@bongos/core 1.19.339 → 1.19.341

package/tests/routine_schedule.mjs

@@ -0,0 +1,176 @@
+// tests/routine_schedule.mjs — a declared cadence must have something that fires
+// it (task 1003209, goal 1000079; ADR 0188, follow-up audit §7).
+//
+// The check exists because goal 1000076's patrol was "wired" by every predicate
+// the repo had and still ran zero times. So these tests are written against the
+// ways that state can come BACK, not merely against the happy path: the strongest
+// one is the cron silently drifting off the declared cadence, which no
+// existence/substring predicate can ever catch.
+//
+// Hermetic — the evaluator is pure and driven with fixtures; the two live-tree
+// tests at the bottom assert the real repo is in the state this task shipped.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const rs = require(path.join(ROOT, 'scripts', 'gds', 'routine-schedule.js'));
+const { parseRoutineFrontmatter } = require(path.join(ROOT, 'scripts', 'gds', 'run-routine.js'));
+
+const WEEKLY_WF = {
+  file: 'redteam-patrol.yml',
+  text: [
+    'on:',
+    '  schedule:',
+    "    - cron: '17 6 * * 1'",
+    '  workflow_dispatch:',
+    'jobs:',
+    '  patrol:',
+    '    steps:',
+    '      - run: node scripts/gds/run-routine.js redteam-weekly',
+  ].join('\n'),
+};
+const routines = (withCadence, withoutCadence = []) => ({ withCadence, withoutCadence });
+const WEEKLY = [{ name: 'redteam-weekly', cadence: 'weekly', steps: [] }];
+
+// ---------------------------------------------------------------- cron parsing
+
+test('cronCadence classifies the four periods a routine may declare', () => {
+  assert.equal(rs.cronCadence('17 6 * * 1'), 'weekly');
+  assert.equal(rs.cronCadence('17 6 * * *'), 'daily');
+  assert.equal(rs.cronCadence('17 6 3 * *'), 'monthly');
+  assert.equal(rs.cronCadence('17 * * * *'), 'hourly');
+});
+
+test('cronCadence refuses what its vocabulary cannot describe, rather than guessing', () => {
+  // Unclassifiable must mean "never matches a declared cadence" — the safe
+  // direction. A clever cron that silently counted as `weekly` would reopen
+  // exactly the drift this check exists to catch.
+  for (const expr of ['*/5 * * * *', '0 6 * * 1-5', '0 6 * * 1,4', '0 0 1 1 *', '17 6 * *', '', 'nonsense']) {
+    assert.equal(rs.cronCadence(expr), null, `${expr} should not classify`);
+  }
+  // A day-of-month AND day-of-week together is an OR in cron — neither period.
+  assert.equal(rs.cronCadence('17 6 3 * 1'), null);
+});
+
+test('workflowCrons reads every cron a workflow declares, quoted or bare, ignoring trailing comments', () => {
+  const y = ["  schedule:", "    - cron: '17 6 * * 1'", '    - cron: "0 3 * * *"', '    - cron: 5 * * * *  # bare + comment'].join('\n');
+  assert.deepEqual(rs.workflowCrons(y), ['17 6 * * 1', '0 3 * * *', '5 * * * *']);
+  assert.deepEqual(rs.workflowCrons(''), []);
+});
+
+// ------------------------------------------------------------- what counts as
+//                                                                an invocation
+
+test('invokesRoutine accepts the dispatcher form and a verbatim step command', () => {
+  assert.equal(rs.invokesRoutine('run: node scripts/gds/run-routine.js redteam-weekly', 'redteam-weekly'), true);
+  assert.equal(rs.invokesRoutine('run: node scripts/gds/run-routine.js --dry-run redteam-weekly', 'redteam-weekly'), true);
+  assert.equal(
+    rs.invokesRoutine('run: node scripts/gds/redteam-patrol.js --file', 'redteam-weekly',
+      [{ command: 'node scripts/gds/redteam-patrol.js --file' }]),
+    true);
+});
+
+test('invokesRoutine does not accept a prefix match for a different routine', () => {
+  // `redteam-weekly-v2` must not satisfy `redteam-weekly` — that would let a
+  // renamed routine keep the old one's green.
+  assert.equal(rs.invokesRoutine('node scripts/gds/run-routine.js redteam-weekly-v2', 'redteam-weekly'), false);
+});
+
+// ------------------------------------------------------------------ the check
+
+test('a routine fired weekly by a weekly cron passes', () => {
+  const { violations } = rs.evaluate(routines(WEEKLY), [WEEKLY_WF]);
+  assert.deepEqual(violations, []);
+});
+
+test('THE regression this check exists for: the cron drifts off the declared cadence', () => {
+  // Every existence/substring predicate in the repo stays green here — the file
+  // exists, the workflow still names the routine, the manifest needle still hits.
+  // Only a relational check sees it.
+  const drifted = { ...WEEKLY_WF, text: WEEKLY_WF.text.replace('17 6 * * 1', '17 6 3 * *') };
+  const { violations } = rs.evaluate(routines(WEEKLY), [drifted]);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /declares cadence: weekly but no scheduler fires it at that period/);
+  assert.match(violations[0], /→ monthly/);
+});
+
