test(public-repository): cover the boundary errors contributors hit - #15
Open
dchaudhari7177 wants to merge 1 commit into
Open
test(public-repository): cover the boundary errors contributors hit#15dchaudhari7177 wants to merge 1 commit into
dchaudhari7177 wants to merge 1 commit into
Conversation
validate-public-repository.mjs is what stops restricted material reaching the public mirror, and nothing tested its messages. Add 18 node --test cases that build a temporary fixture tree and run the validator with --root, asserting the exact string a contributor would see. Covered, as the issue asks: a restricted directory (docs/security/), a blocked binary extension (.apk, .keystore, .safetensors, .pem), a missing community file, and a stale canonical repository URL. Also the neighbouring rules that would otherwise be easy to break -- the commercial-site link reported separately, non-text extensions correctly skipped, .env rejected while .env.example is allowed, a truncated LICENSE, SHA256SUMS mismatch and malformed entries, unclean provenance, and every required file enforced individually rather than as a set. Two cases pin fail-closed behaviour directly: a non-existent root must not pass, and several violations must all be reported rather than only the first. Fixtures are generated per test in a mkdtemp directory and contain no secrets or personal data -- blocked-extension files hold the literal string "not-a-real-key". The test file itself has to contain the stale URL and the commercial link to assert they are caught, which the validator then flagged in the test file. Add it to staleReferenceAllowlist, alongside the two files already there for the same reason. Nothing else about the validator changes, and it stays fail closed for every path outside that list: npm run public:repository:check reports the same 841 pre-existing findings as it does on a clean checkout, neither more nor fewer. Closes esherialabs#11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #11.
18
node --testcases, each building a temporary fixture tree and running the validator with--root, asserting the exact string a contributor would see.Acceptance criteria
docs/security/threat-model.md.apk,.keystore,.safetensors,.pemCODE_OF_CONDUCT.md, plus a case that removes every required file one at a time and asserts a specific message for eachesheria.ailink asserted separatelymkdtempper test; blocked-extension files hold the literalnot-a-real-key- <message>: <path>line, not just a substring of the categorynpm run public:repository:checkAlso pinned, since they were equally untested and easy to break: non-text extensions correctly skipped by the URL scan,
.envrejected while.env.exampleis allowed, truncatedLICENSE,SHA256SUMSmismatch and malformed entries, and unclean provenance.Two cases target fail-closed behaviour directly: a non-existent root must not pass, and several violations must all be reported, not just the first.
One validator change, and why it was unavoidable
To assert the stale-URL rule, the test file must itself contain
github.com/esherialabs/saferiderandhttps://esheria.ai. The validator then flagged the test file:So it is added to
staleReferenceAllowlist— the list that already exists for exactly this, holdingscripts/validate-public-repository.mjsandweb/tests/saferide-v2.spec.ts, both of which carry those strings for the same reason.Nothing else changes, and it stays fail closed everywhere else. Measured rather than asserted:
npm run public:repository:checkmainSame count as baseline — neither more nor fewer. The 841 are pre-existing
SHA256SUMSdrift inweb/, untouched by this PR.Result