marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: format the whole tree and lint the scratch measurement scripts; CI has been red since 25ae4b4

Browse Source 
CI runs ruff format --check and ruff check over the whole repository; 29 files had drifted from the formatter and
four measurement scripts carried lint findings, so every push since 25ae4b4 failed before pytest ran.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-14 02:49:44 +02:00
co-authored by Claude Fable 5.1
parent fbbc03f3ea
commit 0d7d3f0dc9
29 changed files with 281 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_complexity_ledger.py
-1
View File
@@ -164,7 +164,6 @@ def test_not_triggerable_overlay_drops_map_score_and_keeps_inventory(tmp_path: P
assert sev5.rationale == ("Static pattern cmd (CWE-78) matched os.system on line 12; manual verification still required.")
def test_ledger_round_trip_matches_design_schema(tmp_path: Path) -> None:
path = tmp_path / "complexity_ledger.json"
key = hotspot_key("parser.c", "parse_header")
tests/test_findings.py
-2
View File
@@ -90,5 +90,3 @@ def test_findings_inherit_only_matching_function_level_reachability(tmp_path: Pa
assert unreachable.function_name is None
assert unreachable.reachability_status == "unknown"
assert unreachable.ranking_priority <= 1.5
tests/test_hunt_artifact.py
+10 -3
View File
@@ -8,9 +8,16 @@ from openultrasast.hunt.artifact import RunArtifact, UsageLedger
def artifact():
return RunArtifact(program_id="program", schema_version=1, mask=("source",), data_digests={"train": "abc"},
configurations=[{"seed": 0}], usage={"usd": 0.1, "calls": 1, "replay_hits": 0, "wall_seconds": 2},
versions={"dspy": "3.4.0", "litellm": "1", "openultrasast": "2.0.1"}, created="2026-10-13T00:00:00Z")
return RunArtifact(
program_id="program",
schema_version=1,
mask=("source",),
data_digests={"train": "abc"},
configurations=[{"seed": 0}],
usage={"usd": 0.1, "calls": 1, "replay_hits": 0, "wall_seconds": 2},
versions={"dspy": "3.4.0", "litellm": "1", "openultrasast": "2.0.1"},
created="2026-10-13T00:00:00Z",
)
def test_artifact_round_trip_and_tamper(tmp_path):
tests/test_hunt_labels.py
+14 -6
View File
@@ -7,15 +7,23 @@ from openultrasast.hunt.table import FeatureTable
def positive():
return {"kind": "vulnerability", "path": "app.py", "function": "handle", "function_lines": [10, 20],
"family": "injection", "case_id": "verified-case"}
return {
"kind": "vulnerability",
"path": "app.py",
"function": "handle",
"function_lines": [10, 20],
"family": "injection",
"case_id": "verified-case",
}
def test_labels_match_name_or_span_on_same_path():
rows = [{"path": "app.py", "function": "handle", "line": 1},
{"path": "app.py", "function": "nested", "line": 12},
{"path": "other.py", "function": "handle", "line": 12},
{"path": "app.py", "function": "other", "line": 30}]
rows = [
{"path": "app.py", "function": "handle", "line": 1},
{"path": "app.py", "function": "nested", "line": 12},
{"path": "other.py", "function": "handle", "line": 12},
{"path": "app.py", "function": "other", "line": 30},
]
labelled = label_rows(rows, positive())
assert [r["label"] for r in labelled] == [1, 1, None, None]
for data in labelled[:2]:
tests/test_hunt_metric.py
+18 -12
View File
@@ -8,11 +8,14 @@ from benchmarks.unseen.score import catches
from openultrasast.hunt.metric import search_metric, search_outcome
@pytest.mark.parametrize("change", [
{"family": "injection", "path": "app.py", "function": "handler", "function_lines": [100, 140]},
{"family": "path", "path": "other.py", "function": "read", "function_lines": [100, 140]},
{"family": "config_secrets", "path": "app.py", "function": "handler", "function_lines": [100, 140]},
])
@pytest.mark.parametrize(
"change",
[
{"family": "injection", "path": "app.py", "function": "handler", "function_lines": [100, 140]},
{"family": "path", "path": "other.py", "function": "read", "function_lines": [100, 140]},
