claude-dev-env 8.6.1 → 8.7.0

package/scripts/tests/test_contrast_framing.py

@@ -0,0 +1,117 @@
+"""Behavior of the contrast-framing detector and its rule document."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from contrast_framing import (
+    describe_contrast_framing,
+    find_contrast_framing,
+    form_named,
+)
+from dev_env_scripts_constants.contrast_framing_constants import (
+    ALL_CONTRAST_FRAMING_FORMS,
+    CONTRAST_FRAMING_RULE_DOCUMENT,
+)
+
+PACKAGE_ROOT: Path = Path(__file__).resolve().parents[2]
+
+
+def _form_names(document_text: str) -> list[str]:
+    return [each_hit[2] for each_hit in find_contrast_framing(document_text)]
+
+
+def _message_for(document_text: str) -> str:
+    line_number, _column, form_name = find_contrast_framing(document_text)[0]
+    source_line = document_text.splitlines()[line_number - 1]
+    return describe_contrast_framing(source_line, form_name)
+
+
+def test_trailing_comma_not_reports() -> None:
+    assert _form_names("A diff regression, not shared infrastructure.\n") == [
+        "trailing-comma-not"
+    ]
+
+
+def test_corrective_it_is_not_reports() -> None:
+    assert "corrective-it-is-not" in _form_names("It's not a flake, it's a bug.\n")
+
+
+def test_comparative_ranking_reports() -> None:
+    document_text = "Being precise about them matters more than trying to cover them.\n"
+    assert "comparative-ranking" in _form_names(document_text)
+
+
+def test_substitution_and_additive_forms_report() -> None:
+    document_text = "Park it rather than fix it, and not just for today.\n"
+    assert set(_form_names(document_text)) >= {
+        "substitution-rather-than",
+        "additive-not-just",
+    }
+
+
+def test_plain_quantity_comparison_stays_quiet() -> None:
+    assert _form_names("The function runs more than 30 lines.\n") == []
+
+
+def test_statement_of_what_is_stays_quiet() -> None:
+    document_text = (
+        "The check reports the failing line and names the fix.\n"
+        "Push the branch and read the verdict.\n"
+    )
+    assert _form_names(document_text) == []
+
+
+def test_code_span_and_fence_contents_stay_quiet() -> None:
+    document_text = (
+        "Call `parse(value, not_found)` for the missing case.\n"
+        "```\n"
+        "returns a value, not a default\n"
+        "```\n"
+    )
+    assert _form_names(document_text) == []
+
+
+def test_reported_line_and_column_locate_the_match() -> None:
+    document_text = "First line.\nOne answer, not two.\n"
+    assert find_contrast_framing(document_text) == [(2, 11, "trailing-comma-not")]
+
+
+def test_message_names_the_form_the_text_and_the_fix() -> None:
+    message = _message_for("One answer, not two.\n")
+    assert "trailing-comma-not" in message
+    assert "state what is true" in message.lower()
+
+
+def test_form_named_rejects_an_unknown_name() -> None:
+    with pytest.raises(KeyError):
+        form_named("no-such-form")
+
+
+def test_every_form_carries_a_row_in_the_rule_document() -> None:
+    rule_text = (PACKAGE_ROOT / CONTRAST_FRAMING_RULE_DOCUMENT).read_text(
+        encoding="utf-8"
+    )
+    for each_form in ALL_CONTRAST_FRAMING_FORMS:
+        assert f"`{each_form.name}`" in rule_text
+
+
+def test_a_list_of_not_items_stays_quiet() -> None:
+    document_text = "Not in chat, not in a commit message, not in a body.\n"
+    assert _form_names(document_text) == []
+
+
+def test_first_of_several_trailing_not_clauses_reports() -> None:
+    document_text = "A diff regression, not shared code, not a workaround.\n"
+    assert _form_names(document_text) == ["trailing-comma-not"]
+
+
+def test_a_quoted_line_stays_quiet() -> None:
+    assert _form_names("> a bug, not a flake\n") == []
+
+
+def test_message_truncates_a_quoted_line_past_the_limit() -> None:
+    message = _message_for(("x" * 200) + ", not the shorter reading.\n")
+    assert '"' + ("x" * 120) + '"' in message
+    assert "x" * 121 not in message

