mathiasandClaude Sonnet 5.5
3955758c24
Review found a bypass: a PR reporting an empty head sha made the runs query lose its head_sha filter (the repo's 50 most recent runs of any commit were classified) and dropped head_commit_id (omitempty), so the merge was unbound. Both tools now go through evaluateMergeGate, which refuses without a head sha, and pollRuns makes no query without one. pr_merge also reports merged:false for a PR that is not open or is a draft (Gitea refuses closed ones itself; the gate no longer depends on that). Tests: unit (gate, counting-server pollRuns with positive control), end to end for both tools, CI scoped to head_sha, closed/merged/draft. The two caller-wiring mutants are equivalent to the pollRuns guard and survive by design. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM
359 lines
16 KiB
Go
359 lines
16 KiB
Go
package tools_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"sync/atomic"
|
|
"testing"
|
|
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/allowlist"
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/tools"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// shipFake serves the whole tbd_ship flow; runsJSON is the workflow_runs array
|
|
// for the head commit, letting each test drive the CI gate.
|
|
func shipFake(t *testing.T, runsJSON string, merged, deleted *atomic.Bool) *httptest.Server {
|
|
t.Helper()
|
|
return shipFakeOpts(t, runsJSON, 0, http.StatusOK, merged, deleted)
|
|
}
|
|
|
|
// shipFakeOpts adds protection (requiredApprovals>0 → protected) and a merge
|
|
// status code, so tests can drive the review-protected and conflict paths.
|
|
func shipFakeOpts(t *testing.T, runsJSON string, requiredApprovals, mergeStatus int, merged, deleted *atomic.Bool) *httptest.Server {
|
|
t.Helper()
|
|
return shipFakeFull(t, runsJSON, requiredApprovals, mergeStatus, `[{"id":1,"name":"risk/low"}]`, http.StatusOK, merged, deleted)
|
|
}
|
|
|
|
// shipFakeFull also serves the issue whose risk/ label classifies the change (gitea-mcp#63): issueLabels is the
|
|
// labels JSON array, issueStatus the HTTP status of the issue lookup.
|
|
func shipFakeFull(t *testing.T, runsJSON string, requiredApprovals, mergeStatus int, issueLabels string, issueStatus int, merged, deleted *atomic.Bool) *httptest.Server {
|
|
t.Helper()
|
|
return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
p := r.URL.Path
|
|
w.Header().Set("Content-Type", "application/json")
|
|
switch {
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/issues/42"):
|
|
w.WriteHeader(issueStatus)
|
|
_, _ = w.Write([]byte(`{"number":42,"title":"t","state":"open","labels":` + issueLabels + `}`))
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/branch_protections/"):
|
|
if requiredApprovals > 0 {
|
|
_, _ = w.Write([]byte(`{"required_approvals":` + itoa(requiredApprovals) + `}`))
|
|
return
|
|
}
|
|
w.WriteHeader(http.StatusNotFound) // unprotected
|
|
_, _ = w.Write([]byte(`{"message":"not found"}`))
|
|
case r.Method == http.MethodPost && strings.HasSuffix(p, "/branches"):
|
|
w.WriteHeader(http.StatusCreated)
|
|
_, _ = w.Write([]byte(`{"name":"tbd/x","commit":{"id":"abc"}}`))
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/contents/"):
|
|
w.WriteHeader(http.StatusNotFound) // new file
|
|
_, _ = w.Write([]byte(`{"message":"not found"}`))
|
|
case (r.Method == http.MethodPost || r.Method == http.MethodPut) && strings.Contains(p, "/contents/"):
|
|
w.WriteHeader(http.StatusCreated)
|
|
_, _ = w.Write([]byte(`{"content":{"path":"x","sha":"s"},"commit":{"sha":"c"}}`))
|
|
case r.Method == http.MethodPost && strings.HasSuffix(p, "/pulls"):
|
