claude-dev-env 8.7.0 → 8.9.0

package/scripts/tests/test_gh_artifact_upload.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import shutil
 import subprocess
 import sys
 import types
@@ -26,6 +27,15 @@ _DEFAULT_READBACK_ASSET = {
 }
 
 
+_REAL_WHICH = shutil.which
+_REAL_RUN = subprocess.run
+
+
+@pytest.fixture(autouse=True)
+def oxipng_on_path(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(shutil, "which", lambda _name: "oxipng")
+
+
 def _make_gh_stub(
     recorded_calls: list[list[str]],
     view_return_code: int,
@@ -203,3 +213,68 @@ def test_upload_artifact_missing_file_raises(monkeypatch: pytest.MonkeyPatch) ->
     monkeypatch.setattr(subprocess, "run", _make_gh_stub([], view_return_code=0))
     with pytest.raises(mod.ArtifactUploadError):
         mod.upload_artifact("does_not_exist_9f3a.png", "owner/repo")
+
+
+def test_upload_artifact_sends_the_oxipng_shrunk_png(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    image_module = pytest.importorskip("PIL.Image")
+    if _REAL_WHICH("oxipng") is None:
+        pytest.skip("oxipng is not on PATH")
+    monkeypatch.setattr(shutil, "which", _REAL_WHICH)
+    source_file = tmp_path / "contact_sheet.png"
+    image_module.new("RGB", (64, 64), (200, 40, 40)).save(
+        source_file, format="PNG", compress_level=0
+    )
+    source_bytes = source_file.read_bytes()
+    all_uploaded_sizes: list[int] = []
+    gh_stub = _make_gh_stub([], view_return_code=0)
+
+    def gh_stub_beside_live_oxipng(
+        all_command_arguments: list[str], **keyword_arguments: object
+    ) -> object:
+        if all_command_arguments[0] != "gh":
+            return _REAL_RUN(all_command_arguments, **keyword_arguments)
+        if "upload" in all_command_arguments:
+            staged_path = Path(all_command_arguments[4])
+            all_uploaded_sizes.append(staged_path.stat().st_size)
+            with image_module.open(staged_path) as uploaded:
+                assert uploaded.convert("RGB").tobytes() == bytes((200, 40, 40)) * 4096
+        return gh_stub(all_command_arguments, **keyword_arguments)
+
+    monkeypatch.setattr(subprocess, "run", gh_stub_beside_live_oxipng)
+
+    mod.upload_artifact(str(source_file), "owner/repo")
+
+    assert all_uploaded_sizes and all_uploaded_sizes[0] < len(source_bytes)
+    assert source_file.read_bytes() == source_bytes
+
+
+def test_upload_artifact_refuses_a_png_when_oxipng_is_missing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_file = tmp_path / "out.png"
+    source_file.write_bytes(b"binary")
+    recorded_calls: list[list[str]] = []
+    monkeypatch.setattr(shutil, "which", lambda _name: None)
+    monkeypatch.setattr(subprocess, "run", _make_gh_stub(recorded_calls, view_return_code=0))
+
+    with pytest.raises(mod.ArtifactUploadError, match="oxipng"):
+        mod.upload_artifact(str(source_file), "owner/repo")
+
+    assert not any("upload" in call for call in recorded_calls)
+
+
+def test_optimize_png_losslessly_leaves_other_formats_alone(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_file = tmp_path / "trace.zip"
+    source_file.write_bytes(b"PK archive")
+    recorded_calls: list[list[str]] = []
+    monkeypatch.setattr(shutil, "which", lambda _name: None)
+    monkeypatch.setattr(subprocess, "run", _make_gh_stub(recorded_calls, view_return_code=0))
+
+    mod.optimize_png_losslessly(source_file)
+
+    assert source_file.read_bytes() == b"PK archive"
+    assert recorded_calls == []

package/scripts/tests/test_match_exemptions.py

@@ -21,8 +21,8 @@ from repository_checks.tracked_secrets import collect_tracked_secret_findings
 CONTACT = "fixture-contact@company.io"
 CHANGED_CONTACT = "changed-contact@company.io"
 DIGEST = hashlib.sha256(CONTACT.encode()).hexdigest()
-RUNNER_ADDRESS = "10.83.21.14"
-CHANGED_RUNNER_ADDRESS = "10.83.21.15"
+RUNNER_ADDRESS = "10.0.0.14"
+CHANGED_RUNNER_ADDRESS = "10.0.0.15"
 RUNNER_ADDRESS_DIGEST = hashlib.sha256(RUNNER_ADDRESS.encode()).hexdigest()
 
