gowalk-cicd 1.0.0

package/action/scripts/test_auto_detect.py

@@ -0,0 +1,432 @@
+#!/usr/bin/env python3
+"""
+Tests for auto_detect.py — Xcode project / scheme / bundle_id auto-detection.
+
+All tests run offline. xcodebuild invocations are stubbed through
+``unittest.mock`` so they never shell out.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+# Make sibling scripts importable regardless of the pytest invocation cwd.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import auto_detect  # noqa: E402
+
+
+APP_TYPE = "com.apple.product-type.application"
+EXT_TYPE = "com.apple.product-type.app-extension"
+TUN_TYPE = "com.apple.product-type.tunnel-provider"
+
+
+class AutoDetectProjectTests(unittest.TestCase):
+    """auto_detect_project: find *.xcworkspace or *.xcodeproj at repo root."""
+
+    def test_prefers_xcworkspace_over_xcodeproj(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "MyApp.xcworkspace").mkdir()
+            (root / "MyApp.xcodeproj").mkdir()
+            project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "")
+        self.assertEqual(workspace, "MyApp.xcworkspace")
+
+    def test_returns_single_xcodeproj_when_no_workspace(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "MyApp.xcodeproj").mkdir()
+            project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "MyApp.xcodeproj")
+        self.assertEqual(workspace, "")
+
+    def test_prefers_xcodeproj_matching_repo_basename_when_multiple(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            # Create a named subdirectory so basename is predictable.
+            root = Path(tmp) / "myapp"
+            root.mkdir()
+            (root / "Other.xcodeproj").mkdir()
+            (root / "myapp.xcodeproj").mkdir()
+            project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "myapp.xcodeproj")
+        self.assertEqual(workspace, "")
+
+    def test_falls_back_alphabetical_when_no_basename_match(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp) / "ambiguous-repo"
+            root.mkdir()
+            (root / "Zebra.xcodeproj").mkdir()
+            (root / "Alpha.xcodeproj").mkdir()
+            project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "Alpha.xcodeproj")
+        self.assertEqual(workspace, "")
+
+    def test_returns_empty_when_no_project_found(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "")
+        self.assertEqual(workspace, "")
+
+    def test_runs_xcodegen_when_only_project_yml_present(self):
+        """project.yml without .xcodeproj should trigger xcodegen + retry."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "project.yml").write_text("name: MyApp\n")
+
+            def fake_xcodegen(cmd, **kw):
+                # Simulate xcodegen materializing the .xcodeproj.
+                self.assertEqual(cmd[:2], ["xcodegen", "generate"])
+                (root / "MyApp.xcodeproj").mkdir()
+                result = mock.MagicMock()
+                result.returncode = 0
+                result.stdout = ""
+                result.stderr = ""
+                return result
+
+            with mock.patch("auto_detect.subprocess.run", side_effect=fake_xcodegen) as mrun:
+                project, workspace = auto_detect.auto_detect_project(root)
+            mrun.assert_called_once()
+        self.assertEqual(project, "MyApp.xcodeproj")
+        self.assertEqual(workspace, "")
+
+    def test_skips_xcodegen_when_xcodeproj_already_present(self):
+        """xcodegen should NOT run if an .xcodeproj is already there."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "project.yml").write_text("name: MyApp\n")
+            (root / "MyApp.xcodeproj").mkdir()
+
+            with mock.patch("auto_detect.subprocess.run") as mrun:
+                project, workspace = auto_detect.auto_detect_project(root)
+            mrun.assert_not_called()
+        self.assertEqual(project, "MyApp.xcodeproj")
+
+    def test_xcodegen_failure_returns_empty(self):
+        """xcodegen returning non-zero leaves project/workspace empty."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "project.yml").write_text("name: Broken\n")
+
+            def fake_xcodegen(cmd, **kw):
+                result = mock.MagicMock()
+                result.returncode = 1
+                result.stdout = ""
+                result.stderr = "boom"
+                return result
+
+            with mock.patch("auto_detect.subprocess.run", side_effect=fake_xcodegen):
+                project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "")
+        self.assertEqual(workspace, "")
+
+    def test_xcodegen_missing_binary_returns_empty(self):
+        """FileNotFoundError (xcodegen not installed) is handled gracefully.
+
+        When the Homebrew install fallback also fails (brew missing or
+        install rc!=0), the function returns empty without raising.
+        """
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "project.yml").write_text("name: NoTool\n")
+
+            # Raise FileNotFoundError on xcodegen, then brew install also
+            # FileNotFoundErrors — simulates neither tool available.