package/scripts/tests/test_followups.py

@@ -0,0 +1,88 @@
+"""Behavior tests for recording advisory findings in the follow-up ledger."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_CLAUDE_MD_ORPHANS,
+    CHECK_ID_PACKAGE_INVENTORY,
+    FOLLOWUP_LEDGER_MODULE_NAME,
+    SEVERITY_SMELL,
+)
+from repository_checks.followups import record_smell_findings
+from repository_checks.hook_modules import load_hooks_module
+from repository_checks.models import RepositoryCheckReport, RepositoryFinding
+from repository_policy_test_support import initialize_repository
+
+_INVENTORY_PATH = "pipeline/check_dialer_seam_cli.py"
+_INVENTORY_MESSAGE = "production file is absent from package inventory"
+
+
+def test_should_record_an_advisory_finding_with_its_message(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    record_smell_findings(repository_root, _inventory_report())
+    assert _recorded_rows(repository_root) == [
+        (CHECK_ID_PACKAGE_INVENTORY, _INVENTORY_PATH, _INVENTORY_MESSAGE, SEVERITY_SMELL)
+    ]
+
+
+def test_should_record_one_row_for_a_finding_seen_twice(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    report = _inventory_report()
+    record_smell_findings(repository_root, report)
+    record_smell_findings(repository_root, report)
+    assert len(_recorded_rows(repository_root)) == 1
+
+
+def test_should_leave_a_breaking_finding_out_of_the_ledger(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    record_smell_findings(
+        repository_root,
+        RepositoryCheckReport(
+            (
+                RepositoryFinding(
+                    CHECK_ID_CLAUDE_MD_ORPHANS,
+                    "notes/CLAUDE.md",
+                    "references missing file absent_helper.py",
+                ),
+            ),
+            (),
+        ),
+    )
+    assert _recorded_rows(repository_root) == []
+
+
+def _inventory_report() -> RepositoryCheckReport:
+    return RepositoryCheckReport(
+        (
+            RepositoryFinding(
+                CHECK_ID_PACKAGE_INVENTORY, _INVENTORY_PATH, _INVENTORY_MESSAGE
+            ),
+        ),
+        (),
+    )
+
+
+def _recorded_rows(repository_root: Path) -> list[tuple[str, str, str, str]]:
+    ledger = load_hooks_module(FOLLOWUP_LEDGER_MODULE_NAME)
+    return [
+        (
+            each_finding.check_id,
+            each_finding.file_path,
+            each_finding.message,
+            each_finding.severity,
+        )
+        for each_finding in ledger.all_recorded_findings(repository_root)
+    ]

