From e49c1503164b6363c85427e4d3baaf0c68745aaf Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:58:11 +0200 Subject: [PATCH] test(infra): fix the 3 stale/flaky infra tests to the current contracts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - test_engine_image_and_rustfs_policy: root Dockerfile was refactored to the digest-pinned ousast-task-base (carries semantic+s3 deps) + a joern-build stage, installing the package --no-deps. Updated the stale `COPY benchmarks` (now --chown=1000) and `.[semantic,s3]` (now --no-deps + joern-cli copy + pinned base) assertions to the new contract. - test_image_stages: plane/Dockerfile.engine-task refactored the same way; the split marker is now `FROM ${ENGINE_REF} AS replay`, base is ousast-task-base (not ax-task-runner:v0.3.1), and the replay stage no longer installs git (base provides it). Re-pinned the engine-stage SHA and updated the markers/assertions. - test_partial_clone_lazy_fetch: passed alone but failed mid-suite — a leaked GIT_DIR/GIT_OBJECT_DIRECTORY/alternates from an earlier test changed the missing-blob count. Added an autouse fixture that neutralises inherited git control vars so every test in the file is self-contained (reproduced + verified). Co-Authored-By: Claude Opus 4.8 --- tests/test_engine_queue.py | 8 ++++++-- tests/test_unseen_extract.py | 19 +++++++++++++++++++ tests/test_unseen_image.py | 18 ++++++++++++------ 3 files changed, 37 insertions(+), 8 deletions(-) diff --git a/tests/test_engine_queue.py b/tests/test_engine_queue.py index 7a406ce..eb4e4cd 100644 --- a/tests/test_engine_queue.py +++ b/tests/test_engine_queue.py @@ -199,8 +199,12 @@ def test_engine_k8s_render_contract(): def test_engine_image_and_rustfs_policy(): dockerfile = (ROOT / "Dockerfile").read_text() - assert "COPY benchmarks ./benchmarks" in dockerfile - assert ".[semantic,s3]" in dockerfile + assert "COPY --chown=1000 benchmarks ./benchmarks" in dockerfile + # The image is built on the digest-pinned task base (which carries the semantic+s3 deps), so the package + # installs --no-deps and Joern (the semantic engine) is copied from the joern-build stage. + assert "ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST}" in dockerfile + assert "/venv/bin/pip install --no-deps --no-cache-dir ." in dockerfile + assert "COPY --from=joern-build /opt/joern-cli /opt/joern-cli" in dockerfile for name in ["engine_trace_worker.py", "engine_trace_parse.py", "engine_worker_service.py"]: assert (ROOT / "benchmarks/learn" / name).stat().st_size > 0 doc = (ROOT / "docs/rustfs.md").read_text().split("## Scoped account for engine workers")[1] diff --git a/tests/test_unseen_extract.py b/tests/test_unseen_extract.py index 888de12..f0ec2c3 100644 --- a/tests/test_unseen_extract.py +++ b/tests/test_unseen_extract.py @@ -16,6 +16,25 @@ e = importlib.import_module("benchmarks.unseen.extract") s = importlib.import_module("benchmarks.unseen.source") +@pytest.fixture(autouse=True) +def _hermetic_git_env(monkeypatch): + """Neutralise inherited Git control vars so each test is self-contained. + + A GIT_DIR / GIT_OBJECT_DIRECTORY / alternates value leaked from an earlier test in the suite redirects + object lookup: the partial-clone lazy-fetch test then sees a different missing-blob count (it passes alone + but failed mid-suite). These tests build their own repos under tmp_path and must not read ambient git env. + """ + for var in ( + "GIT_DIR", + "GIT_WORK_TREE", + "GIT_INDEX_FILE", + "GIT_OBJECT_DIRECTORY", + "GIT_ALTERNATE_OBJECT_DIRECTORIES", + "GIT_COMMON_DIR", + ): + monkeypatch.delenv(var, raising=False) + + @pytest.mark.parametrize("slow", [False, True]) def test_process_deadline_restores_alarm(slow): original = signal.getsignal(signal.SIGALRM) diff --git a/tests/test_unseen_image.py b/tests/test_unseen_image.py index 2caf81e..000cd2c 100644 --- a/tests/test_unseen_image.py +++ b/tests/test_unseen_image.py @@ -4,13 +4,19 @@ import hashlib from pathlib import Path ROOT = Path(__file__).resolve().parents[1] -ENGINE_SHA = "06ec67d411cd7abbfcd0735b1c2a70e4f3eb65ddcfeef89975709c664f59ad42" +# The engine portion is pinned so that adding the replay stage cannot silently change the engine image. +# Recompute after an intentional engine-stage change: it is sha256 of `engine.rstrip() + "\n"` where `engine` +# is everything before the `FROM ${ENGINE_REF} AS replay` line. +ENGINE_SHA = "77c34f3381cef6c6d1f7fd761cd3924a3656cc5e6eb20c51c819de77afb4b2fc" def test_image_stages(): text = (ROOT / "plane/Dockerfile.engine-task").read_text() - engine, replay = text.split("FROM engine AS replay", 1) - original = engine.replace("v0.3.1 AS engine", "v0.3.1").rstrip() + "\n" - assert hashlib.sha256(original.encode()).hexdigest() == ENGINE_SHA - assert "FROM ghcr.io/norandom/ax-task-runner:v0.3.1 AS engine" in engine - assert "git" in replay and "replay_entry.py" in replay and "ousast pre-push --help" in replay + # The replay stage builds FROM the engine stage (via the ENGINE_REF arg, default `engine`). + engine, replay = text.split("FROM ${ENGINE_REF} AS replay", 1) + assert hashlib.sha256((engine.rstrip() + "\n").encode()).hexdigest() == ENGINE_SHA + # Task base is digest-pinned (no floating fallback) and built in two stages: joern-build -> engine. + assert "FROM ghcr.io/norandom/ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST} AS joern-build" in engine + assert "FROM ghcr.io/norandom/ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST} AS engine" in engine + # The replay stage is a pure addition on top of engine: the unseen replay harness + a smoke check. + assert "replay_entry.py" in replay and "ousast pre-push --help" in replay