YoVinchen
f4ba5d5342
Some checks failed
verify / verify (push) Has been cancelled
The Stage 1 foundation now proves provider contracts with mocks and validates PostgreSQL/pgvector ingestion, approval binding, retrieval, reranking, and idempotency using only synthetic data. Live Bailian validation remains gated on rotating the exposed key. Constraint: The key shown in chat is compromised and cannot be used or committed Rejected: Mark Stage 1 complete from mock and offline results | real three-model smoke is still required Confidence: high Scope-risk: moderate Reversibility: clean Directive: Do not enable real-data ingestion until Stage 3 cloud approval and outbound manifest controls are enforced end to end Tested: make verify; 41 pytest tests; strict mypy; Ruff; Compose config; pinned image build; empty-volume migration; role denial; two idempotent 20-vector seeds; database restart persistence Not-tested: Live Bailian calls require a newly rotated key; React product UI is not implemented
39 lines
1.2 KiB
Python
39 lines
1.2 KiB
Python
import subprocess
|
|
from pathlib import Path
|
|
|
|
PROJECT_ROOT = Path(__file__).resolve().parents[3]
|
|
SCANNER = PROJECT_ROOT / "scripts" / "check-secrets.sh"
|
|
|
|
|
|
def run_git(repository: Path, *arguments: str) -> None:
|
|
subprocess.run(
|
|
["git", *arguments],
|
|
cwd=repository,
|
|
check=True,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
|
|
|
|
def test_staged_scan_reads_index_blob_not_modified_worktree(tmp_path: Path) -> None:
|
|
run_git(tmp_path, "init", "--quiet")
|
|
run_git(tmp_path, "config", "user.email", "test@example.invalid")
|
|
run_git(tmp_path, "config", "user.name", "Secret Scanner Test")
|
|
candidate = tmp_path / "config.txt"
|
|
candidate.write_text("sk-" + "A" * 30, encoding="utf-8")
|
|
run_git(tmp_path, "add", "config.txt")
|
|
candidate.write_text("safe working-tree replacement", encoding="utf-8")
|
|
|
|
result = subprocess.run(
|
|
[str(SCANNER), "--staged"],
|
|
cwd=tmp_path,
|
|
check=False,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
|
|
assert result.returncode == 1
|
|
assert "config.txt" in result.stderr
|
|
assert "safe working-tree replacement" not in result.stderr
|
|
assert "A" * 30 not in result.stderr
|