732642856
45 lines
1.8 KiB
Python
45 lines
1.8 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from scripts.public_release_privacy_scan import build_report, deny_patterns, iter_release_files, scan_text
|
|
|
|
|
|
def test_public_release_privacy_scan_finds_private_configured_pattern(monkeypatch) -> None:
|
|
monkeypatch.setenv("PUBLIC_RELEASE_DENY_PATTERNS", "SECRET_BIRTH_TOKEN")
|
|
findings = scan_text(
|
|
Path("sample.py"),
|
|
"safe text SECRET_BIRTH_TOKEN",
|
|
deny_patterns(),
|
|
)
|
|
assert {item["rule_id"] for item in findings} == {"private_env_pattern_01"}
|
|
|
|
|
|
def test_public_release_privacy_scan_has_no_release_findings() -> None:
|
|
report = build_report()
|
|
assert report["status"] == "pass", report["findings"][:20]
|
|
assert report["finding_count"] == 0
|
|
|
|
|
|
def test_public_release_privacy_scan_supports_unpacked_zip_without_git(tmp_path: Path) -> None:
|
|
(tmp_path / "INSTALL.md").write_text("safe install text\n", encoding="utf-8")
|
|
(tmp_path / "scratch").mkdir()
|
|
(tmp_path / "scratch" / "ignored.md").write_text("SECRET_BIRTH_TOKEN\n", encoding="utf-8")
|
|
|
|
assert [path.name for path in iter_release_files(tmp_path)] == ["INSTALL.md"]
|
|
report = build_report(tmp_path)
|
|
assert report["status"] == "pass", report["findings"]
|
|
|
|
|
|
def test_public_release_privacy_scan_rejects_executable_redaction_placeholder(tmp_path: Path) -> None:
|
|
(tmp_path / "unsafe.py").write_text("year = REDACTED_YEAR\n", encoding="utf-8")
|
|
report = build_report(tmp_path)
|
|
assert report["status"] == "fail"
|
|
assert report["findings"][0]["rule_id"] == "executable_redaction_placeholder"
|
|
|
|
|
|
def test_private_workspace_directories_are_gitignored() -> None:
|
|
gitignore = (Path(__file__).resolve().parents[1] / ".gitignore").read_text(encoding="utf-8").splitlines()
|
|
assert "/scratch/" in gitignore
|
|
assert "/.serena/" in gitignore
|