@bongos/core 1.19.1036 → 1.19.1037

package/tests/audit_ships_git_argv.mjs

@@ -1,173 +0,0 @@
-// tests/audit_ships_git_argv.mjs — audit-ships' git calls must be argv, not a
-// shell string (task 1003223; the class task 1002761 named).
-//
-// THE BUG. Five calls interpolated `--format=''` into a shell string. A POSIX
-// shell strips the quotes and git sees an empty format; the shell Node uses on
-// Windows does not, so git receives `--format=''` literally and dies with
-// `fatal: invalid --pretty format: ''`. A sixth built a `grep | head | awk`
-// pipeline and pinned `shell: '/bin/bash'` to survive at all.
-//
-// WHY THIS NEEDS A TEST AND NOT JUST A FIX. Every one of those calls sat inside a
-// try/catch that returned null or []. So the Windows failure did not crash the
-// audit — it produced an audit with no diff stats and zero downstream impact for
-// every ship, which is indistinguishable from a clean run. The originating row
-// asked exactly this ("check whether the catch degrades to a silently empty audit
-// — if so it is the same dangerous shape after all"). It did.
-//
-// The static half of this file is the real net: it is the half that stays true on
-// Linux CI, where the shell-string form would have passed happily forever.
-//
-// Run:  node --test tests/audit_ships_git_argv.mjs
-
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import { execSync, execFileSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const FILE = path.join(ROOT, 'scripts/gds/audit-ships.js');
-const audit = require('../scripts/gds/audit-ships.js');
-const raw = fs.readFileSync(FILE, 'utf8');
-
-// Scan CODE, not prose. The file's header explains the bug by quoting the exact
-// tokens that are banned ("--format=''", "grep -E", "shell: '/bin/bash'"), so a
-// naive scan of the whole file fails on its own documentation — which is exactly
-// what happened when this test was first written. Same comments-stripped posture
-// as scripts/gds/category-advisory-guard.js.
-const src = raw
-  .replace(/\/\*[\s\S]*?\*\//g, '')          // block comments
-  .split('\n').map((l) => l.replace(/(^|\s)\/\/.*$/, '$1')).join('\n');
-
-// ---- static: the shape that broke must not come back ----------------------
-
-test('no execSync anywhere — a shell string is what mangles the quoting', () => {
-  assert.doesNotMatch(src, /\bexecSync\b/,
-    'audit-ships must spawn git through execFileSync with an argv array');
-});
-
-test("no quoted --format='' — the argv spelling is --format= with no quotes", () => {
-  // Match the SHELL form precisely: two consecutive quotes after the '='. A naive
-  // /--format='/ also matches the correct argv literal '--format=', where that
-  // quote is JS string syntax, not a shell quote — it flagged the fix as the bug.
-  assert.doesNotMatch(src, /--format=''/,
-    "a quoted empty format is the exact token git rejects on Windows");
-  assert.match(src, /'--format='/, 'the argv spelling is present');
-});
-
-test('no shell pipeline and no pinned /bin/bash', () => {
-  assert.doesNotMatch(src, /\bshell:\s*['"]/, 'no shell is needed once calls are argv');
-  for (const tool of ['grep -E', '| head', '| awk']) {
-    assert.ok(!src.includes(tool), `${tool} is a POSIX-only dependency`);
-  }
-});
-
-test('git failures are reported, not swallowed into a clean-looking audit', () => {
-  // The silent `catch (_) { return null; }` is what made the Windows breakage
-  // invisible. Every catch around a git call must go through gitFails.
-  assert.match(raw, /function gitFails\(/, 'the reporting helper exists');
-  // Scoped to catches returning an empty RESULT SET — null or [] — which is the
-  // shape that turned a git failure into a clean-looking audit. A catch returning
-  // `{}` for an unreadable branding pack is a different, legitimate default and is
-  // deliberately not swept up here.
-  const silent = src.match(/catch \(_\)\s*\{\s*return (?:null|\[\])/g) || [];
-  assert.equal(silent.length, 0,
-    `silent catch(es) returning an empty result: ${silent.join(' | ')}`);
-});
-
-// ---- behavioural: the calls actually work on THIS platform ----------------
-//
-// These run real git against this repo, which is what makes them meaningful on
-// Windows: before the fix, two of them threw here and returned empty.
-
-const git = (args) => execFileSync('git', args, { cwd: ROOT, encoding: 'utf8' }).trim();
-// A NON-MERGE commit. `git show --name-only` prints nothing for a merge by
-// default, so anchoring on HEAD makes the file-listing assertions depend on
-// whatever happened to be checked out — they failed here for that reason, not
-// because the code was wrong. --no-merges picks a commit that really touched files.
