mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.7
4ac7a95ec6
Reorganises four folders that exceeded the 12-item readability limit: - tests/lint/repository/ (27 -> 11): structure/, naming/, documentation/, python/, dependencies/, shell/, yaml/, network/, settings/ - tests/integration/ (25 -> 7): ansible/, infrastructure/, iam/, meta/ (24 sibling dirs grouped under 4 super-categories) - tests/integration/roles/ (13 -> 10): naming/, playwright/, dashboard/ - tests/unit/utils/ (15 -> 12): certs/ for 3 cert/TLS test files Renames 7 test files whose name duplicated the new folder name (e.g. test_no_direct_yaml_calls.py -> yaml/test_no_direct_calls.py, test_dashboard_integration_scope.py -> dashboard/test_integration_scope.py). Adjusts parents[N] in moved __init__.py files, fixes __file__-based path resolution in 8 tests, updates self-path whitelists, and uses absolute imports for PROJECT_ROOT re-exports (ruff TID252). Adds README.md to each new subfolder following the existing scope template. Updates all docs links (suppression.md, base.md, email.md, playwright spec/parity docs, 005-/019- requirements) to new paths. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
112 lines
3.7 KiB
Python
112 lines
3.7 KiB
Python
import fnmatch
|
|
import os
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from utils.cache.files import iter_project_files
|
|
from utils.cache.yaml import load_yaml_any
|
|
|
|
from . import PROJECT_ROOT
|
|
|
|
SECURITY_WORKFLOW_PATH = PROJECT_ROOT / ".github" / "workflows" / "security-codeql.yml"
|
|
|
|
# Hidden directories that are the only ones worth scanning (the cached walker
|
|
# already prunes .git/.venv/__pycache__/node_modules etc.).
|
|
SCANNED_HIDDEN_DIRS = {
|
|
".github",
|
|
}
|
|
|
|
# Mapping: CodeQL language name -> filename patterns
|
|
CODEQL_FILENAME_INDICATORS: dict[str, list[str]] = {
|
|
"c-cpp": ["*.c", "*.cc", "*.cpp", "*.cxx", "*.h", "*.hh", "*.hpp", "*.hxx"],
|
|
"csharp": ["*.cs"],
|
|
"go": ["*.go"],
|
|
"java-kotlin": ["*.java", "*.kt", "*.kts"],
|
|
"javascript-typescript": ["*.js", "*.jsx", "*.ts", "*.tsx", "*.mjs", "*.cjs"],
|
|
"python": ["*.py"],
|
|
"ruby": ["*.rb"],
|
|
"rust": ["*.rs"],
|
|
"swift": ["*.swift"],
|
|
}
|
|
|
|
# Mapping: CodeQL language name -> repository-relative path patterns
|
|
CODEQL_PATH_INDICATORS: dict[str, list[str]] = {
|
|
"actions": [
|
|
".github/workflows/*.yml",
|
|
".github/workflows/*.yaml",
|
|
"action.yml",
|
|
"action.yaml",
|
|
],
|
|
}
|
|
|
|
|
|
def _load_active_languages() -> set[str]:
|
|
data = load_yaml_any(str(SECURITY_WORKFLOW_PATH))
|
|
|
|
include = data["jobs"]["analyze"]["strategy"]["matrix"]["include"]
|
|
return {
|
|
entry["language"]
|
|
for entry in include
|
|
if isinstance(entry, dict) and "language" in entry
|
|
}
|
|
|
|
|
|
def _matching_languages(rel_file: str, filename: str) -> set[str]:
|
|
matched = {
|
|
language
|
|
for language, patterns in CODEQL_FILENAME_INDICATORS.items()
|
|
if any(fnmatch.fnmatch(filename, pattern) for pattern in patterns)
|
|
}
|
|
matched.update(
|
|
language
|
|
for language, patterns in CODEQL_PATH_INDICATORS.items()
|
|
if any(fnmatch.fnmatch(rel_file, pattern) for pattern in patterns)
|
|
)
|
|
return matched
|
|
|
|
|
|
class TestSecurityWorkflowCoverage(unittest.TestCase):
|
|
def test_codeql_languages_match_repository_content(self):
|
|
"""The CodeQL workflow must only enable languages that are actually
|
|
present in the repository, and it must not miss any detected language."""
|
|
|
|
detected_languages: set[str] = set()
|
|
|
|
for path in iter_project_files():
|
|
rel_file = os.path.relpath(path, PROJECT_ROOT)
|
|
# Skip top-level hidden directories that are not SCANNED_HIDDEN_DIRS
|
|
# (the cached walker already prunes the vendor/cache junk).
|
|
top = rel_file.split(os.sep, 1)[0]
|
|
if top.startswith(".") and top not in SCANNED_HIDDEN_DIRS:
|
|
continue
|
|
filename = Path(rel_file).name
|
|
detected_languages.update(_matching_languages(rel_file, filename))
|
|
|
|
active_languages = _load_active_languages()
|
|
missing_languages = sorted(detected_languages - active_languages)
|
|
extra_languages = sorted(active_languages - detected_languages)
|
|
|
|
problems: list[str] = []
|
|
if missing_languages:
|
|
problems.append(
|
|
"Detected languages missing from .github/workflows/security-codeql.yml:"
|
|
)
|
|
problems.extend(f" - {language}" for language in missing_languages)
|
|
|
|
if extra_languages:
|
|
problems.append(
|
|
"Active CodeQL languages without matching repository files:"
|
|
)
|
|
problems.extend(f" - {language}" for language in extra_languages)
|
|
|
|
if problems:
|
|
self.fail(
|
|
"The CodeQL workflow matrix does not match the repository content.\n"
|
|
"Enable missing languages or comment out inactive ones.\n\n"
|
|
+ "\n".join(problems)
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|