package/scripts/tests/test_match_exemptions.py

@@ -0,0 +1,291 @@
+"""An owned match clears while every other scanner finding stays reported."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from repository_checks.config.policy_document import (
+    EMAIL_EXEMPTION_FAMILY,
+    PRIVATE_IP_EXEMPTION_FAMILY,
+    MatchExemptionFamily,
+)
+from repository_checks.match_exemptions import (
+    load_all_match_exemptions,
+    load_match_exemptions,
+)
+from repository_checks.tracked_secrets import collect_tracked_secret_findings
+
+CONTACT = "fixture-contact@company.io"
+CHANGED_CONTACT = "changed-contact@company.io"
+DIGEST = hashlib.sha256(CONTACT.encode()).hexdigest()
+RUNNER_ADDRESS = "10.83.21.14"
+CHANGED_RUNNER_ADDRESS = "10.83.21.15"
+RUNNER_ADDRESS_DIGEST = hashlib.sha256(RUNNER_ADDRESS.encode()).hexdigest()
+
+
+def _write_config(root: Path, entries: list[object]) -> None:
+    _write_document(root, {"version": 1, "email_exemptions": entries})
+
+
+def _write_private_ip_config(root: Path, entries: list[object]) -> None:
+    _write_document(root, {"version": 1, "private_ip_exemptions": entries})
+
+
+def _write_document(root: Path, document: dict[str, object]) -> None:
+    directory = root / "config"
+    directory.mkdir(exist_ok=True)
+    (directory / "repository-policy.json").write_text(
+        json.dumps(document), encoding="utf-8"
+    )
+
+
+def _entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": "contacts.py",
+        "sha256": DIGEST,
+        "reason": "Published support contact",
+        **changes,
+    }
+
+
+def _runner_entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": "runner.py",
+        "sha256": RUNNER_ADDRESS_DIGEST,
+        "reason": "Documented address of the shared build runner",
+        **changes,
+    }
+
+
+def _load_email_exemptions(root: Path) -> frozenset[tuple[str, str, str]]:
+    return load_match_exemptions(root, EMAIL_EXEMPTION_FAMILY)
+
+
+def test_only_matching_email_and_path_are_exempt(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry()])
+    (tmp_path / "contacts.py").write_text(
+        f"contact = '{CONTACT}'\nchanged = '{CHANGED_CONTACT}'\n", encoding="utf-8"
+    )
+    (tmp_path / "other.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
+    findings = collect_tracked_secret_findings(tmp_path, ["contacts.py", "other.py"])
+    assert [finding.relative_path for finding in findings] == [
+        "contacts.py",
+        "other.py",
+    ]
+    assert all(finding.message.startswith("[email]") for finding in findings)
+
+
+def test_matching_contact_has_no_findings(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry()])
+    (tmp_path / "contacts.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
+    assert collect_tracked_secret_findings(tmp_path, ["contacts.py"]) == []
+
+
+def test_matching_private_ip_has_no_findings(tmp_path: Path) -> None:
+    _write_private_ip_config(tmp_path, [_runner_entry()])
+    (tmp_path / "runner.py").write_text(
+        f"host = '{RUNNER_ADDRESS}'\n", encoding="utf-8"
+    )
+    assert collect_tracked_secret_findings(tmp_path, ["runner.py"]) == []
+
+
+def test_only_matching_private_ip_and_path_are_exempt(tmp_path: Path) -> None:
+    _write_private_ip_config(tmp_path, [_runner_entry()])
+    (tmp_path / "runner.py").write_text(
+        f"host = '{RUNNER_ADDRESS}'\nspare = '{CHANGED_RUNNER_ADDRESS}'\n",
+        encoding="utf-8",
+    )
+    (tmp_path / "other.py").write_text(f"host = '{RUNNER_ADDRESS}'\n", encoding="utf-8")
+    findings = collect_tracked_secret_findings(tmp_path, ["runner.py", "other.py"])
+    assert [finding.relative_path for finding in findings] == ["runner.py", "other.py"]
+    assert all(finding.message.startswith("[private-ip]") for finding in findings)
+
+
+def test_private_ip_exemption_leaves_email_findings(tmp_path: Path) -> None:
+    _write_document(
+        tmp_path,
+        {"version": 1, "private_ip_exemptions": [_runner_entry(path="hosts.py")]},
+    )
+    (tmp_path / "hosts.py").write_text(
+        f"host = '{RUNNER_ADDRESS}'\ncontact = '{CONTACT}'\n", encoding="utf-8"
+    )
+    findings = collect_tracked_secret_findings(tmp_path, ["hosts.py"])
+    assert [finding.message.split("]")[0] + "]" for finding in findings] == ["[email]"]
+
+
+def test_both_families_apply_together(tmp_path: Path) -> None:
+    _write_document(
+        tmp_path,
+        {
+            "version": 1,
+            "email_exemptions": [_entry(path="hosts.py")],
+            "private_ip_exemptions": [_runner_entry(path="hosts.py")],
+        },
+    )
+    (tmp_path / "hosts.py").write_text(
+        f"host = '{RUNNER_ADDRESS}'\ncontact = '{CONTACT}'\n", encoding="utf-8"
+    )
+    assert collect_tracked_secret_findings(tmp_path, ["hosts.py"]) == []
+
+
+def test_email_entry_does_not_exempt_a_private_ip(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry(path="runner.py", sha256=RUNNER_ADDRESS_DIGEST)])
