mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 4.8
fc77d9d265
Resolve the 80 open CodeQL/code-scanning alerts on this branch. Security-sensitive fixes: - cli/administration/deploy/development: break the unsafe import cycle by extracting the env/arg helpers into a leaf module `env.py`, giving the load-time DAG compose -> common -> deps -> env. - web-app-bluesky login-broker server.js: prototype-pollution guard on cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped exception text, and a ReDoS-bounded handle regex. - web-app-baserow SSO: harden the open-redirect `next` handling. - network diagnose probes: require TLS >= 1.2. - actionlint installer: validate tar members against path traversal. - decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking. - 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA. Mechanical cleanups: unused imports/globals/locals, empty-except comments, import-and-import-from, implicit-string-concat, multiple-definition, unreachable/useless-assignment. False positives are intentionally left in place (Django settings patches, Odoo __manifest__, side-effect imports, cross-module symbols). Recurrence guards: - import-linter contract (pyproject + tests/lint) locks the dev-deploy package acyclic; a new cycle now fails CI instead of only CodeQL. - new lint test requires every bandit (S###) `noqa` to carry a justification. - BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt, current production offenders grandfathered). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
70 lines
2.2 KiB
Python
70 lines
2.2 KiB
Python
"""Unit tests for :mod:`utils.install.github_release`."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import unittest
|
|
import unittest.mock as mock
|
|
|
|
from utils.install import github_release as gr
|
|
|
|
|
|
class _FakeResp:
|
|
def __init__(self, final_url: str) -> None:
|
|
self._final = final_url
|
|
|
|
def __enter__(self) -> _FakeResp: # noqa: PYI034 - test double, not a Self-typed lib
|
|
return self
|
|
|
|
def __exit__(self, *exc: object) -> None:
|
|
return None
|
|
|
|
def geturl(self) -> str:
|
|
return self._final
|
|
|
|
|
|
class TestResolveLatestTag(unittest.TestCase):
|
|
def test_strips_leading_v(self) -> None:
|
|
with mock.patch.object(
|
|
gr,
|
|
"urlopen",
|
|
return_value=_FakeResp("https://example.com/x/y/releases/tag/v1.2.3"),
|
|
):
|
|
self.assertEqual(
|
|
gr.resolve_latest_tag("https://example.com/x/y/releases/latest"),
|
|
"1.2.3",
|
|
)
|
|
|
|
def test_handles_trailing_slash(self) -> None:
|
|
with mock.patch.object(
|
|
gr,
|
|
"urlopen",
|
|
return_value=_FakeResp("https://example.com/x/y/releases/tag/v9.0.0/"),
|
|
):
|
|
self.assertEqual(gr.resolve_latest_tag("https://example/latest"), "9.0.0")
|
|
|
|
def test_raises_when_unresolved(self) -> None:
|
|
latest = "https://example.com/x/y/releases/latest"
|
|
with mock.patch.object(gr, "urlopen", return_value=_FakeResp(latest)):
|
|
self.assertRaises(RuntimeError, gr.resolve_latest_tag, latest)
|
|
|
|
def test_raises_when_tag_is_literal_latest(self) -> None:
|
|
with mock.patch.object(
|
|
gr,
|
|
"urlopen",
|
|
return_value=_FakeResp("https://example.com/x/y/releases/tag/latest"),
|
|
):
|
|
self.assertRaises(
|
|
RuntimeError, gr.resolve_latest_tag, "https://example/latest"
|
|
)
|
|
|
|
|
|
class TestDownloadReleaseAsset(unittest.TestCase):
|
|
def test_delegates_to_download_file(self) -> None:
|
|
with mock.patch.object(gr, "download_file") as dl:
|
|
gr.download_release_asset("https://example/x.tar.gz", "/tmp/x.tar.gz")
|
|
dl.assert_called_once_with("https://example/x.tar.gz", "/tmp/x.tar.gz")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|