|
w.WriteHeader(http.StatusCreated)
|
|
_, _ = w.Write([]byte(`{"number":7,"title":"t","html_url":"http://x/pulls/7","state":"open","head":{"ref":"tbd/x","sha":"` + shipPRHeadSha + `"},"base":{"ref":"main"}}`))
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/actions/runs"):
|
|
_, _ = w.Write([]byte(`{"total_count":0,"workflow_runs":` + runsJSON + `}`))
|
|
case r.Method == http.MethodPost && strings.HasSuffix(p, "/pulls/7/merge"):
|
|
body, _ := io.ReadAll(r.Body)
|
|
shipLastMergeBody.Store(string(body))
|
|
merged.Store(true)
|
|
w.WriteHeader(mergeStatus)
|
|
_, _ = w.Write([]byte(`{}`))
|
|
case r.Method == http.MethodDelete && strings.Contains(p, "/branches/"):
|
|
deleted.Store(true)
|
|
w.WriteHeader(http.StatusOK)
|
|
_, _ = w.Write([]byte(`{}`))
|
|
default:
|
|
t.Errorf("unexpected request: %s %s", r.Method, p)
|
|
w.WriteHeader(http.StatusNotFound)
|
|
}
|
|
}))
|
|
}
|
|
|
|
func callShip(t *testing.T, srvURL, args string) map[string]any {
|
|
t.Helper()
|
|
tool := tools.NewTBDShip(gitea.NewClient(srvURL, "tok"), allowlist.New([]string{"mathias"}))
|
|
out, err := tool.Call(context.Background(), json.RawMessage(args))
|
|
require.NoError(t, err)
|
|
var res map[string]any
|
|
require.NoError(t, json.Unmarshal(out, &res))
|
|
return res
|
|
}
|
|
|
|
// Green CI + unprotected base → squash-merge + branch deleted.
|
|
func TestTBDShip_GreenCI_Merges(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFake(t, `[{"id":1,"status":"completed","conclusion":"success","head_sha":"abc"}]`, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x","issue":42}`)
|
|
|
|
assert.Equal(t, true, res["merged"])
|
|
assert.Equal(t, "success", res["ci_status"])
|
|
assert.Equal(t, float64(7), res["pr_number"])
|
|
assert.True(t, merged.Load(), "merge endpoint must be called")
|
|
assert.True(t, deleted.Load(), "branch must be deleted after merge")
|
|
}
|
|
|
|
// No CI runs for the head commit → fail closed: PR opened, NOT merged.
|
|
func TestTBDShip_NoCI_FailsClosed(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFake(t, `[]`, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x","issue":42}`)
|
|
|
|
assert.Equal(t, false, res["merged"])
|
|
assert.Equal(t, "none", res["ci_status"])
|
|
assert.NotEmpty(t, res["reason"])
|
|
assert.False(t, merged.Load(), "merge must NOT be called when there is no CI")
|
|
assert.Equal(t, float64(7), res["pr_number"], "PR is still opened for manual merge")
|
|
}
|
|
|
|
// Red CI → fail closed.
|
|
func TestTBDShip_RedCI_FailsClosed(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFake(t, `[{"id":1,"status":"completed","conclusion":"failure","head_sha":"abc"}]`, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x","issue":42}`)
|
|
|
|
assert.Equal(t, false, res["merged"])
|
|
assert.Equal(t, "failed", res["ci_status"])
|
|
assert.False(t, merged.Load(), "merge must NOT be called when CI is red")
|
|
}
|
|
|
|
func itoa(n int) string { b, _ := json.Marshal(n); return string(b) }
|
|
|
|
// Green CI but the base branch requires review → fail closed (no auto-merge).
|
|
func TestTBDShip_ReviewProtected_FailsClosed(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFakeOpts(t, `[{"id":1,"status":"completed","conclusion":"success","head_sha":"abc"}]`, 1, http.StatusOK, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x","issue":42}`)
|
|
|
|
assert.Equal(t, false, res["merged"])
|
|
assert.NotEmpty(t, res["reason"])
|
|
assert.Contains(t, res["reason"], "review")
|
|
assert.False(t, merged.Load(), "must NOT merge a review-protected base")
|
|
}
|
|
|
|
// Green CI but the merge is unclean (409) → fail closed, PR left open.
