60 lines
2.9 KiB
Python
60 lines
2.9 KiB
Python
from __future__ import annotations
|
|
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
from app.git_analysis import analyze_git
|
|
from app.scanner import _walk_files, scan_repository
|
|
|
|
|
|
def test_non_git_fallback_applies_root_gitignore_rules(tmp_path: Path) -> None:
|
|
(tmp_path / ".gitignore").write_text("ignored.py\nignored-dir/\n*.log\n!keep.log\n", encoding="utf-8")
|
|
(tmp_path / "kept.py").write_text("print('kept')\n", encoding="utf-8")
|
|
(tmp_path / "ignored.py").write_text("print('ignored')\n", encoding="utf-8")
|
|
(tmp_path / "keep.log").write_text("kept\n", encoding="utf-8")
|
|
(tmp_path / "drop.log").write_text("dropped\n", encoding="utf-8")
|
|
(tmp_path / "ignored-dir").mkdir()
|
|
(tmp_path / "ignored-dir" / "nested.py").write_text("print('nested')\n", encoding="utf-8")
|
|
|
|
files = {path.relative_to(tmp_path).as_posix() for path in _walk_files(tmp_path)}
|
|
|
|
assert "kept.py" in files
|
|
assert "keep.log" in files
|
|
assert "ignored.py" not in files
|
|
assert "drop.log" not in files
|
|
assert "ignored-dir/nested.py" not in files
|
|
|
|
|
|
def test_git_churn_attributes_renames_to_the_new_path(tmp_path: Path) -> None:
|
|
subprocess.run(["git", "init", "--quiet", str(tmp_path)], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "config", "user.email", "test@example.com"], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "config", "user.name", "RepoPulse Test"], check=True)
|
|
(tmp_path / "old.py").write_text("print('hello')\n", encoding="utf-8")
|
|
subprocess.run(["git", "-C", str(tmp_path), "add", "."], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "commit", "--quiet", "-m", "initial"], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "mv", "old.py", "new.py"], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "commit", "--quiet", "-m", "rename"], check=True)
|
|
(tmp_path / "new.py").write_text("print('hello world')\n", encoding="utf-8")
|
|
subprocess.run(["git", "-C", str(tmp_path), "commit", "--quiet", "-am", "edit after rename"], check=True)
|
|
|
|
signals, churn = analyze_git(tmp_path)
|
|
|
|
assert signals.renamed_files == ["new.py"]
|
|
assert churn.get("new.py", 0) > 0
|
|
assert "old.py" not in churn
|
|
|
|
|
|
def test_policy_suppresses_accepted_risk_without_erasing_the_observation(tmp_path: Path) -> None:
|
|
(tmp_path / "README.md").write_text("# Demo\n", encoding="utf-8")
|
|
(tmp_path / ".gitignore").write_text("\n", encoding="utf-8")
|
|
(tmp_path / ".repopulse.yml").write_text("suppressions:\n - security.secret-assignment\n", encoding="utf-8")
|
|
(tmp_path / "app.py").write_text("api_key = 'abcdefghijk1234'\n", encoding="utf-8")
|
|
|
|
report = scan_repository(str(tmp_path))
|
|
finding = next(item for item in report.findings if item.code == "security.secret-assignment")
|
|
|
|
assert finding.suppressed is True
|
|
assert report.category_scores["Security basics"] == 100
|
|
assert report.release_gate is not None
|
|
assert report.release_gate.checks[0].state.value == "pass"
|