 

package/scripts/tests/test_private_term_scan.py

@@ -0,0 +1,176 @@
+"""Behavior tests for the GitHub event private-term scan."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+import private_term_scan
+
+_FIXTURE_TERM = "acmewidget"
+_CLEAN_IDENTITY = ("Claude", "noreply@example.com")
+
+
+@pytest.fixture(autouse=True)
+def private_fixture_terms(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        private_term_scan,
+        "ALL_PRIVATE_TERM_DIGESTS",
+        frozenset(
+            {
+                PrivateTermDigest(
+                    length=len(_FIXTURE_TERM),
+                    sha256=hashlib.sha256(_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+                )
+            }
+        ),
+    )
+
+
+def _write_event(tmp_path: Path, event: dict[str, object]) -> Path:
+    event_path = tmp_path / "event.json"
+    event_path.write_text(json.dumps(event), encoding="utf-8")
+    return event_path
+
+
+def _git(repository_root: Path, *all_arguments: str, name: str, email: str) -> str:
+    completed = subprocess.run(
+        ["git", "-C", str(repository_root), *all_arguments],
+        check=True,
+        capture_output=True,
+        text=True,
+        env={
+            "GIT_AUTHOR_NAME": name,
+            "GIT_AUTHOR_EMAIL": email,
+            "GIT_COMMITTER_NAME": name,
+            "GIT_COMMITTER_EMAIL": email,
+            "GIT_CONFIG_GLOBAL": "/dev/null",
+            "GIT_CONFIG_NOSYSTEM": "1",
+            "HOME": str(repository_root),
+        },
+    )
+    return completed.stdout.strip()
+
+
+def _repository_with_commits(
+    tmp_path: Path, all_commits: list[tuple[str, str, str]]
+) -> tuple[Path, str, str]:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _git(
+        repository_root, "init", "-q", name=_CLEAN_IDENTITY[0], email=_CLEAN_IDENTITY[1]
+    )
+    _git(
+        repository_root,
+        "commit",
+        "-q",
+        "--allow-empty",
+        "-m",
+        "base",
+        name=_CLEAN_IDENTITY[0],
+        email=_CLEAN_IDENTITY[1],
+    )
+    base = _git(repository_root, "rev-parse", "HEAD", name="x", email="x@example.com")
+    for each_message, each_name, each_email in all_commits:
+        _git(
+            repository_root,
+            "commit",
+            "-q",
+            "--allow-empty",
+            "-m",
+            each_message,
+            name=each_name,
+            email=each_email,
+        )
+    head = _git(repository_root, "rev-parse", "HEAD", name="x", email="x@example.com")
+    return repository_root, base, head
+
+
+def test_should_flag_a_pull_request_body_line(tmp_path: Path) -> None:
+    event_path = _write_event(
+        tmp_path,
+        {
+            "pull_request": {
+                "title": "fix: one",
+                "body": "Why\nSee Acme-Widgets-Inc/x#1\n",
+            }
+        },
+    )
+    all_findings = private_term_scan.scan_event(event_path)
+    assert all_findings == [
+        "pull request body: Line 2 names a private organization. "
+        "Describe it in general terms and drop any link to it."
+    ]
+
+
+def test_should_flag_a_pull_request_title(tmp_path: Path) -> None:
+    event_path = _write_event(
+        tmp_path, {"pull_request": {"title": "fix: acme widget upload", "body": None}}
+    )
+    assert private_term_scan.scan_event(event_path)[0].startswith("pull request title:")
+
+
+@pytest.mark.parametrize(
+    ("event", "label"),
+    [
+        ({"comment": {"body": "by acme widgets"}}, "comment body"),
+        ({"review": {"body": "by acme widgets"}}, "review body"),
+        ({"issue": {"title": "clean", "body": "by acme widgets"}}, "issue body"),
+        ({"release": {"name": "v1", "body": "by acme widgets"}}, "release body"),
+    ],
+)
+def test_should_flag_each_event_text(
+    tmp_path: Path, event: dict[str, object], label: str
+) -> None:
+    all_findings = private_term_scan.scan_event(_write_event(tmp_path, event))
+    assert len(all_findings) == 1
+    assert all_findings[0].startswith(f"{label}: Line 1")
+
+
+def test_should_pass_a_clean_event(tmp_path: Path) -> None:
+    event_path = _write_event(
+        tmp_path,
+        {"comment": {"body": "Looks good."}, "issue": {"title": "t", "body": None}},
+    )
+    assert private_term_scan.scan_event(event_path) == []
+
+
+def test_should_flag_a_commit_message_and_a_commit_identity(tmp_path: Path) -> None:
+    repository_root, base, head = _repository_with_commits(
+        tmp_path,
+        [
+            ("fix: clean change", "Pat", "pat@acmewidgets.example.com"),
+            ("docs: note\n\nWritten for Acme Widgets.", *_CLEAN_IDENTITY),
+            ("chore: clean", *_CLEAN_IDENTITY),
+        ],
+    )
+    all_findings = private_term_scan.scan_commits(repository_root, f"{base}..{head}")
+    assert len(all_findings) == 2
+    assert all_findings[0].startswith("commit ")
+    assert " identity:" in all_findings[0]
+    assert " message: Line 3 " in all_findings[1]
+    assert all("acme" not in each_finding.lower() for each_finding in all_findings)
+
+
+def test_should_print_findings_and_fail_from_the_command_line(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    event_path = _write_event(tmp_path, {"comment": {"body": "by acme widgets"}})
+    exit_code = private_term_scan.main(["--event-path", str(event_path)])
+    assert exit_code == 1
+    assert "comment body: Line 1" in capsys.readouterr().out
+
+
+def test_should_pass_from_the_command_line_on_a_clean_event(tmp_path: Path) -> None:
+    event_path = _write_event(tmp_path, {"comment": {"body": "fine"}})
+    assert private_term_scan.main(["--event-path", str(event_path)]) == 0