-const HEAD = git(['rev-list', '--no-merges', '-n', '1', 'HEAD']);
-
-test('the exact argv git rejected as a shell string succeeds here', () => {
-  const out = execFileSync('git', ['show', '--shortstat', '--format=', HEAD], { cwd: ROOT, encoding: 'utf8' });
-  assert.match(out, /\d+ files? changed/, `shortstat should parse, got: ${JSON.stringify(out.slice(0, 80))}`);
-});
-
-test('the shell-string form is what actually fails on this platform', () => {
-  // Not a hypothetical: assert the OLD form's behaviour so the reason for the fix
-  // is recorded in a runnable way. On POSIX it succeeds (the quotes are stripped),
-  // on Windows it throws — either way, argv is the only spelling that is correct
-  // on both, which is the whole point.
-  let threw = false;
-  try { execSync(`git show --shortstat --format='' ${HEAD}`, { cwd: ROOT, encoding: 'utf8' }); }
-  catch { threw = true; }
-  if (process.platform === 'win32') {
-    assert.equal(threw, true, 'on win32 the quoted form must be the one that fails');
-  } else {
-    assert.equal(threw, false, 'on POSIX it happens to work — which is why this hid on CI');
-  }
-});
-
-test('--name-only --format= yields real paths', () => {
-  const out = execFileSync('git', ['show', '--name-only', '--format=', HEAD], { cwd: ROOT, encoding: 'utf8' });
-  const files = out.split('\n').map((s) => s.trim()).filter(Boolean);
-  assert.ok(files.length > 0, 'HEAD touched at least one file');
-  assert.ok(files.every((f) => !f.includes("'")), 'paths come back unquoted');
-});
-
-// ---- the real functions, not equivalents ---------------------------------
-//
-// These drive audit-ships' own helpers. Before this task the file executed main()
-// on require — it hit the API the moment anything imported it — so its git helpers
-// had never been reachable from a test at all. That is the deeper reason the
-// Windows breakage went unnoticed for months.
-
-test('gitDiffStatsForCommit returns real stats on this platform', () => {
-  const stats = audit.gitDiffStatsForCommit(HEAD);
-  assert.ok(stats, 'must not be the null the Windows failure returned');
-  assert.equal(stats.commit_sha, HEAD);
-  assert.ok(stats.files_changed > 0, `files_changed should be positive, got ${stats.files_changed}`);
-});
-
-test('filesTouchedByCommit returns real paths, not the empty array of a swallowed failure', () => {
-  const files = audit.filesTouchedByCommit(HEAD);
-  assert.ok(Array.isArray(files) && files.length > 0, `expected paths, got ${JSON.stringify(files)}`);
-  assert.ok(files.every((f) => typeof f === 'string' && f.length > 0));
-});
-
-test('the commit list is read once per run, not once per task', () => {
-  // The shell pipeline this replaced ended in `head -1`, so git stopped at the
-  // first match. The argv form has no early exit, and findCommitForTask runs once
-  // per shipped task — up to 500 a run — so a naive port turns one bounded call
-  // into 500 full history walks. Caught by the grader on this task's first round.
-  //
-  // Measured rather than asserted structurally: the second lookup must not spend
-  // anywhere near the first's time, because it must not touch git at all.
-  const t0 = process.hrtime.bigint();
-  audit.findCommitForTask(999999901);
-  const cold = process.hrtime.bigint() - t0;
-
-  const t1 = process.hrtime.bigint();
-  audit.findCommitForTask(999999902);
-  const warm = process.hrtime.bigint() - t1;
-
-  assert.ok(warm * 5n < cold || warm < 2_000_000n,
-    `second lookup should reuse the cached list (cold ${cold / 1000000n}ms, warm ${warm / 1000000n}ms)`);
-});
-
-test('the helpers still answer safely for a missing sha', () => {
-  assert.equal(audit.gitDiffStatsForCommit(null), null);
-  assert.deepEqual(audit.filesTouchedByCommit(null), []);
-  assert.deepEqual(audit.downstreamImpact(null, ['x']),
-    { commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [] });
-});
-
-test('a path containing a space survives argv — the hand-rolled quoting is gone', () => {
-  // git log -- <pathspec> with a space used to need shell quoting; in argv it is
-  // simply one element. An unmatched pathspec returns empty, never an error.
-  const out = execFileSync('git', ['log', '-1', '--format=%H', '--', 'no such file.md'], { cwd: ROOT, encoding: 'utf8' });
-  assert.equal(out.trim(), '', 'an unmatched pathspec is empty, not a crash');
-});
-