'big', '--', 'head -c 3000000 /dev/zero | tr "\\0" a']);
|
|
expect(r.status).toBe(0);
|
|
const rec = records().pop();
|
|
const size = fs.statSync(rec.log_path).size;
|
|
expect(size).toBeLessThanOrEqual(2 * 1024 * 1024 + 200);
|
|
expect(fs.readFileSync(rec.log_path, 'utf-8')).toContain('log truncated at 2MB');
|
|
});
|
|
|
|
test('logs older than 30 days are pruned opportunistically', () => {
|
|
run(['run', '--label', 'tests', '--', 'echo ok']);
|
|
const logsDir = path.dirname(records().pop().log_path);
|
|
const oldLog = path.join(logsDir, 'ancient.log');
|
|
fs.writeFileSync(oldLog, 'old');
|
|
const past = new Date(Date.now() - 40 * 24 * 3600 * 1000);
|
|
fs.utimesSync(oldLog, past, past);
|
|
run(['run', '--label', 'tests', '--', 'echo again']);
|
|
expect(fs.existsSync(oldLog)).toBe(false);
|
|
});
|
|
|
|
test('works as a backgrounded job (ship Step 5 lanes run with & wait)', () => {
|
|
execSync(`bash -c '"${EVIDENCE}" run --label bg -- "echo backgrounded" & wait'`, {
|
|
cwd: repoDir,
|
|
env: { ...process.env, GSTACK_HOME: gstackHome },
|
|
encoding: 'utf-8',
|
|
timeout: 60000,
|
|
});
|
|
const rec = records().pop();
|
|
expect(rec.label).toBe('bg');
|
|
expect(rec.exit).toBe(0);
|
|
});
|
|
|
|
test('a HIGH credential in the command is stored redacted', () => {
|
|
const r = run(['run', '--label', 'sec', '--', 'echo ghp_A8bC2dE4fG6hI8jK0lM2nO4pQ6rS8tU0vW2x deploy']);
|
|
expect(r.status).toBe(0);
|
|
const rec = records().pop();
|
|
expect(rec.command).not.toContain('ghp_A8bC2dE4fG6hI8jK0lM2nO4pQ6rS8tU0vW2x');
|
|
expect(rec.redacted).toBe(true);
|
|
// The hash still binds to the ORIGINAL exact string (freshness key).
|
|
expect(rec.cmd_sha256).toMatch(/^[0-9a-f]{64}$/);
|
|
});
|
|
});
|
|
|
|
describe('gstack-evidence check', () => {
|
|
test('KEYSTONE: evidence recorded on a dirty tree stays FRESH after committing the exact tested content', () => {
|
|
// Dirty the tree (this is /ship Step 5: tests run on uncommitted code).
|
|
fs.writeFileSync(path.join(repoDir, 'src.txt'), 'v2-tested\n');
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
expect(records().pop().dirty).toBe(true);
|
|
|
|
// Step 15: commit the exact same content. HEAD tree changes; working-tree
|
|
// content does not.
|
|
git('commit -q -am ship');
|
|
|
|
const chk = run(['check', '--label', 'tests']);
|
|
expect(chk.status).toBe(0);
|
|
expect(chk.stdout).toContain('EVIDENCE: FRESH');
|
|
});
|
|
|
|
test('a content change after the run grades STALE', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
fs.writeFileSync(path.join(repoDir, 'src.txt'), 'changed-after-tests\n');
|
|
const chk = run(['check', '--label', 'tests']);
|
|
expect(chk.status).toBe(1);
|
|
expect(chk.stdout).toContain('EVIDENCE: STALE');
|
|
});
|
|
|
|
test('an untracked NEW source file grades STALE; gitignored scratch stays FRESH', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
|
|
fs.writeFileSync(path.join(repoDir, 'scratch.txt'), 'conductor noise\n');
|
|
expect(run(['check', '--label', 'tests']).status).toBe(0);
|
|
|
|
fs.writeFileSync(path.join(repoDir, 'brand-new.ts'), 'export {}\n');
|
|
const chk = run(['check', '--label', 'tests']);
|
|
expect(chk.status).toBe(1);
|
|
expect(chk.stdout).toContain('STALE');
|
|
});
|
|
|
|
test('allow-paths carve-out: a CHANGELOG-only change stays FRESH with --allow-paths', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
fs.writeFileSync(path.join(repoDir, 'CHANGELOG.md'), '## v1\n');
|
|
git('add CHANGELOG.md');
|
|
git('commit -q -m changelog');
|
|
|
|
const without = run(['check', '--label', 'tests']);
|
|
expect(without.status).toBe(1);
|
|
|
|
const withAllow = run(['check', '--label', 'tests', '--allow-paths', 'CHANGELOG.md,VERSION,package.json']);
|
|
expect(withAllow.status).toBe(0);
|
|
expect(withAllow.stdout).toContain('FRESH');
|
|
|
|
// A source change is NOT rescued by the allow-list.
