test(version): coverage for publish-gating version derivation — scripts/review-appliance-version.sh, scripts/contribute-version.sh - #575
Open
kubestellar-hive[bot] wants to merge 1 commit into
Conversation
![sec-check[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
scripts/review-appliance-version.sh and scripts/contribute-version.sh
decide the tag publish-appliance.yml and publish-contribute.yml push, but
nothing executed them except the happy path on the committed tree
(validate.yml and tests/appliance-contract.sh both just capture their
output). Every other branch was unverified, so a regression in them was
observable only as a bad publish.
tests/version-derivation.sh runs both scripts against synthetic repo
roots, so each script's own "$(dirname "$BASH_SOURCE")/.." resolution is
exercised rather than mocked. It covers:
- zero-padding of the tool revision, including 0
- 10#$revision octal protection for REVISION 08 and 09
- digest stripping, digestless tags, patched base tags, registry ports
- rejection of a missing ARG FSDK_BASE_IMAGE, an empty or unparseable
base tag, and a missing, empty or non-integer REVISION, each with a
diagnostic on stderr and nothing on stdout
- first ARG default winning over a later restatement
- the committed tree yielding a well-formed version for both images
- appliance and contribute agreeing on the FSDK series, which their
Containerfiles pin independently
One case is a characterization rather than a contract: REVISION is read
through 'tr -d [:space:]', which deletes interior whitespace instead of
rejecting it, so '3 4' publishes revision 34. Recorded with a comment
pointing at the issue; changing it is a production fix, not a test.
Reached from validate.yml through tests/appliance-contract.sh, which
already hosts the appliance SBOM contract for the same reason, so
tests/test-registry.sh stays green without a workflow edit.
Closes #574
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: sec-check[bot] <sec-check[bot]@users.noreply.github.com>
kubestellar-hive
Bot
added
hold
kubestellar-hive
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test Improvement
Adds
tests/version-derivation.sh, black-box coverage for the two publish-gating version scripts. No production code changes.Files/functions claimed by this PR:
tests/version-derivation.shtests/appliance-contract.sh(one added block, immediately after its existingversion="$(bash scripts/review-appliance-version.sh)"check)scripts/review-appliance-version.sh,scripts/contribute-version.sh,image/appliance/REVISION,image/contribute/REVISIONWhy
Those two scripts decide the tag
publish-appliance.ymlandpublish-contribute.ymlpush. Nothing executed them except the happy path on the committed tree —validate.yml:111andtests/appliance-contract.sh:122each just capture their output. Every other branch was unverified, so a regression was observable only as a bad publish.Covered
Each case runs the real script against a synthetic repo root, so each script's own
$(dirname "$BASH_SOURCE")/..resolution is exercised rather than mocked.010#$revisionoctal protection forREVISION08and09ARG FSDK_BASE_IMAGE, an empty or unparseable base tag, and a missing, empty or non-integerREVISION— each with a diagnostic on stderr and nothing on stdoutARGdefault winning over a later restatement in a second build stageMutation-checked: changing
printf '%02d'toprintf '%d'inreview-appliance-version.shfails the suite.One characterization, not a contract
REVISIONis read throughtr -d '[:space:]', which deletes interior whitespace rather than rejecting it, so3 4publishes revision34— while both scripts' diagnostics say the file "must contain a single integer". The test records the current behaviour with a comment pointing at #574. Fixing it is a production change and is deliberately out of scope here.Registration
tests/test-registry.shrequires every test to be reachable fromvalidate.ymlwithin one hop. This PR reaches it throughtests/appliance-contract.shrather than adding avalidate.ymlstep, matching the existing precedent in that file fortests/appliance_sbom_contract.py("Its own contract runs here rather than as a separate validate.yml step"). No workflow file is touched.Verified locally
tests/version-derivation.sh,tests/test-registry.sh(16 files, all reachable),tests/appliance-contract.sh,tests/contribute-contract.sh,tests/check-commit-message.sh, shellcheck v0.11.0 with the repo's--excludeset, andshfmt -i 2 -d— all clean.Related Issue
Closes #574
Overlap check
No open PR in the snapshot touches this cluster.
review#571is the extension module reachability gate overimage/extension/**;review#566is the PR reader extension;review#570is a dependency digest bump. None touchscripts/*version*.sh,tests/appliance-contract.sh, ortests/version-derivation.sh.Filed by quality agent (hold-gated mode). Human review required.
— hive: agent=quality backend=copilot model=claude-opus-5