{"family": "config_secrets", "path": "app.py", "function": "handler", "function_lines": [100, 140]},
],
)
def test_matches_score_catches(change):
change = {**change, "kind": "vulnerability", "files": [{"path": "app.py", "head_lines": [[20, 22]]}]}
for path in ("app.py", "other.py"):
@@ -20,17 +23,20 @@ def test_matches_score_catches(change):
for function in ("handler", "other"):
for family in (change["family"], "unknown"):
finding = {"path": path, "line": line, "function": function, "family": family}
record = {**change, "push": {"admission": {"defects": [
{**finding, "locations": [[path, line]]}
]}}}
record = {**change, "push": {"admission": {"defects": [{**finding, "locations": [[path, line]]}]}}}
assert search_outcome(change, [finding]).hit == bool(catches(record))
def test_counts_scope_feedback_and_tolerance():
change = {"kind": "vulnerability", "path": "app.py", "function": "handle", "family": "path",
"function_lines": [20, 22], "files": [{"path": "app.py", "head_lines": [[20, 22]]}]}
findings = [{"path": "app.py", "line": 10, "family": "path"},
{"path": "other.py", "line": 30, "family": "path"}]
change = {
"kind": "vulnerability",
"path": "app.py",
"function": "handle",
"family": "path",
"function_lines": [20, 22],
"files": [{"path": "app.py", "head_lines": [[20, 22]]}],
}
findings = [{"path": "app.py", "line": 10, "family": "path"}, {"path": "other.py", "line": 30, "family": "path"}]
outcome = search_outcome(change, findings)
assert (outcome.hit, outcome.suspicions, outcome.on_diff) == (True, 2, 1)
assert "other.py:30" in outcome.feedback
tests/test_hunt_table.py
+17 -5
View File
@@ -10,11 +10,23 @@ from openultrasast.hunt.table import SCHEMA_VERSION, FeatureTable
def row(label=1):
return {
"change_id": "c", "repo": "r", "head": "h", "path": "app.py", "line": 1,
"kind": "vulnerability", "fold": 0, "label": label, "family": "injection",
"fix_span": [1, 3], "label_ref": "case", "verification": None,
"feature.diff.distance": 0, "provenance.diff.ok": True,
"provenance.diff.reason": None, "provenance.diff.version": "1", "provenance.diff.bytes_read": 10,
"change_id": "c",
"repo": "r",
"head": "h",
"path": "app.py",
"line": 1,
"kind": "vulnerability",
"fold": 0,
"label": label,
"family": "injection",
"fix_span": [1, 3],
"label_ref": "case",
"verification": None,
"feature.diff.distance": 0,
"provenance.diff.ok": True,
"provenance.diff.reason": None,
"provenance.diff.version": "1",
"provenance.diff.bytes_read": 10,
}
tests/test_obligation_scan.py
-2
View File
@@ -90,5 +90,3 @@ def test_quick_scan_and_disabled_config_skip_obligations(tmp_path: Path, monkeyp
assert "obligations" not in manifest
findings = json.loads((_run_dir(repo) / "findings.json").read_text())["findings"]
assert not any(f["finding_id"].startswith("obligation:") for f in findings)
tests/test_plane_engine_alerts.py
+31 -9
View File
@@ -49,20 +49,42 @@ def world(tmp_path: Path) -> dict[str, Any]:
(plane / name).mkdir(parents=True)
task = yaml.safe_load((Path(__file__).resolve().parents[1] / "plane/tasks/alerts.yaml").read_text())
task["metadata"]["name"] = f"{CASE}-alerts"
task["spec"]["env"] = [{"name": f"OUSAST_{role.upper()}_PIN", "value": pin} for role, pin in
(("vulnerable", vulnerable), ("fixed", fixed))]
task["spec"]["env"] = [
{"name": f"OUSAST_{role.upper()}_PIN", "value": pin} for role, pin in (("vulnerable", vulnerable), ("fixed", fixed))
]
task["spec"]["workspaces"] = [{"name": "case", "path": "/workspace/case"}]
(plane / "tasks/alerts.yaml").write_text(yaml.safe_dump(task))
case = {"family": "injection", "ranges": {"app/index.php": [[3, 3]]}, "fixed_ranges": {"app/index.php": [[3, 3]]}}
workspace = {"apiVersion": task["apiVersion"], "kind": "Workspace", "metadata": {"name": "case"}, "spec": {
"git": [{"name": "repo", "repo": "https://example.com/reserved/probe", "dir": "repo"}],
"files": [{"path": "case.json", "content": json.dumps(case)}],