|
|
fs.writeFileSync(path.join(repoDir, 'src.txt'), 'v3\n');
|
|
expect(run(['check', '--label', 'tests', '--allow-paths', 'CHANGELOG.md']).status).toBe(1);
|
|
});
|
|
|
|
test('--expect-cmd binds the label to the exact command string', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
expect(run(['check', '--label', 'tests', '--expect-cmd', 'echo green']).status).toBe(0);
|
|
const mismatch = run(['check', '--label', 'tests', '--expect-cmd', 'echo cheaper-command']);
|
|
expect(mismatch.status).toBe(1);
|
|
expect(mismatch.stdout).toContain('cmd_sha256 mismatch');
|
|
});
|
|
|
|
test('a recorded FAILING run is never FRESH', () => {
|
|
run(['run', '--label', 'tests', '--', 'exit 1']);
|
|
const chk = run(['check', '--label', 'tests']);
|
|
expect(chk.status).toBe(1);
|
|
expect(chk.stdout).toContain('recorded run failed');
|
|
});
|
|
|
|
test('--max-age expires old records', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
const file = ledgerFile();
|
|
const rec = JSON.parse(fs.readFileSync(file, 'utf-8').trim());
|
|
rec.ts = new Date(Date.now() - 48 * 3600 * 1000).toISOString();
|
|
fs.writeFileSync(file, JSON.stringify(rec) + '\n');
|
|
const chk = run(['check', '--label', 'tests', '--max-age', '24']);
|
|
expect(chk.status).toBe(1);
|
|
expect(chk.stdout).toContain('older than 24h');
|
|
});
|
|
|
|
test('a gc-d / fabricated stored fingerprint degrades to STALE, never a crash', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
const file = ledgerFile();
|
|
const rec = JSON.parse(fs.readFileSync(file, 'utf-8').trim());
|
|
rec.wtree = 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeef';
|
|
fs.writeFileSync(file, JSON.stringify(rec) + '\n');
|
|
const chk = run(['check', '--label', 'tests']);
|
|
expect(chk.status).toBe(1);
|
|
expect(chk.stdout).toContain('STALE');
|
|
});
|
|
|
|
test('a green lane never masks a red sibling: every named label must be FRESH', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
run(['run', '--label', 'vitest', '--', 'exit 1']);
|
|
const chk = run(['check', '--label', 'tests', '--label', 'vitest']);
|
|
expect(chk.status).toBe(1);
|
|
expect(chk.stdout).toContain('EVIDENCE: FRESH label=tests');
|
|
expect(chk.stdout).toContain('EVIDENCE: STALE label=vitest');
|
|
});
|
|
|
|
test('MISSING for a label that never ran (explicit labels prove expected lanes)', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
const chk = run(['check', '--label', 'tests', '--label', 'never-ran']);
|
|
expect(chk.status).toBe(1);
|
|
expect(chk.stdout).toContain('MISSING label=never-ran');
|
|
});
|
|
|
|
test('check never errors outside a git repo — degrades to STALE', () => {
|
|
expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
|
|
const nonGit = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-evidence-nongit-'));
|
|
try {
|
|
const chk = run(['check', '--label', 'tests'], { cwd: nonGit });
|
|
expect([0, 1]).toContain(chk.status); // different slug → MISSING; the point is: no crash
|
|
expect(chk.status).toBe(1);
|
|
} finally {
|
|
fs.rmSync(nonGit, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|