mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-28 16:32:06 +00:00
thePR0M3TH3ANandClaude Opus 5
527d7be5c5
The Tests workflow reported SUCCESS on Windows while its own log read "2 failed, 1114 passed". On Windows a multi-line `run:` block executes under pwsh, where only the last command decides the step's result -- so `coverage xml` succeeding hid `pytest` failing. Linux and macOS use bash -e and did catch it, which is why this was invisible. `shell: bash` on that step fixes it, and the same hazard is fixed in python-ci.yml's install step. An audit of every Windows-capable multi-line step found no others; the installer smoke steps are Unix-guarded and already set -euo pipefail. A check that cannot go red is worse than no check, because it is trusted -- and this one has been trusted while six Windows tests failed underneath it. Two of those six are now skipped on Windows: they assert POSIX mode 0o600, which cannot hold where os.chmod only toggles a read-only flag and st_mode reads back 0o666. Skipped rather than relaxed, because the property is real and a weakened assertion would answer it falsely. Whether these files -- the semantic index among them, which holds stored secrets -- are actually protected from other users on Windows is an ACL question, now recorded. The remaining four are TUI tests that assume POSIX paths. They are recorded rather than patched: reproducing them needs a Windows host, and guessing at path normalization and palette-argument parsing would mean changing tests to match an assumption rather than a behaviour. They also interact with the undeclared-textual finding -- those tests SKIP everywhere except Windows, the one platform they were not written for. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
53 lines
1.8 KiB
YAML
53 lines
1.8 KiB
YAML
name: Tests
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
branches: ["**"]
|
|
|
|
jobs:
|
|
test:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
|
python-version: ["3.10", "3.11", "3.12"]
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
cache: pip
|
|
- name: Install Poetry
|
|
run: pipx install poetry
|
|
- name: Install dependencies
|
|
run: poetry install --no-interaction --no-ansi
|
|
- name: Check formatting
|
|
run: poetry run black --check .
|
|
- name: Run security audit
|
|
run: |
|
|
poetry run pip-audit || echo "::warning::pip-audit found vulnerabilities"
|
|
shell: bash
|
|
- name: TUI v2 check smoke
|
|
run: poetry run seedpass tui2 --check
|
|
- name: Run deterministic regression tests
|
|
run: poetry run pytest -q src/tests/test_deterministic_artifact_regression.py
|
|
- name: Run tests with coverage
|
|
# `shell: bash` is load-bearing, not tidiness. Without it Windows runs
|
|
# this block under pwsh, where only the LAST command decides whether
|
|
# the step failed -- so `coverage xml` succeeding hid pytest failing,
|
|
# and this job reported success on Windows while reading
|
|
# "2 failed, 1114 passed". A check that cannot go red is worse than no
|
|
# check, because it is trusted.
|
|
shell: bash
|
|
run: |
|
|
poetry run coverage run -m pytest
|
|
poetry run coverage xml
|
|
- name: Upload coverage report
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: coverage-${{ matrix.os }}-py${{ matrix.python-version }}
|
|
path: coverage.xml
|