mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-14 06:37:25 +00:00
kevinveenbirkenbachandClaude Opus 5.5
043e001669
Each CI deploy row now draws one vulnerability engine (trivy, grype or osv) as a fifth rotation axis, shown in the job name next to distro and filesystem (🔬 axis, 🔺 trivy, 🍇 grype, 🐙 osv). The deploy-time scan of sys-ctl-hlth-runtime runs that engine behind Syft and the Grype runtime pass. - A vulnerability-db job keeps one Actions cache per database and day and downloads only the missing ones. Every deploy job restores Grype plus its drawn engine, fails on a cache miss and never downloads a database itself. - Local stacks share one host directory, INFINITO_VULNERABILITY_DB_HOST_PATH, mounted read-only at INFINITO_VULNERABILITY_DB_DIR in compose.yml and in every swarm node. A local deploy without a pinned engine draws one and refreshes only the databases it reads, at most once a day, under a lock. - A pinned engine whose database is missing stops the deploy before it starts. Part of #1324 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
1.1 KiB
Python
33 lines
1.1 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
from unittest import TestCase, main, mock
|
|
|
|
import cli.contributing.security.database.__main__ as database_main
|
|
|
|
|
|
class TestMain(TestCase):
|
|
def _main(self, errors):
|
|
with mock.patch.object(
|
|
database_main, "fetch_databases", return_value=errors
|
|
) as fetch:
|
|
code = database_main.main(["--dir", "/tmp/db", "--engines", "trivy", "osv"])
|
|
return code, fetch
|
|
|
|
def test_the_requested_engines_are_downloaded_into_the_directory(self):
|
|
_code, fetch = self._main([])
|
|
_p, root, engines, _runner, _fetch = fetch.call_args.args
|
|
self.assertEqual((root, engines), (Path("/tmp/db"), ["trivy", "osv"]))
|
|
|
|
def test_a_failed_download_fails_the_command(self):
|
|
code, _fetch = self._main(["trivy database: exited 1: no network"])
|
|
self.assertEqual(code, 1)
|
|
|
|
def test_an_unknown_engine_is_rejected(self):
|
|
with self.assertRaises(SystemExit):
|
|
database_main.main(["--dir", "/tmp/db", "--engines", "clair"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|