+    (tmp_path / "runner.py").write_text(
+        f"host = '{RUNNER_ADDRESS}'\n", encoding="utf-8"
+    )
+    findings = collect_tracked_secret_findings(tmp_path, ["runner.py"])
+    assert [finding.message.startswith("[private-ip]") for finding in findings] == [
+        True
+    ]
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/contacts.py",
+        "C:/contacts.py",
+        "../contacts.py",
+        "src/../contacts.py",
+        "*.py",
+        "src/?.py",
+        "src/[a].py",
+        "src\\contacts.py",
+        "src//contacts.py",
+        "./contacts.py",
+        "",
+    ],
+)
+def test_rejects_nonliteral_or_nonrelative_paths(tmp_path: Path, path: str) -> None:
+    _write_config(tmp_path, [_entry(path=path)])
+    with pytest.raises(ValueError):
+        _load_email_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "entry",
+    [
+        None,
+        {},
+        _entry(reason=" "),
+        _entry(sha256="f" * 63),
+        _entry(sha256="z" * 64),
+        _entry(category="secret"),
+    ],
+)
+def test_rejects_invalid_entries(tmp_path: Path, entry: object) -> None:
+    _write_config(tmp_path, [entry])
+    with pytest.raises(ValueError):
+        _load_email_exemptions(tmp_path)
+
+
+def test_rejects_duplicate_entries(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry(), _entry(reason="Another explanation")])
+    with pytest.raises(ValueError):
+        _load_email_exemptions(tmp_path)
+
+
+def test_rejects_duplicate_private_ip_entries(tmp_path: Path) -> None:
+    _write_private_ip_config(
+        tmp_path, [_runner_entry(), _runner_entry(reason="Another explanation")]
+    )
+    with pytest.raises(ValueError):
+        load_match_exemptions(tmp_path, PRIVATE_IP_EXEMPTION_FAMILY)
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        "{",
+        "[]",
+        '{"version":true,"email_exemptions":[]}',
+        '{"version":1,"email_exemptions":{}}',
+        '{"version":1,"email_exemptions":[],"extra":0}',
+        '{"version":1,"version":1,"email_exemptions":[]}',
+        '{"version":1,"private_ip_exemptions":{}}',
+    ],
+)
+def test_malformed_config_stops_scanning(tmp_path: Path, content: str) -> None:
+    (tmp_path / "config").mkdir()
+    (tmp_path / "config" / "repository-policy.json").write_text(
+        content, encoding="utf-8"
+    )
+    with pytest.raises(ValueError):
+        collect_tracked_secret_findings(tmp_path, [])
+
+
+def test_missing_config_has_no_exemptions(tmp_path: Path) -> None:
+    assert _load_email_exemptions(tmp_path) == frozenset()
+
+
+@pytest.mark.parametrize(
+    "family", [EMAIL_EXEMPTION_FAMILY, PRIVATE_IP_EXEMPTION_FAMILY]
+)
+@pytest.mark.parametrize(
+    "document",
+    [
+        {"version": 1},
+        {
+            "version": 1,
+            "path_exemptions": [
+                {
+                    "path": "evidence/manifest.json",
+                    "sha256": DIGEST,
+                    "reason": "Frozen evidence file pinned by its consumers",
+                }
+            ],
+        },
+    ],
+)
+def test_document_without_a_family_list_loads_no_exemptions(
+    tmp_path: Path, document: dict[str, object], family: MatchExemptionFamily
+) -> None:
+    """A document may carry another family, or no exception list at all."""
+    _write_document(tmp_path, document)
+    assert load_match_exemptions(tmp_path, family) == frozenset()
+
+
+def test_reason_rejection_names_the_ownership_requirement(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry(reason=" ")])
+    with pytest.raises(ValueError) as rejection:
+        _load_email_exemptions(tmp_path)
+    assert (
+        str(rejection.value)
+        == "Email exemption reason must explain why the exception is owned"
+    )
+
+
+def test_private_ip_reason_rejection_names_its_own_family(tmp_path: Path) -> None:
+    _write_private_ip_config(tmp_path, [_runner_entry(reason=" ")])
+    with pytest.raises(ValueError) as rejection:
+        load_match_exemptions(tmp_path, PRIVATE_IP_EXEMPTION_FAMILY)
+    assert (
+        str(rejection.value)
+        == "Private IP exemption reason must explain why the exception is owned"
+    )
+
+
+def test_loading_every_family_returns_both_owned_matches(tmp_path: Path) -> None:
+    _write_document(
+        tmp_path,
+        {
+            "version": 1,
+            "email_exemptions": [_entry()],
+            "private_ip_exemptions": [_runner_entry()],
+        },
+    )
+
+    assert load_all_match_exemptions(tmp_path) == frozenset(
+        {
+            ("contacts.py", "email", DIGEST),
+            ("runner.py", "private-ip", RUNNER_ADDRESS_DIGEST),
+        }
+    )
+
+
+def test_loading_every_family_returns_nothing_without_a_policy_document(
+    tmp_path: Path,
+) -> None:
+    assert load_all_match_exemptions(tmp_path) == frozenset()