|
|
func TestTBDShip_MergeConflict_FailsClosed(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFakeOpts(t, `[{"id":1,"status":"completed","conclusion":"success","head_sha":"abc"}]`, 0, http.StatusConflict, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x","issue":42}`)
|
|
|
|
assert.Equal(t, false, res["merged"])
|
|
assert.NotEmpty(t, res["reason"])
|
|
assert.True(t, merged.Load(), "merge is attempted")
|
|
assert.False(t, deleted.Load(), "branch is NOT deleted on a failed merge")
|
|
}
|
|
|
|
// Re-invoking with the same change must resume the existing branch/PR (not
|
|
// error on "branch exists"), skip the redundant write when content is
|
|
// unchanged, and merge once CI is green (#48).
|
|
func TestTBDShip_Resume_ExistingBranchAndPR(t *testing.T) {
|
|
var merged, deleted, wrote atomic.Bool
|
|
branch := "tbd/resume-me"
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
p := r.URL.Path
|
|
w.Header().Set("Content-Type", "application/json")
|
|
switch {
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/issues/42"):
|
|
_, _ = w.Write([]byte(`{"number":42,"title":"t","state":"open","labels":[{"id":1,"name":"risk/low"}]}`))
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/branch_protections/"):
|
|
w.WriteHeader(http.StatusNotFound)
|
|
_, _ = w.Write([]byte(`{"message":"not found"}`))
|
|
case r.Method == http.MethodPost && strings.HasSuffix(p, "/branches"):
|
|
w.WriteHeader(http.StatusConflict) // branch already exists
|
|
_, _ = w.Write([]byte(`{"message":"branch already exists"}`))
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/contents/"):
|
|
// existing file with identical content ("hi") → write should be skipped
|
|
w.WriteHeader(http.StatusOK)
|
|
_, _ = w.Write([]byte(`{"path":"docs/x.md","sha":"s","content":"aGk=","encoding":"base64"}`))
|
|
case (r.Method == http.MethodPost || r.Method == http.MethodPut) && strings.Contains(p, "/contents/"):
|
|
wrote.Store(true)
|
|
w.WriteHeader(http.StatusCreated)
|
|
_, _ = w.Write([]byte(`{"content":{"path":"x","sha":"s2"},"commit":{"sha":"c"}}`))
|
|
case r.Method == http.MethodPost && strings.HasSuffix(p, "/pulls"):
|
|
w.WriteHeader(http.StatusConflict) // PR already exists for this head
|
|
_, _ = w.Write([]byte(`{"message":"pull request already exists"}`))
|
|
case r.Method == http.MethodGet && strings.HasSuffix(p, "/pulls"):
|
|
_, _ = w.Write([]byte(`[{"number":7,"html_url":"http://x/pulls/7","state":"open","head":{"ref":"` + branch + `","sha":"abc"},"base":{"ref":"main"}}]`))
|
|
case r.Method == http.MethodGet && strings.Contains(p, "/actions/runs"):
|
|
_, _ = w.Write([]byte(`{"total_count":1,"workflow_runs":[{"id":1,"status":"completed","conclusion":"success","head_sha":"abc"}]}`))
|
|
case r.Method == http.MethodPost && strings.HasSuffix(p, "/pulls/7/merge"):
|
|
merged.Store(true)
|
|
w.WriteHeader(http.StatusOK)
|
|
_, _ = w.Write([]byte(`{}`))
|
|
case r.Method == http.MethodDelete && strings.Contains(p, "/branches/"):
|
|
deleted.Store(true)
|
|
w.WriteHeader(http.StatusOK)
|
|
_, _ = w.Write([]byte(`{}`))
|
|
default:
|
|
t.Errorf("unexpected request: %s %s", r.Method, p)
|
|
w.WriteHeader(http.StatusNotFound)
|
|
}
|
|
}))
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x","issue":42,"branch":"`+branch+`"}`)
|
|
|
|
assert.Equal(t, true, res["merged"], "resume must merge when CI is green")
|
|
assert.Equal(t, float64(7), res["pr_number"], "must reuse the existing PR #7")
|
|
assert.False(t, wrote.Load(), "identical content must not trigger a redundant write")
|
|
assert.True(t, merged.Load())
|
|
}
|
|
|
|
// shipPRHeadSha is the head sha the fake reports for the PR it opens (tests may blank it, then restore it).
