marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(infra): fix the 3 stale/flaky infra tests to the current contracts

Browse Source 
- test_engine_image_and_rustfs_policy: root Dockerfile was refactored to the
  digest-pinned ousast-task-base (carries semantic+s3 deps) + a joern-build stage,
  installing the package --no-deps. Updated the stale `COPY benchmarks` (now
  --chown=1000) and `.[semantic,s3]` (now --no-deps + joern-cli copy + pinned base)
  assertions to the new contract.
- test_image_stages: plane/Dockerfile.engine-task refactored the same way; the
  split marker is now `FROM ${ENGINE_REF} AS replay`, base is ousast-task-base
  (not ax-task-runner:v0.3.1), and the replay stage no longer installs git (base
  provides it). Re-pinned the engine-stage SHA and updated the markers/assertions.
- test_partial_clone_lazy_fetch: passed alone but failed mid-suite — a leaked
  GIT_DIR/GIT_OBJECT_DIRECTORY/alternates from an earlier test changed the
  missing-blob count. Added an autouse fixture that neutralises inherited git
  control vars so every test in the file is self-contained (reproduced + verified).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-12 15:58:11 +02:00
co-authored by Claude Opus 4.8
parent 6c789eac40
commit e49c150316
3 changed files with 37 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_unseen_image.py
+12 -6
View File
@@ -4,13 +4,19 @@ import hashlib
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
ENGINE_SHA = "06ec67d411cd7abbfcd0735b1c2a70e4f3eb65ddcfeef89975709c664f59ad42"
# The engine portion is pinned so that adding the replay stage cannot silently change the engine image.
# Recompute after an intentional engine-stage change: it is sha256 of `engine.rstrip() + "\n"` where `engine`
# is everything before the `FROM ${ENGINE_REF} AS replay` line.
ENGINE_SHA = "77c34f3381cef6c6d1f7fd761cd3924a3656cc5e6eb20c51c819de77afb4b2fc"
def test_image_stages():
text = (ROOT / "plane/Dockerfile.engine-task").read_text()
engine, replay = text.split("FROM engine AS replay", 1)
original = engine.replace("v0.3.1 AS engine", "v0.3.1").rstrip() + "\n"
assert hashlib.sha256(original.encode()).hexdigest() == ENGINE_SHA
assert "FROM ghcr.io/norandom/ax-task-runner:v0.3.1 AS engine" in engine
assert "git" in replay and "replay_entry.py" in replay and "ousast pre-push --help" in replay
# The replay stage builds FROM the engine stage (via the ENGINE_REF arg, default `engine`).
engine, replay = text.split("FROM ${ENGINE_REF} AS replay", 1)
assert hashlib.sha256((engine.rstrip() + "\n").encode()).hexdigest() == ENGINE_SHA
# Task base is digest-pinned (no floating fallback) and built in two stages: joern-build -> engine.
assert "FROM ghcr.io/norandom/ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST} AS joern-build" in engine
assert "FROM ghcr.io/norandom/ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST} AS engine" in engine
# The replay stage is a pure addition on top of engine: the unseen replay harness + a smoke check.
assert "replay_entry.py" in replay and "ousast pre-push --help" in replay