package/scripts/tests/test_private_terms.py

@@ -0,0 +1,59 @@
+"""Behavior tests for the hashed private-term matcher."""
+
+from __future__ import annotations
+
+import hashlib
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+from private_terms import names_private_term, private_term_line_numbers
+
+_FIXTURE_TERM = "acmewidget"
+_ALL_FIXTURE_DIGESTS = frozenset(
+    {
+        PrivateTermDigest(
+            length=len(_FIXTURE_TERM),
+            sha256=hashlib.sha256(_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+        )
+    }
+)
+
+
+def test_should_report_the_line_of_a_spaced_spelling() -> None:
+    text = "first line\nBuilt for Acme Widgets, Inc. last year\nthird line\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (2,)
+
+
+def test_should_report_a_hyphenated_owner_in_a_link() -> None:
+    text = "See https://github.com/Acme-Widgets-Inc/tools/pull/12 for detail."
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (1,)
+
+
+def test_should_report_an_email_domain() -> None:
+    text = "Co-authored-by: Pat <pat@ACMEWIDGETS.EXAMPLE.COM>"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (1,)
+
+
+def test_should_report_a_term_split_across_a_line_break_at_its_first_line() -> None:
+    text = "one\nsold by Acme\nWidgets today\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (2,)
+
+
+def test_should_report_each_line_once() -> None:
+    text = "acme widget and acme-widget\nclean\nAcmeWidget\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (1, 3)
+
+
+def test_should_report_nothing_for_clean_text() -> None:
+    text = "An acme of widgets.\nWidget acme.\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == ()
+    assert not names_private_term(text, _ALL_FIXTURE_DIGESTS)
+
+
+def test_should_answer_whether_text_names_a_term() -> None:
+    assert names_private_term("Acme-Widgets-Inc", _ALL_FIXTURE_DIGESTS)

