kevinveenbirkenbachandClaude Opus 5.5
3610e7b9ef
Of the 76 open code scanning alerts, 39 point at code that can change. svc-ai-mcp-adapter: - A path argument that is empty or made only of dots is refused. Percent-encoding keeps a separator inside its segment, but "." and ".." need none, so an upstream that resolves dot segments could answer from a path the contract does not name. - parse_duration splits on the units. The pattern it used before rescanned a long run of digits from every start position. Tests and the README generators: - Every Jinja environment built with autoescape=False and a "noqa: S701" uses select_autoescape now, as six test modules and utils/templating/jinja.py already did. It escapes templates named *.html, *.htm and *.xml, which none of these call sites loads. - Dead code goes: a doubled "rel" block in the email lint, an unread _SKIP_DIRS, and a module that _resolve returned to no caller. - Two "except ...: pass" blocks become contextlib.suppress and assertRaises. - Nine test modules import unittest.mock one way instead of two, and one lookup test imports its module once. Closes #807 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Role Structure Tests 📚
Integration tests that enforce structural invariants of every role under roles/: folder-name conventions and include_tasks / import_tasks target existence.
Tests in this directory MUST only cover role-level structural rules (folder naming, role-name regex). meta/main.yml presence and field checks MUST live under meta/. Dependency-graph checks (self-, circular, unnecessary dependencies, run_after) MUST live under meta/dependencies/ (and the sibling meta/services/run_after/). Application-specific role rules (web-app README, applications[...] / group_names usage, application_id identity) MUST live under applications/. run_once_<role> flag lifecycle checks MUST live under run_once/. Block-level when: hygiene (guard blocks, duplication, size) MUST live under when/. include_tasks / import_tasks / include_role / import_role target existence MUST live under includes/. Compose- or handler-specific checks MUST live in their respective topical clusters.
For framework, directory layout, and make test-integration usage see integration.md.