claude-dev-env 7.4.0 → 7.4.1

package/scripts/tests/test_email_exemptions.py

@@ -0,0 +1,121 @@
+"""Exact public-contact exceptions preserve all other scanner findings."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from repository_checks.email_exemptions import load_email_exemptions
+from repository_checks.tracked_secrets import collect_tracked_secret_findings
+
+CONTACT = "fixture-contact@company.io"
+CHANGED_CONTACT = "changed-contact@company.io"
+DIGEST = hashlib.sha256(CONTACT.encode()).hexdigest()
+
+
+def _write_config(root: Path, entries: list[object]) -> None:
+    directory = root / "config"
+    directory.mkdir(exist_ok=True)
+    (directory / "repository-policy.json").write_text(
+        json.dumps({"version": 1, "email_exemptions": entries}), encoding="utf-8"
+    )
+
+
+def _entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": "contacts.py",
+        "sha256": DIGEST,
+        "reason": "Published support contact",
+        **changes,
+    }
+
+
+def test_only_matching_email_and_path_are_exempt(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry()])
+    (tmp_path / "contacts.py").write_text(
+        f"contact = '{CONTACT}'\nchanged = '{CHANGED_CONTACT}'\n", encoding="utf-8"
+    )
+    (tmp_path / "other.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
+    findings = collect_tracked_secret_findings(tmp_path, ["contacts.py", "other.py"])
+    assert [finding.relative_path for finding in findings] == [
+        "contacts.py",
+        "other.py",
+    ]
+    assert all(finding.message.startswith("[email]") for finding in findings)
+
+
+def test_matching_contact_has_no_findings(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry()])
+    (tmp_path / "contacts.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
+    assert collect_tracked_secret_findings(tmp_path, ["contacts.py"]) == []
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/contacts.py",
+        "C:/contacts.py",
+        "../contacts.py",
+        "src/../contacts.py",
+        "*.py",
+        "src/?.py",
+        "src/[a].py",
+        "src\\contacts.py",
+        "src//contacts.py",
+        "./contacts.py",
+        "",
+    ],
+)
+def test_rejects_nonliteral_or_nonrelative_paths(tmp_path: Path, path: str) -> None:
+    _write_config(tmp_path, [_entry(path=path)])
+    with pytest.raises(ValueError):
+        load_email_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "entry",
+    [
+        None,
+        {},
+        _entry(reason=" "),
+        _entry(sha256="f" * 63),
+        _entry(sha256="z" * 64),
+        _entry(category="secret"),
+    ],
+)
+def test_rejects_invalid_entries(tmp_path: Path, entry: object) -> None:
+    _write_config(tmp_path, [entry])
+    with pytest.raises(ValueError):
+        load_email_exemptions(tmp_path)
+
+
+def test_rejects_duplicate_entries(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry(), _entry(reason="Another explanation")])
+    with pytest.raises(ValueError):
+        load_email_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        "{",
+        "[]",
+        '{"version":true,"email_exemptions":[]}',
+        '{"version":1,"email_exemptions":{}}',
+        '{"version":1,"email_exemptions":[],"extra":0}',
+        '{"version":1,"version":1,"email_exemptions":[]}',
+    ],
+)
+def test_malformed_config_stops_scanning(tmp_path: Path, content: str) -> None:
+    (tmp_path / "config").mkdir()
+    (tmp_path / "config" / "repository-policy.json").write_text(
+        content, encoding="utf-8"
+    )
+    with pytest.raises(ValueError):
+        collect_tracked_secret_findings(tmp_path, [])
+
+
+def test_missing_config_has_no_exemptions(tmp_path: Path) -> None:
+    assert load_email_exemptions(tmp_path) == frozenset()

package/scripts/tests/test_env_var_documentation.py

@@ -17,6 +17,9 @@ from repository_checks.config.constants import (
     FINDINGS_EXIT_CODE,
     SUCCESS_EXIT_CODE,
 )
+from repository_checks.env_var_documentation import (
+    collect_env_var_documentation_findings,
+)
 from repository_policy_test_support import (
     commit_tracked_files,
     initialize_repository,
@@ -131,3 +134,26 @@ def record_read_paths(monkeypatch: pytest.MonkeyPatch) -> list[Path]:
 
     monkeypatch.setattr(Path, "read_text", record_read_path)
     return all_read_paths
+
+
+@pytest.mark.parametrize("header", ["Symbol", "Component", "Constant"])
+def test_should_ignore_source_tables_before_reading_named_code(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, header: str
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "workflow.py", "def run():\n    return\n")
+    write_text(
+        repository_root / "docs" / "source-map.md",
+        f"| {header} | Source |\n"
+        "| --- | --- |\n"
+        "| `PROCESSING_VISIBLE` | `workflow.py` |\n",
+    )
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(
+        monkeypatch, "workflow.py", "unrelated source unreadable"
+    )
+    assert (
+        collect_env_var_documentation_findings(repository_root, ["docs/source-map.md"])
+        == []
+    )

package/scripts/tests/test_tracked_secrets.py

@@ -10,6 +10,7 @@ import pytest
 from repository_checks.config.constants import (
     ALL_TRACKED_SECRET_EXACT_EXEMPTIONS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    FAILED_CHECK_EXIT_CODE,
     FINDINGS_EXIT_CODE,
 )
 from repository_checks.hook_modules import load_hooks_module
@@ -55,6 +56,18 @@ def test_should_flag_a_tracked_secret(tmp_path: Path) -> None:
     assert _SYNTHETIC_GITHUB_TOKEN not in stdout_text
 
 
+def test_should_fail_closed_for_malformed_repository_email_policy(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "config" / "repository-policy.json", "{")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert f"error: rule failed: {CHECK_ID_TRACKED_PERSONAL_DATA}" in stdout_text
+
+
 def test_should_fail_closed_before_reading_a_tracked_symlink_outside_repository(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None: