sysadmin
553f745f23
Bind mutation/credential paths to a process-local native MCP runtime so env spoofing, direct imports, and offline helpers cannot reconstruct session gates after native transport failure. Quarantine contaminated formal reviews under controller authority and honor quarantine in review feedback, merge eligibility, merge mutation, and canonical handoff validation. Add regression coverage for the second (PR #694 / review 427) incident class.
79 lines
3.0 KiB
Python
79 lines
3.0 KiB
Python
"""Hermetic tests for merge approval head pinning (#471)."""
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
|
|
|
|
from merge_approval_gate import assess_merge_approval_head # noqa: E402
|
|
|
|
HEAD_OLD = "8b61c4b41f1b49b271ed3b99657431cf06eeda3e"
|
|
HEAD_NEW = "3e4b721d60e97147ba0704773cf57cd0d42cbe31"
|
|
|
|
|
|
class TestMergeApprovalGate(unittest.TestCase):
|
|
def test_fresh_approval_at_current_head(self):
|
|
result = assess_merge_approval_head(
|
|
current_head_sha=HEAD_NEW,
|
|
latest_by_reviewer={
|
|
"reviewer1": {
|
|
"verdict": "APPROVED",
|
|
"dismissed": False,
|
|
"reviewed_head_sha": HEAD_NEW,
|
|
"submitted_at": "2026-07-06T12:00:00Z",
|
|
}
|
|
},
|
|
)
|
|
self.assertTrue(result["approval_at_current_head"])
|
|
self.assertIsNone(result["stale_approval_block_reason"])
|
|
|
|
def test_stale_approval_after_rebase(self):
|
|
result = assess_merge_approval_head(
|
|
current_head_sha=HEAD_NEW,
|
|
latest_by_reviewer={
|
|
"reviewer1": {
|
|
"verdict": "APPROVED",
|
|
"dismissed": False,
|
|
"reviewed_head_sha": HEAD_OLD,
|
|
"submitted_at": "2026-07-06T10:00:00Z",
|
|
}
|
|
},
|
|
)
|
|
self.assertFalse(result["approval_at_current_head"])
|
|
self.assertEqual(result["latest_approved_head_sha"], HEAD_OLD)
|
|
self.assertIn("stale approval", result["stale_approval_block_reason"])
|
|
self.assertIn(HEAD_OLD, result["stale_approval_block_reason"])
|
|
self.assertIn(HEAD_NEW, result["stale_approval_block_reason"])
|
|
self.assertIn("re-review PR at current head", result["stale_approval_block_reason"])
|
|
|
|
def test_no_approval_entries(self):
|
|
result = assess_merge_approval_head(
|
|
current_head_sha=HEAD_NEW,
|
|
latest_by_reviewer={},
|
|
)
|
|
self.assertFalse(result["approval_at_current_head"])
|
|
self.assertIsNone(result["latest_approved_head_sha"])
|
|
|
|
def test_quarantined_approval_void_for_merge(self):
|
|
"""#695: contaminated formal review at head must not authorize merge."""
|
|
result = assess_merge_approval_head(
|
|
current_head_sha=HEAD_NEW,
|
|
latest_by_reviewer={
|
|
"sysadmin": {
|
|
"verdict": "APPROVED",
|
|
"dismissed": False,
|
|
"reviewed_head_sha": HEAD_NEW,
|
|
"review_id": 427,
|
|
"submitted_at": "2026-07-13T07:20:00Z",
|
|
}
|
|
},
|
|
quarantined_review_ids={427},
|
|
)
|
|
self.assertFalse(result["approval_at_current_head"])
|
|
self.assertEqual(result["quarantined_approvals_at_current_head"], 1)
|
|
self.assertIn("quarantined", result["stale_approval_block_reason"])
|
|
self.assertIn("#695", result["stale_approval_block_reason"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main() |