marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: format the whole tree and lint the scratch measurement scripts; CI has been red since 25ae4b4

Browse Source 
CI runs ruff format --check and ruff check over the whole repository; 29 files had drifted from the formatter and
four measurement scripts carried lint findings, so every push since 25ae4b4 failed before pytest ran.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-14 02:49:44 +02:00
co-authored by Claude Fable 5.1
parent fbbc03f3ea
commit 0d7d3f0dc9
29 changed files with 281 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_task_images.py
+39 -15
View File
@@ -1,4 +1,5 @@
"""Offline image contracts; these do not claim a built image or measured size."""
import json
import re
from pathlib import Path
@@ -23,11 +24,14 @@ def workflow(name):
return yaml.load(read(f".github/workflows/{name}.yml"), Loader=yaml.BaseLoader)
@pytest.mark.parametrize("name,variant", [
("plane/Dockerfile.engine-task", "BASE"),
("plane/Dockerfile.search-task", "BROWSER"),
("Dockerfile", "BASE"),
])
@pytest.mark.parametrize(
"name,variant",
[
("plane/Dockerfile.engine-task", "BASE"),
("plane/Dockerfile.search-task", "BROWSER"),
("Dockerfile", "BASE"),
],
)
def test_digest_required_and_code_last(name, variant):
lines = instructions(name)
assert f"ARG TASK_{variant}_DIGEST" in lines
@@ -75,8 +79,7 @@ def test_triggers_caches_and_digest_outputs(name):
assert "plane/task-base.digest" in wf["on"]["push"]["paths"]
else:
assert set(wf["on"]["push"]["paths"]) == {"plane/Dockerfile.base", "pyproject.toml", "uv.lock"}
builds = [s["with"] for job in wf["jobs"].values() for s in job["steps"]
if s.get("uses") == "docker/build-push-action@v6"]
builds = [s["with"] for job in wf["jobs"].values() for s in job["steps"] if s.get("uses") == "docker/build-push-action@v6"]
assert builds
for build in builds:
assert "type=gha" in build["cache-from"] and "type=gha" in build["cache-to"]
@@ -107,9 +110,14 @@ def test_ci_pin_gate_offline(case, tmp_path, monkeypatch):
base = "ghcr.io/norandom/ousast-task-base:base-1234567@sha256:" + "a" * 64
browser = "ghcr.io/norandom/ousast-task-base:base-1234567-browser@sha256:" + "b" * 64
(tmp_path / "plane").mkdir()
(tmp_path / "plane/task-base.digest").write_text(json.dumps({
"base": None if case == "unpublished" else base, "base-browser": browser,
}))
(tmp_path / "plane/task-base.digest").write_text(
json.dumps(
{
"base": None if case == "unpublished" else base,
"base-browser": browser,
}
)
)
output = tmp_path / "output"
monkeypatch.chdir(tmp_path)
monkeypatch.setenv("GITHUB_OUTPUT", str(output))
@@ -147,15 +155,31 @@ def test_base_preserves_executor_build_toolchains():
install = re.search(r"apt-get install -y --no-install-recommends\s+(.*?)\s+&&", commands).group(1)
packages = set(install.split())
assert packages == {
"nodejs", "npm", "node-typescript", "php-cli", "composer", "maven",
"sqlite3", "bubblewrap", "util-linux", "git", "ca-certificates",
"libstdc++6", "zlib1g",
"nodejs",
"npm",
"node-typescript",
"php-cli",
"composer",
"maven",
"sqlite3",
"bubblewrap",
"util-linux",
"git",
"ca-certificates",
"libstdc++6",
"zlib1g",
}
assert "gradle" not in packages
assert "FROM eclipse-temurin:21-jdk-jammy AS jdk" in common
assert "COPY --from=jdk /opt/java/openjdk /opt/java/openjdk" in common
for command in ("javac -version", "npm --version", "composer --version", "mvn --version",
"python3 -m venv /venv", "/venv/bin/pip install"):
for command in (
"javac -version",
"npm --version",
"composer --version",
"mvn --version",
"python3 -m venv /venv",
"/venv/bin/pip install",
):
assert command in common
assert "joern" not in common.lower()
assert "apt-get clean" in common