package/scripts/tests/test_repository_policy.py

@@ -20,6 +20,7 @@ from repository_checks.config.constants import (
     CHECK_ID_PACKAGE_INVENTORY,
     CHECK_ID_PYTEST_TESTPATHS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
     FOLLOWUP_LEDGER_MODULE_NAME,
     SUCCESS_EXIT_CODE,
 )
@@ -52,6 +53,7 @@ def test_should_keep_stable_check_identifiers() -> None:
         CHECK_ID_PACKAGE_INVENTORY,
         CHECK_ID_PYTEST_TESTPATHS,
         CHECK_ID_TRACKED_PERSONAL_DATA,
+        CHECK_ID_TRACKED_PRIVATE_TERMS,
     )
 
 

package/scripts/tests/test_runner.py

@@ -12,6 +12,7 @@ if str(_TESTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_TESTS_DIRECTORY))
 
 from repository_checks.config.constants import (
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
     FAILED_CHECK_EXIT_CODE,
     FINDINGS_EXIT_CODE,
 )
@@ -57,3 +58,22 @@ def test_should_emit_stable_sorted_findings(tmp_path: Path) -> None:
     assert first_exit_code == FINDINGS_EXIT_CODE
     assert first_stdout == second_stdout
     assert first_stdout.index("alpha/CLAUDE.md") < first_stdout.index("zeta/CLAUDE.md")
+
+
+def test_should_fail_closed_when_the_private_term_check_cannot_read_a_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = seed_clean_repository(tmp_path / "repo")
+
+    def fail_private_term_scan(
+        _repository_root: Path, _all_tracked_paths: object
+    ) -> list[object]:
+        raise OSError("tracked file unreadable")
+
+    monkeypatch.setattr(
+        "repository_checks.runner.collect_tracked_private_term_findings",
+        fail_private_term_scan,
+    )
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert f"error: rule failed: {CHECK_ID_TRACKED_PRIVATE_TERMS}" in stdout_text

package/scripts/tests/test_tracked_private_terms.py

@@ -0,0 +1,71 @@
+"""Behavior tests for the tracked private-term check."""
+
+from __future__ import annotations
+
+import hashlib
+import sys
+from pathlib import Path
+
+import pytest
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+from repository_checks import tracked_private_terms
+from repository_checks.config.constants import (
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
+    FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
+)
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    write_text,
+)
+
+_FIXTURE_TERM = "acmewidget"
+
+
+@pytest.fixture(autouse=True)
+def private_fixture_terms(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        tracked_private_terms,
+        "ALL_PRIVATE_TERM_DIGESTS",
+        frozenset(
+            {
+                PrivateTermDigest(
+                    length=len(_FIXTURE_TERM),
+                    sha256=hashlib.sha256(_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+                )
+            }
+        ),
+    )
+
+
+def test_should_flag_a_tracked_file_naming_a_private_organization(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "docs" / "notes.md", "intro\nBuilt by Acme Widgets.\n")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert f"{CHECK_ID_TRACKED_PRIVATE_TERMS}: docs/notes.md:" in stdout_text
+    assert "Line 2" in stdout_text
+    assert "Acme" not in stdout_text
+
+
+def test_should_pass_a_tree_that_names_no_private_organization(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "docs" / "notes.md", "An acme of widget design.\n")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert stdout_text == ""

package/scripts/tests/test_tracked_secrets.py

@@ -46,7 +46,7 @@ _PII_PREVENTION_CONSTANTS = load_hooks_module(
 _PII_CATEGORY_EMAIL = _PII_PREVENTION_CONSTANTS.CATEGORY_EMAIL
 _PII_CATEGORY_HOME_PATH = _PII_PREVENTION_CONSTANTS.CATEGORY_HOME_PATH
 _PII_CATEGORY_PRIVATE_IP = _PII_PREVENTION_CONSTANTS.CATEGORY_PRIVATE_IP
-_OWNED_ADDRESS = "10.83.21.14"
+_OWNED_ADDRESS = "10.0.0.14"
 _OWNED_ADDRESS_RELATIVE_PATH = "src/runner.py"