marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(push): a verified source freeze for long measurement runs

Browse Source 
Every long run mounts src into a container, and mounting the working tree is a live mount: edits
made during a multi-hour run are picked up mid-run, and a measurement whose code changed underneath
it is not a measurement of anything. A five-hour PHP transfer replay was lost that way today.

The export has to be checked too. git archive piped into tar once produced a tree missing the whole
ontology -- every tracked file after groovy alphabetically -- and reported success, because tar
status in a pipeline was never read. Every scan on that tree died at its first fact load and looked
like a slow run for fourteen minutes.

So: archive to a file, extract, count against git, and refuse an export without the ontology.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-22 21:56:20 +02:00
co-authored by Claude Fable 5.1
parent cfd1493d69
commit a084dce780
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/push/freeze_source.sh
Executable
+28
View File
@@ -0,0 +1,28 @@
#!/usr/bin/env bash
# Export the COMMITTED source for a long measurement run, and prove the export is whole.
#
# Every long run here mounts src into a container. Mounting the working tree is a live mount: edits
# made during a multi-hour run are picked up mid-run, and a measurement whose code changed underneath
# it is not a measurement of anything -- the failure looks exactly like the thing being measured
# failing. A five-hour PHP transfer replay was lost that way on 2026-09-22.
#
# And the export has to be checked. `git archive | tar -x` once produced a tree missing the whole
# ontology (every tracked file after `groovy` alphabetically) and reported success, because tar's
# status in a pipeline was never read. Every scan on that tree died at its first fact load and looked
# like a slow run for fourteen minutes. So: archive to a file, extract, count against git.
#
# Usage: benchmarks/push/freeze_source.sh <dest-dir> -> prints the frozen commit on success
set -euo pipefail
dest="${1:?destination directory}"
rm -rf "$dest" && mkdir -p "$dest"
git archive HEAD src benchmarks > "$dest.tar"
tar -xf "$dest.tar" -C "$dest"
rm -f "$dest.tar"
want=$(git ls-files src benchmarks | wc -l)
have=$(find "$dest" -type f | wc -l)
if [ "$want" -ne "$have" ]; then
echo "TRUNCATED export: git tracks $want files, export holds $have" >&2
exit 1
fi
test -d "$dest/src/openultrasast/ruleset/semantic" || { echo "export lacks the ontology" >&2; exit 1; }
echo "$(git rev-parse --short HEAD) $have files"