mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
Neil
1912c90141
Extract subprocess execution and process contracts into @orca/process-host with explicit public entry points, independent checks, and one Node 18 compatible CommonJS runtime. Migrate application consumers and integrate package builds, dependency selection, import enforcement, and runtime resource staging. Preserve daemon startup ownership and profile isolation, and qualify development rebuild recovery and concurrent output publication. Remove unnecessary aliases, test forwarding exports, and a duplicate output scan. Validation: full typechecks, changed-code quality, package and artifact checks, native Windows builds/types plus 306 runtime tests, and independent native reviews. Matched full E2E controls on original main and unchanged reviewed head both pass all 17 applicable tests (nine skips). Earlier intermittent E2E failures are documented in the PR; no assertions were weakened. The final combined-tree audit preserves both branches with no import-boundary violations.
93 lines
4.0 KiB
JavaScript
93 lines
4.0 KiB
JavaScript
import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
|
|
import { tmpdir } from 'node:os'
|
|
import { join } from 'node:path'
|
|
import { pathToFileURL } from 'node:url'
|
|
import { expect, it } from 'vitest'
|
|
import { parse } from 'yaml'
|
|
import { runProcessSync } from '@orca/process-host'
|
|
|
|
const workflow = parse(
|
|
readFileSync(new URL('../../.github/workflows/cloud-verify.yml', import.meta.url), 'utf8')
|
|
)
|
|
const steps = workflow.jobs.security.steps
|
|
const history = steps.find((step) => step.name === 'Fetch complete scan history')
|
|
|
|
it('fetches both merge parents and deleted content without unrelated branches or tags', () => {
|
|
const directory = mkdtempSync(join(tmpdir(), 'orca-cloud-history-'))
|
|
const source = join(directory, 'source')
|
|
const checkout = join(directory, 'checkout')
|
|
const run = (program, args, cwd, env = process.env) => {
|
|
const result = runProcessSync({ program, args, cwd, env })
|
|
expect(result.code, result.stderr).toBe(0)
|
|
return result.stdout.trim()
|
|
}
|
|
const git = (args, cwd = source) => run('git', args, cwd)
|
|
const commit = (message) => {
|
|
git(['add', '-A'])
|
|
git(['-c', 'commit.gpgsign=false', 'commit', '--quiet', '-m', message])
|
|
return git(['rev-parse', 'HEAD'])
|
|
}
|
|
|
|
try {
|
|
run('git', ['init', '--quiet', source], directory)
|
|
git(['checkout', '-b', 'main'])
|
|
git(['config', 'user.name', 'CI test'])
|
|
git(['config', 'user.email', 'ci@example.invalid'])
|
|
mkdirSync(join(source, 'cloud'))
|
|
writeFileSync(join(source, 'cloud', 'removed.txt'), 'historical-scan-marker\n')
|
|
const original = commit('historical content')
|
|
rmSync(join(source, 'cloud', 'removed.txt'))
|
|
writeFileSync(join(source, 'cloud', 'current.txt'), 'current\n')
|
|
commit('delete historical content')
|
|
git(['checkout', '-b', 'feature'])
|
|
writeFileSync(join(source, 'cloud', 'feature.txt'), 'feature-parent-marker\n')
|
|
commit('feature parent')
|
|
git(['checkout', 'main'])
|
|
writeFileSync(join(source, 'cloud', 'base.txt'), 'base-parent-marker\n')
|
|
commit('base parent')
|
|
git(['-c', 'commit.gpgsign=false', 'merge', '--no-ff', 'feature', '-m', 'PR merge'])
|
|
const sha = git(['rev-parse', 'HEAD'])
|
|
const expectedHistory = git(['rev-list', 'HEAD']).split('\n').sort()
|
|
const expectedPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'])
|
|
git(['checkout', '-b', 'unrelated', original])
|
|
writeFileSync(join(source, 'unrelated.txt'), 'unrelated-object\n')
|
|
const unrelated = commit('unrelated branch')
|
|
git(['tag', 'unrelated-tag'])
|
|
git(['checkout', 'main'])
|
|
|
|
run(
|
|
'git',
|
|
['clone', '--depth=1', '--no-tags', '--branch', 'main', pathToFileURL(source).href, checkout],
|
|
directory
|
|
)
|
|
expect(git(['rev-list', '--count', 'HEAD'], checkout)).toBe('1')
|
|
run('bash', ['-e', '-c', history.run], checkout, { ...process.env, GITHUB_SHA: sha })
|
|
|
|
expect(git(['rev-list', 'HEAD'], checkout).split('\n').sort()).toEqual(expectedHistory)
|
|
const actualPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'], checkout)
|
|
expect(actualPatch).toBe(expectedPatch)
|
|
expect(actualPatch).toContain('historical-scan-marker')
|
|
expect(actualPatch).toContain('feature-parent-marker')
|
|
expect(actualPatch).toContain('base-parent-marker')
|
|
expect(git(['tag', '--list'], checkout)).toBe('')
|
|
expect(
|
|
runProcessSync({ program: 'git', args: ['cat-file', '-e', unrelated], cwd: checkout }).code
|
|
).not.toBe(0)
|
|
} finally {
|
|
rmSync(directory, { recursive: true, force: true })
|
|
}
|
|
})
|
|
|
|
it('completes history before scanning the same HEAD and Cloud paths', () => {
|
|
expect(steps[0].with['fetch-depth']).toBe(1)
|
|
expect(history['working-directory']).toBe('.')
|
|
const scanIndex = steps.findIndex(
|
|
(step) => step.run?.includes('docker run') && step.run.includes('gitleaks@')
|
|
)
|
|
expect(steps.indexOf(history)).toBeLessThan(scanIndex)
|
|
expect(steps[scanIndex].run).toContain(
|
|
'--log-opts="HEAD -- cloud :(glob).github/workflows/cloud-*.yml .github/actions/cloud-sql-rollout-lease"'
|
|
)
|
|
expect(steps.some((step) => step.run?.includes('trufflehog@'))).toBe(true)
|
|
})
|