fix(ci): post-release cleanup — isolate the two pre-tag negative-control tests - #158
Merged
Merged
Conversation
…free temp tree Post-release cleanup (QITEM-PB5-POST-RELEASE-CLEANUP-01). After v5.0.0, two negative-control tests (test_released_repo_without_signed_receipt_is_fail_closed, test_gegenrichtung_das_echte_repo_besteht_weiterhin) were red: they evaluated the REAL repo expecting fail-closed, but a release legitimately commits a valid receipt into the tree, so the gate correctly returns ok=True — the tests flipped at every release. Fix: both now evaluate a guaranteed RECEIPT-FREE temp tree (like the neighbor tests in these files), so they catch the real fail-closed invariant regardless of the real repo's receipt state. The skipUnless(running_in_repo_checkout) on the second test is removed (it no longer depends on the checkout). An un-review (finding B) hardened them from a keyword match to the structural invariant assertEqual(verified_receipts, []) — fail-closed BECAUSE 0 receipts verified, not a coincidental reason. This also greens crypto-floor and coverage (both run the full suite, which failed only on these two; the crypto-floor "corpus under-declares" FAIL lines are expected output from negative tests that deliberately break case copies — the real corpus is well-formed). hermetic-cleanroom is already green on current main (the mail's failure was on the old head d23ea50, superseded by the release PRs). CodeQL alert 100 (clear-text logging in pre_tag_audit_gate.py) is a false positive, presented to the owner as a Dismiss rather than a code fix: the logged fields are all non-secret (release version, a bool, a status word, a 12-char public sha256 tree prefix, a trusted-key COUNT), and a code fix would change gate_source_digest and invalidate the signed v5.0.0 receipt (measured: the gate rejected the receipt after any edit to the gate file). A real leak is never dismissed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Post-release cleanup (QITEM-PB5-POST-RELEASE-CLEANUP-01). Measured on current main (840a0a6), then fixed.
The two negative-control tests (
test_released_repo_without_signed_receipt_is_fail_closed,test_gegenrichtung_das_echte_repo_besteht_weiterhin) evaluated the real repo expecting fail-closed; a release commits a valid receipt, so the gate correctly returns ok=True and they flipped. Now they evaluate a receipt-free temp tree (like the neighbor tests) and assert the structural invariantverified_receipts == [](un-review finding B: not a keyword match).crypto-floor + coverage were downstream of these two (both run the full suite; the crypto-floor "under-declares" FAIL lines are expected negative-test output — the real corpus is well-formed). hermetic-cleanroom is already green on current main (the mail's failure was on the old head d23ea50).
CodeQL alert 100 is a false positive presented to the owner as a Dismiss (not a code fix): the logged fields are all non-secret, and a code fix would change
gate_source_digestand invalidate the signed v5.0.0 receipt (measured). A real leak is never dismissed.No new release.