}}
workspace = {
"apiVersion": task["apiVersion"],
"kind": "Workspace",
"metadata": {"name": "case"},
"spec": {
"git": [{"name": "repo", "repo": "https://example.com/reserved/probe", "dir": "repo"}],
"files": [{"path": "case.json", "content": json.dumps(case)}],
},
}
(plane / "workspaces/case.yaml").write_text(yaml.safe_dump(workspace))
run = plane / "runs/validation-46.yaml"
run.write_text(yaml.safe_dump({"apiVersion": RUN_API_VERSION, "kind": "Run", "metadata": {"name": "validation-46"},
"spec": {"tasks": [{"name": f"{CASE}-alerts", "task": f"{CASE}-alerts",
"outputs": ["alerts.jsonl", "summary.json"], "budget": {"usd": 0, "calls": 0}}]}}))
run.write_text(
yaml.safe_dump(
{
"apiVersion": RUN_API_VERSION,
"kind": "Run",
"metadata": {"name": "validation-46"},
"spec": {
"tasks": [
{
"name": f"{CASE}-alerts",
"task": f"{CASE}-alerts",
"outputs": ["alerts.jsonl", "summary.json"],
"budget": {"usd": 0, "calls": 0},
}
]
},
}
)
)
source = tmp_path / "frozen"
(source / "src" / "openultrasast").mkdir(parents=True)
(source / "benchmarks" / "push").mkdir(parents=True)
tests/test_plane_reconciler.py
-2
View File
@@ -1003,5 +1003,3 @@ def test_a_tar_the_store_path_cannot_accept_fails_the_task(fake: Fake, tmp_path:
assert reconciler.run(write_run(tmp_path, "esc"), ax=str(fake.ax)) == "failed"
assert "rejected member ../escape.json" in state_of("esc")["tasks"]["repo-facts"]["reason"]
assert not (reconciler.run_dir("esc").parent / "escape.json").exists()
tests/test_plane_runner.py
+3 -10
View File
@@ -317,9 +317,7 @@ def test_sigterm_goes_to_the_commands_group_then_sigkill_after_the_grace(env: di
assert not (tmp_path / "state" / "stub.done.json").exists(), "an interrupted command is not complete"
def test_the_completion_marker_prevents_a_rerun_on_resume(
env: dict[str, str], monkeypatch: pytest.MonkeyPatch, tmp_path: Path
) -> None:
def test_the_completion_marker_prevents_a_rerun_on_resume(env: dict[str, str], monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
counter = tmp_path / "runs.txt"
code, _ = run_main(monkeypatch, tmp_path, files_workspace_yaml(), STUB_COUNTER=str(counter))
assert code == 0 and len(counter.read_text().splitlines()) == 1
@@ -482,10 +480,7 @@ def test_git_commits_annotation_round_trips_to_the_checkout(
assert rest[0]["metadata"] == {"name": "case"}, "annotations are stripped before ax"
assert rest[0]["spec"]["git"] == [{"name": "code", "repo": repo.as_uri(), "branch": "main"}], "no commit for ax"
overrides = {"OUSAST_OUTPUT_DIR": str(output)}
task_doc["spec"]["env"] = [
{"name": e["name"], "value": overrides.get(e["name"], e["value"])}
for e in task_doc["spec"]["env"]
]
task_doc["spec"]["env"] = [{"name": e["name"], "value": overrides.get(e["name"], e["value"])} for e in task_doc["spec"]["env"]]
assert json.loads({e["name"]: e["value"] for e in task_doc["spec"]["env"]}["OUSAST_GIT_PINS"]) == {"case/code": pin}
monkeypatch.setenv("AX_TASK_YAML", yaml.safe_dump(task_doc))
monkeypatch.setenv("AX_WORKSPACES_YAML", yaml.safe_dump_all([d for d in rest if d["kind"] == "Workspace"]))
@@ -584,9 +579,7 @@ def test_the_command_waits_for_the_start_request_and_the_credential_reaches_only
assert any("start request: 202" in record.getMessage() for record in caplog.records)
def test_a_crash_that_prints_the_credential_is_redacted(
env: dict[str, str], tmp_path: Path, capfd: pytest.CaptureFixture[str]
) -> None:
def test_a_crash_that_prints_the_credential_is_redacted(env: dict[str, str], tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
thread, environ, codes = main_in_thread(tmp_path, STUB_MODE="leak")
start = {"run": "run-1", "task": "stub", "credentials": {"DEEPSEEK_API_KEY": SECRET}}
assert post_start(environ["AX_RUNNER_BOUND_PORT"], start)[0] == 202
tests/test_task_images.py
+39 -15
View File
@@ -1,4 +1,5 @@
"""Offline image contracts; these do not claim a built image or measured size."""