package/scripts/tests/test_models.py

@@ -1,4 +1,4 @@
-"""Behavior tests for repository-check report models."""
+"""Behavior tests for the severity that decides the committed-tree gate."""
 
 from __future__ import annotations
 
@@ -6,15 +6,31 @@ import sys
 from pathlib import Path
 
 _SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
 if str(_SCRIPTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
 
 from repository_checks.config.constants import (
+    ALL_CHECK_IDS,
+    CHECK_ID_CLAUDE_MD_ORPHANS,
+    CHECK_ID_PACKAGE_INVENTORY,
     FAILED_CHECK_EXIT_CODE,
     FINDINGS_EXIT_CODE,
+    SEVERITY_BREAKING,
+    SEVERITY_BY_CHECK_ID,
+    SEVERITY_SMELL,
     SUCCESS_EXIT_CODE,
 )
-from repository_checks.models import RepositoryCheckReport, RepositoryFinding
+from repository_checks.hook_modules import load_hooks_module
+from repository_checks.models import (
+    RepositoryCheckReport,
+    RepositoryFinding,
+    severity_for_check_id,
+)
+
+_LEDGER_CONSTANTS_MODULE_NAME = "hooks_constants.followup_ledger_constants"
 
 
 def test_should_choose_exit_code_by_report_severity() -> None:
@@ -24,3 +40,52 @@ def test_should_choose_exit_code_by_report_severity() -> None:
     assert RepositoryCheckReport((finding,), ("check",)).exit_code == (
         FAILED_CHECK_EXIT_CODE
     )
+
+
+def test_should_declare_a_severity_for_every_check() -> None:
+    assert tuple(SEVERITY_BY_CHECK_ID) == ALL_CHECK_IDS
+
+
+def test_should_read_a_check_with_no_row_as_breaking() -> None:
+    assert severity_for_check_id("check-with-no-row") == SEVERITY_BREAKING
+
+
+def test_should_carry_the_ledger_severity_names() -> None:
+    ledger_constants = load_hooks_module(_LEDGER_CONSTANTS_MODULE_NAME)
+    assert SEVERITY_BREAKING == ledger_constants.SEVERITY_BREAKING
+    assert SEVERITY_SMELL == ledger_constants.SEVERITY_SMELL
+
+
+def test_should_classify_the_package_inventory_check_as_advisory() -> None:
+    assert severity_for_check_id(CHECK_ID_PACKAGE_INVENTORY) == SEVERITY_SMELL
+
+
+def test_should_pass_a_report_that_carries_advisory_findings_alone() -> None:
+    report = RepositoryCheckReport((_inventory_finding(),), ())
+    assert report.all_smell_findings == (_inventory_finding(),)
+    assert report.all_breaking_findings == ()
+    assert report.exit_code == SUCCESS_EXIT_CODE
+
+
+def test_should_fail_a_report_that_carries_a_breaking_finding() -> None:
+    breaking_finding = RepositoryFinding(
+        CHECK_ID_CLAUDE_MD_ORPHANS, "notes/CLAUDE.md", "references missing file x.py"
+    )
+    report = RepositoryCheckReport((_inventory_finding(), breaking_finding), ())
+    assert report.all_breaking_findings == (breaking_finding,)
+    assert report.exit_code == FINDINGS_EXIT_CODE
+
+
+def test_should_fail_closed_over_an_advisory_finding() -> None:
+    report = RepositoryCheckReport(
+        (_inventory_finding(),), (CHECK_ID_PACKAGE_INVENTORY,)
+    )
+    assert report.exit_code == FAILED_CHECK_EXIT_CODE
+
+
+def _inventory_finding() -> RepositoryFinding:
+    return RepositoryFinding(
+        CHECK_ID_PACKAGE_INVENTORY,
+        "pipeline/check_dialer_seam_cli.py",
+        "production file is absent from package inventory",
+    )

package/scripts/tests/test_package_inventory.py

@@ -14,7 +14,7 @@ if str(_TESTS_DIRECTORY) not in sys.path:
 from repository_checks.config.constants import (
     CHECK_ID_PACKAGE_INVENTORY,
     FAILED_CHECK_EXIT_CODE,
-    FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
 )
 from repository_policy_test_support import (
     commit_tracked_files,
@@ -33,14 +33,16 @@ _SKILL_INVENTORY_MARKDOWN = (
 )
 