|
|
var shipPRHeadSha = "abc"
|
|
|
|
// shipLastMergeBody is the body of the most recent merge request the fake received.
|
|
var shipLastMergeBody atomic.Value
|
|
|
|
// An empty head sha used to unscope the CI query and drop the merge binding (review of PR #76). Fail closed.
|
|
func TestTBDShip_AnEmptyHeadShaFailsClosed(t *testing.T) {
|
|
shipPRHeadSha = ""
|
|
t.Cleanup(func() { shipPRHeadSha = "abc" })
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFake(t, shipGreen, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, shipArgs)
|
|
|
|
assert.Equal(t, false, res["merged"])
|
|
assert.Contains(t, res["reason"], "head commit")
|
|
assert.False(t, merged.Load(), "an unknown head commit must never merge")
|
|
}
|
|
|
|
// TOCTOU: the merge is bound to the head commit whose CI the gate evaluated (gitea-mcp#74).
|
|
func TestTBDShip_TheMergeIsBoundToTheCommitTheGateChecked(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFake(t, shipGreen, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, shipArgs)
|
|
|
|
require.Equal(t, true, res["merged"])
|
|
var payload map[string]any
|
|
require.NoError(t, json.Unmarshal([]byte(shipLastMergeBody.Load().(string)), &payload))
|
|
assert.Equal(t, "abc", payload["head_commit_id"], "the head sha the CI check used")
|
|
}
|
|
|
|
// ---- gitea-mcp#63: the risk tier is an input to the gate. Only exactly one risk/low label merges. ----
|
|
const (
|
|
shipGreen = `[{"id":1,"status":"completed","conclusion":"success","head_sha":"abc"}]`
|
|
shipArgs = `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x","issue":42}`
|
|
)
|
|
|
|
func TestTBDShip_RiskTier_OnlyLowMerges(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
labels string
|
|
wantMerged bool
|
|
wantInReason string
|
|
}{
|
|
{"risk/low merges", `[{"id":1,"name":"risk/low"}]`, true, ""},
|
|
{"risk/low among other labels merges", `[{"id":2,"name":"type/fix"},{"id":1,"name":"risk/low"},{"id":3,"name":"size/s"}]`, true, ""},
|
|
{"risk/medium does not merge", `[{"id":1,"name":"risk/medium"}]`, false, "risk/medium"},
|
|
{"risk/high does not merge", `[{"id":1,"name":"risk/high"}]`, false, "risk/high"},
|
|
{"no risk label is unclassified, not low", `[{"id":2,"name":"type/fix"}]`, false, "no risk/"},
|
|
{"no labels at all", `[]`, false, "no risk/"},
|
|
{"two risk labels are ambiguous", `[{"id":1,"name":"risk/low"},{"id":2,"name":"risk/high"}]`, false, "more than one"},
|
|
{"two identical risk/low labels are still ambiguous", `[{"id":1,"name":"risk/low"},{"id":2,"name":"risk/low"}]`, false, "more than one"},
|
|
{"an unknown risk value does not merge", `[{"id":1,"name":"risk/lowish"}]`, false, "unknown"},
|
|
{"an empty risk value does not merge", `[{"id":1,"name":"risk/"}]`, false, "unknown"},
|
|
{"labels are case-sensitive: RISK/LOW is not risk/low", `[{"id":1,"name":"RISK/LOW"}]`, false, "no risk/"},
|
|
{"a label that merely contains risk/low does not count", `[{"id":1,"name":"not-risk/low"}]`, false, "no risk/"},
|
|
}
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFakeFull(t, shipGreen, 0, http.StatusOK, tc.labels, http.StatusOK, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, shipArgs)
|
|
|
|
assert.Equal(t, tc.wantMerged, res["merged"])
|
|
assert.Equal(t, tc.wantMerged, merged.Load(), "the merge endpoint is called iff the tier allows it")
|
|
assert.Equal(t, "success", res["ci_status"], "CI was green: the tier alone decided")
|
|
assert.Equal(t, float64(7), res["pr_number"], "the PR is opened either way")
|
|
if !tc.wantMerged {
|
|
assert.Contains(t, res["reason"], tc.wantInReason)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// No issue named → nothing classifies the change → no merge, even on green CI.
