marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 19:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

pre-push(17.1): never block a push the user did not choose to block

Browse Source 
The installed hook exits 0 with one line when ousast (or OUSAST_COMMAND) is
not on PATH, still chaining a prior hook. In Git hook mode without an explicit
--mode blocking, argument/usage errors (an invalid OUSAST_PUSH_DEADLINE, a cache
directory inside the repository, a refused experimental flag) and unexpected
exceptions print one "check did not run" line and exit 0. Blocking mode keeps
its usage errors. Requirement 9.1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-02 21:57:42 +02:00
co-authored by Claude Opus 5.5
parent a656fda2f4
commit bf07cd4d1d
5 changed files with 182 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_push_vetoes.py
+21 -1
View File
@@ -247,8 +247,28 @@ def test_cli_refuses_the_flag_outside_explicit_replay(tmp_path, capsys):
from openultrasast.cli import main
root, base, head, _ = history(tmp_path)
# Hook mode refuses the flag without running anything; since 17.1 (Req 9.1) the refusal is advisory
# (exit 0 with a line), because a usage error in a hook must never reject the push.
hook = ["pre-push", str(root), "--remote", "origin", "/x", "--artifact", str(tmp_path / "x.json")]
refused = main([*hook, "--experimental-record-vetoes"])
captured = capsys.readouterr()
assert refused == 0 and "requires explicit --base/--head replay" in captured.err
assert "pre-push check did not run" in captured.out and not (tmp_path / "x.json").exists()
with pytest.raises(SystemExit):
main(["pre-push", str(root), "--remote", "origin", "/x", "--artifact", str(tmp_path / "x.json"), "--experimental-record-vetoes"])
main(
[
"pre-push",
str(root),
"--remote",
"origin",
"/x",
"--artifact",
str(tmp_path / "x.json"),
"--mode",
"blocking",
"--experimental-record-vetoes",
]
)
assert "requires explicit --base/--head replay" in capsys.readouterr().err
code = main(
[