 
-def test_should_flag_a_stale_package_inventory(tmp_path: Path) -> None:
+def test_should_report_a_stale_package_inventory_without_failing(
+    tmp_path: Path,
+) -> None:
     repository_root = tmp_path / "repo"
     initialize_repository(repository_root)
     package_directory = repository_root / "pipeline"
     _write_package_inventory(package_directory)
     commit_tracked_files(repository_root)
     exit_code, stdout_text, _stderr_text = run_policy(repository_root)
-    assert exit_code == FINDINGS_EXIT_CODE
+    assert exit_code == SUCCESS_EXIT_CODE
     assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
     assert "pipeline/check_dialer_seam_cli.py" in stdout_text
 
@@ -52,7 +54,7 @@ def test_should_check_active_skills_and_exclude_archived_skills(tmp_path: Path)
     _seed_skill_package(repository_root / ".agents" / "skills-archived" / "old-skill")
     commit_tracked_files(repository_root)
     exit_code, stdout_text, _stderr_text = run_policy(repository_root)
-    assert exit_code == FINDINGS_EXIT_CODE
+    assert exit_code == SUCCESS_EXIT_CODE
     assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
     assert ".agents/skills/live-skill/scripts/unlisted_gamma.py" in stdout_text
     assert (

package/scripts/tests/test_pester_suites_run.py

@@ -0,0 +1,53 @@
+"""Specifications for the quality gate reaching every PowerShell suite.
+
+A suite nobody calls stops guarding without failing, so the tree reads as
+covered while nothing holds it. These tests pin the wiring that calls the
+suites and the directory the call points at.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+_CHECK_SCRIPT_PATH = _SCRIPTS_DIRECTORY / "check.ps1"
+_RUNNER_SCRIPT_PATH = _SCRIPTS_DIRECTORY / "Invoke-PesterSuites.ps1"
+_TESTS_DIRECTORY = _SCRIPTS_DIRECTORY / "tests"
+_SUITE_GLOB = "*.Tests.ps1"
+_UTF8_ENCODING = "utf-8"
+
+
+def test_should_run_the_suites_as_a_gate_tool() -> None:
+    script_text = _CHECK_SCRIPT_PATH.read_text(encoding=_UTF8_ENCODING)
+
+    assert "Invoke-Tool -Label 'pester'" in script_text
+    assert "Invoke-PesterSuites.ps1" in script_text
+    assert "SkipPester" in script_text
+
+
+def test_should_point_the_run_at_the_directory_holding_the_suites() -> None:
+    script_text = _CHECK_SCRIPT_PATH.read_text(encoding=_UTF8_ENCODING)
+
+    assert "$pesterTestsRoot = Resolve-Path (Join-Path $PSScriptRoot 'tests')" in (
+        script_text
+    )
+    assert "-TestsRoot $pesterTestsRoot" in script_text
+    assert list(_TESTS_DIRECTORY.glob(_SUITE_GLOB))
+
+
+def test_should_run_the_suites_in_a_child_process() -> None:
+    """Invoke-Tool reads an exit code, which an in-process cmdlet never sets."""
+    script_text = _CHECK_SCRIPT_PATH.read_text(encoding=_UTF8_ENCODING)
+
+    assert "pwsh -NoProfile -File" in script_text
+    assert "Invoke-Pester -Configuration" not in script_text
+    assert "Invoke-Pester -Configuration" in (
+        _RUNNER_SCRIPT_PATH.read_text(encoding=_UTF8_ENCODING)
+    )
+
+
+def test_should_fail_the_run_when_the_module_is_missing() -> None:
+    runner_text = _RUNNER_SCRIPT_PATH.read_text(encoding=_UTF8_ENCODING)
+
+    assert "Get-Module -ListAvailable -Name Pester" in runner_text
+    assert "exit 1" in runner_text