+test('dispatch-only is not scheduled — the exact state the audit called "decorative"', () => {
+  const manual = { ...WEEKLY_WF, text: WEEKLY_WF.text.replace(/  schedule:\n.*\n/, '') };
+  const { violations } = rs.evaluate(routines(WEEKLY), [manual]);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /carries no 'on: schedule:' cron \(manual dispatch only\)/);
+});
+
+test('a cadence with no scheduler at all is a violation where CI exists', () => {
+  const { violations } = rs.evaluate(routines(WEEKLY), []);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /NOTHING fires it/);
+});
+
+test('rename rot is caught from the other side: a scheduler dispatching a routine that is gone', () => {
+  const { violations } = rs.evaluate(routines([], [{ name: 'something-else' }]), [WEEKLY_WF]);
+  assert.equal(violations.length, 1, violations.join(' | '));
+  assert.match(violations[0], /dispatches routine 'redteam-weekly', which has no/);
+});
+
+test('a workflow naming its own invocation twice reports one problem, not two', () => {
+  const twice = { ...WEEKLY_WF, text: `# see run-routine.js redteam-weekly below\n${WEEKLY_WF.text}` };
+  const { violations } = rs.evaluate(routines([], []), [twice]);
+  assert.equal(violations.length, 1);
+});
+
+test('an unknown cadence word is refused rather than silently unenforceable', () => {
+  const { violations } = rs.evaluate(routines([{ name: 'r', cadence: 'fortnightly', steps: [] }]), []);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /unknown cadence "fortnightly"/);
+});
+
+test('an instance checkout (no .github/workflows) warns instead of red-building', () => {
+  // Routines are materialized into every instance; .github/workflows is the core
+  // repo's and does not travel. Hard-failing there would red every instance for
+  // owning a scheduler the core cannot see.
+  const { violations, warnings } = rs.evaluate(routines(WEEKLY), null);
+  assert.deepEqual(violations, []);
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /NOTHING fires it/);
+});
+
+test('a routine with no cadence is a warning — it can only ever be run by hand', () => {
+  const { violations, warnings } = rs.evaluate(routines([], [{ name: 'manual-thing' }]), []);
+  assert.deepEqual(violations, []);
+  assert.match(warnings.join(' '), /declares no cadence/);
+});
+
+// --------------------------------------------------------------- the live tree
+
+test('the frontmatter parser reads cadence: alongside mode: and steps:', () => {
+  const md = ['---', 'mode: deterministic', 'cadence: weekly', 'description: d', 'steps:',
+    '  - command: node x.js', '    sink: gds', '---', '# body'].join('\n');
+  const fm = parseRoutineFrontmatter(md);
+  assert.equal(fm.cadence, 'weekly');
+  assert.equal(fm.mode, 'deterministic');
+  assert.equal(fm.steps.length, 1);
+  // Absent cadence must be null, not undefined — evaluate() branches on truthiness.
+  assert.equal(parseRoutineFrontmatter('---\nmode: deterministic\n---\n').cadence, null);
+});
+
+test('LIVE: redteam-weekly declares a cadence and this repo actually fires it', () => {
+  const r = rs.checkRoutineCadencesScheduled();
+  assert.equal(r.hardFail, false, r.violations.join(' | '));
+  assert.ok(rs.readRoutines().withCadence.some((x) => x.name === 'redteam-weekly'),
+    'redteam-weekly must declare a cadence — without it nothing can schedule it');
+});
+
+test('LIVE: the patrol workflow installs gitleaks, which the history scan cannot run without', () => {
+  // The follow-up audit listed the missing binary as its own gap; a scheduled
+  // patrol without it degrades to "history scan SKIPPED" every week forever.
+  const wf = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'redteam-patrol.yml'), 'utf8');
+  assert.match(wf, /GITLEAKS_BIN=/, 'the patrol must be handed a gitleaks binary');
+  assert.match(wf, /sha256sum -c -/, 'the binary must be checksum-verified (the tj-actions lesson)');
+  assert.match(wf, /fetch-depth: 0/, 'a shallow clone makes the history scan a confident no-op');
+});

package/tests/run_routine.mjs

@@ -49,8 +49,11 @@ test('a top-level key after steps ends the list', () => {
 });
 
 test('no frontmatter → empty contract', () => {
-  assert.deepEqual(parseRoutineFrontmatter('just a body'), { mode: null, steps: [], description: null });
-  assert.deepEqual(parseRoutineFrontmatter(''), { mode: null, steps: [], description: null });
+  // `cadence: null` joined the contract at task 1003209 — routine-schedule.js
+  // branches on its truthiness, so "absent" must be null, never undefined.
+  const empty = { mode: null, cadence: null, steps: [], description: null };
+  assert.deepEqual(parseRoutineFrontmatter('just a body'), empty);
+  assert.deepEqual(parseRoutineFrontmatter(''), empty);
 });
 
 test('mode-only frontmatter (judgment) → no steps', () => {