|
|
func TestTBDShip_NoIssue_Unclassified_NoMerge(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFake(t, shipGreen, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
res := callShip(t, srv.URL, `{"owner":"mathias","repo":"myrepo","path":"docs/x.md","content":"hi","message":"add x"}`)
|
|
|
|
assert.Equal(t, false, res["merged"])
|
|
assert.Contains(t, res["reason"], "issue")
|
|
assert.False(t, merged.Load(), "an unclassified change must not merge")
|
|
assert.Equal(t, float64(7), res["pr_number"])
|
|
}
|
|
|
|
// The issue lookup failing is not a reason to merge: fail closed, PR left open.
|
|
func TestTBDShip_IssueLookupFails_FailsClosed(t *testing.T) {
|
|
for _, status := range []int{http.StatusInternalServerError, http.StatusNotFound, http.StatusForbidden} {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFakeFull(t, shipGreen, 0, http.StatusOK, `[{"id":1,"name":"risk/low"}]`, status, &merged, &deleted)
|
|
|
|
res := callShip(t, srv.URL, shipArgs)
|
|
srv.Close()
|
|
|
|
assert.Equal(t, false, res["merged"], "status %d", status)
|
|
assert.NotEmpty(t, res["reason"], "status %d", status)
|
|
assert.False(t, merged.Load(), "status %d: an unreadable issue must not merge", status)
|
|
}
|
|
}
|
|
|
|
// risk/low is necessary, not sufficient: red CI still blocks it, and a review-protected base still blocks it.
|
|
func TestTBDShip_RiskLow_DoesNotOverrideTheOtherGates(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
red := shipFakeFull(t, `[{"id":1,"status":"completed","conclusion":"failure","head_sha":"abc"}]`, 0, http.StatusOK, `[{"id":1,"name":"risk/low"}]`, http.StatusOK, &merged, &deleted)
|
|
defer red.Close()
|
|
assert.Equal(t, false, callShip(t, red.URL, shipArgs)["merged"])
|
|
assert.False(t, merged.Load())
|
|
|
|
prot := shipFakeFull(t, shipGreen, 1, http.StatusOK, `[{"id":1,"name":"risk/low"}]`, http.StatusOK, &merged, &deleted)
|
|
defer prot.Close()
|
|
assert.Equal(t, false, callShip(t, prot.URL, shipArgs)["merged"])
|
|
assert.False(t, merged.Load())
|
|
}
|
|
|
|
// The decision is visible to the caller.
|
|
func TestTBDShip_ReportsTheRiskTier(t *testing.T) {
|
|
var merged, deleted atomic.Bool
|
|
srv := shipFakeFull(t, shipGreen, 0, http.StatusOK, `[{"id":1,"name":"risk/medium"}]`, http.StatusOK, &merged, &deleted)
|
|
defer srv.Close()
|
|
|
|
assert.Equal(t, "medium", callShip(t, srv.URL, shipArgs)["risk"])
|
|
}
|
|
|
|
func TestTBDShip_AllowlistRejects(t *testing.T) {
|
|
tool := tools.NewTBDShip(gitea.NewClient("http://unused", ""), allowlist.New([]string{"mathias"}))
|
|
_, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"evil","repo":"r","path":"p","content":"c","message":"m"}`))
|
|
require.Error(t, err)
|
|
}
|