import json
import re
from pathlib import Path
@@ -23,11 +24,14 @@ def workflow(name):
return yaml.load(read(f".github/workflows/{name}.yml"), Loader=yaml.BaseLoader)
@pytest.mark.parametrize("name,variant", [
("plane/Dockerfile.engine-task", "BASE"),
("plane/Dockerfile.search-task", "BROWSER"),
("Dockerfile", "BASE"),
])
@pytest.mark.parametrize(
"name,variant",
[
("plane/Dockerfile.engine-task", "BASE"),
("plane/Dockerfile.search-task", "BROWSER"),
("Dockerfile", "BASE"),
],
)
def test_digest_required_and_code_last(name, variant):
lines = instructions(name)
assert f"ARG TASK_{variant}_DIGEST" in lines
@@ -75,8 +79,7 @@ def test_triggers_caches_and_digest_outputs(name):
assert "plane/task-base.digest" in wf["on"]["push"]["paths"]
else:
assert set(wf["on"]["push"]["paths"]) == {"plane/Dockerfile.base", "pyproject.toml", "uv.lock"}
builds = [s["with"] for job in wf["jobs"].values() for s in job["steps"]
if s.get("uses") == "docker/build-push-action@v6"]
builds = [s["with"] for job in wf["jobs"].values() for s in job["steps"] if s.get("uses") == "docker/build-push-action@v6"]
assert builds
for build in builds:
assert "type=gha" in build["cache-from"] and "type=gha" in build["cache-to"]
@@ -107,9 +110,14 @@ def test_ci_pin_gate_offline(case, tmp_path, monkeypatch):
base = "ghcr.io/norandom/ousast-task-base:base-1234567@sha256:" + "a" * 64
browser = "ghcr.io/norandom/ousast-task-base:base-1234567-browser@sha256:" + "b" * 64
(tmp_path / "plane").mkdir()
(tmp_path / "plane/task-base.digest").write_text(json.dumps({
"base": None if case == "unpublished" else base, "base-browser": browser,
}))
(tmp_path / "plane/task-base.digest").write_text(
json.dumps(
{
"base": None if case == "unpublished" else base,
"base-browser": browser,
}
)
)
output = tmp_path / "output"
monkeypatch.chdir(tmp_path)
monkeypatch.setenv("GITHUB_OUTPUT", str(output))
@@ -147,15 +155,31 @@ def test_base_preserves_executor_build_toolchains():
install = re.search(r"apt-get install -y --no-install-recommends\s+(.*?)\s+&&", commands).group(1)
packages = set(install.split())
assert packages == {
"nodejs", "npm", "node-typescript", "php-cli", "composer", "maven",
"sqlite3", "bubblewrap", "util-linux", "git", "ca-certificates",
"libstdc++6", "zlib1g",
"nodejs",
"npm",
"node-typescript",
"php-cli",
"composer",
"maven",
"sqlite3",
"bubblewrap",
"util-linux",
"git",
"ca-certificates",
"libstdc++6",
"zlib1g",
}
assert "gradle" not in packages
assert "FROM eclipse-temurin:21-jdk-jammy AS jdk" in common
assert "COPY --from=jdk /opt/java/openjdk /opt/java/openjdk" in common
for command in ("javac -version", "npm --version", "composer --version", "mvn --version",
"python3 -m venv /venv", "/venv/bin/pip install"):
for command in (
"javac -version",
"npm --version",
"composer --version",
"mvn --version",
"python3 -m venv /venv",
"/venv/bin/pip install",
):
assert command in common
assert "joern" not in common.lower()
assert "apt-get clean" in common