+            with mock.patch(
+                "auto_detect.subprocess.run",
+                side_effect=FileNotFoundError("binary"),
+            ):
+                project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "")
+        self.assertEqual(workspace, "")
+
+    def test_xcodegen_installed_via_brew_on_missing_binary(self):
+        """When xcodegen is missing, brew install runs and we retry."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "project.yml").write_text("name: Installable\n")
+
+            call_log: list[str] = []
+
+            def fake_run(cmd, **kw):
+                call_log.append(cmd[0])
+                result = mock.MagicMock()
+                result.returncode = 0
+                result.stdout = ""
+                result.stderr = ""
+                if cmd[0] == "xcodegen" and call_log.count("xcodegen") == 1:
+                    # First xcodegen call fails as FileNotFoundError
+                    raise FileNotFoundError("xcodegen")
+                if cmd[0] == "xcodegen":
+                    # Second call succeeds after brew install
+                    (root / "Installable.xcodeproj").mkdir()
+                    return result
+                if cmd[0] == "brew":
+                    # brew install succeeds
+                    return result
+                return result
+
+            with mock.patch("auto_detect.subprocess.run", side_effect=fake_run):
+                project, workspace = auto_detect.auto_detect_project(root)
+        self.assertEqual(project, "Installable.xcodeproj")
+        self.assertEqual(call_log, ["xcodegen", "brew", "xcodegen"])
+
+    def test_detects_alt_xcodegen_spec_names(self):
+        """xcodegen also accepts Project.yml / project.yaml / Project.yaml."""
+        for spec_name in ("Project.yml", "project.yaml", "Project.yaml"):
+            with self.subTest(spec=spec_name):
+                with tempfile.TemporaryDirectory() as tmp:
+                    root = Path(tmp)
+                    (root / spec_name).write_text("name: Alt\n")
+
+                    def fake_xcodegen(cmd, **kw):
+                        (root / "Alt.xcodeproj").mkdir()
+                        result = mock.MagicMock()
+                        result.returncode = 0
+                        result.stdout = ""
+                        result.stderr = ""
+                        return result
+
+                    with mock.patch(
+                        "auto_detect.subprocess.run",
+                        side_effect=fake_xcodegen,
+                    ):
+                        project, workspace = auto_detect.auto_detect_project(root)
+                self.assertEqual(project, "Alt.xcodeproj")
+                self.assertEqual(workspace, "")
+
+
+class AutoDetectSchemeTests(unittest.TestCase):
+    """auto_detect_scheme: pick the single application-type scheme."""
+
+    def setUp(self):
+        auto_detect._clear_caches()
+
+    def _list_output(self, schemes: list[str], project_name: str = "MyApp") -> str:
+        return json.dumps({"project": {"name": project_name, "schemes": schemes}})
+
+    def _show_settings(self, product_type: str, bundle_id: str = "com.x.y") -> str:
+        return json.dumps(
+            [
+                {
+                    "action": "build",
+                    "buildSettings": {
+                        "PRODUCT_TYPE": product_type,
+                        "PRODUCT_BUNDLE_IDENTIFIER": bundle_id,
+                    },
+                }
+            ]
+        )
+
+    def test_returns_single_application_scheme(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            if "-list" in cmd:
+                result.stdout = self._list_output(["MyApp"])
+            else:
+                result.stdout = self._show_settings(APP_TYPE)
+            return result
+
+        root = Path("/tmp/x")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "MyApp.xcodeproj", "")
+        self.assertEqual(scheme, "MyApp")
+
+    def test_filters_out_extension_and_tunnel_schemes(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            if "-list" in cmd:
+                result.stdout = self._list_output(["Tunnel", "VPNProj2"])
+            else:
+                # Find the scheme name in the command
+                idx = cmd.index("-scheme") + 1
+                scheme_name = cmd[idx]
+                if scheme_name == "Tunnel":
+                    result.stdout = self._show_settings(TUN_TYPE)
+                else:
+                    result.stdout = self._show_settings(APP_TYPE)
+            return result
+
+        root = Path("/tmp/mirage")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "VPNProj2.xcodeproj", "")
+        self.assertEqual(scheme, "VPNProj2")
+
+    def test_prefers_basename_match_when_multiple_app_schemes(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            if "-list" in cmd:
+                result.stdout = self._list_output(["AppA", "myapp"])
+            else:
+                result.stdout = self._show_settings(APP_TYPE)
+            return result
+
+        root = Path("/tmp/myapp")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+        self.assertEqual(scheme, "myapp")
+
+    def test_falls_back_alphabetical_when_ambiguous(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            if "-list" in cmd:
+                result.stdout = self._list_output(["Zebra", "Alpha"])
+            else:
+                result.stdout = self._show_settings(APP_TYPE)
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+        self.assertEqual(scheme, "Alpha")
+
+    def test_returns_none_when_no_application_scheme(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            if "-list" in cmd:
+                result.stdout = self._list_output(["Tunnel"])
+            else:
+                result.stdout = self._show_settings(TUN_TYPE)
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+        self.assertIsNone(scheme)
+
+    def test_returns_none_when_xcodebuild_list_fails(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 1
+            result.stdout = ""
+            result.stderr = "xcodebuild error"
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+        self.assertIsNone(scheme)
+
+
+class AutoDetectBundleIdTests(unittest.TestCase):
+    """auto_detect_bundle_id: extract PRODUCT_BUNDLE_IDENTIFIER from showBuildSettings."""
+
+    def setUp(self):
+        auto_detect._clear_caches()
+
+    def _show_settings(self, bundle_id: str) -> str:
+        return json.dumps(
+            [
+                {
+                    "action": "build",
+                    "buildSettings": {
+                        "PRODUCT_TYPE": APP_TYPE,
+                        "PRODUCT_BUNDLE_IDENTIFIER": bundle_id,
+                    },
+                }
+            ]
+        )
+
+    def test_returns_bundle_id_from_showBuildSettings(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            result.stdout = self._show_settings("com.example.myapp")
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            bundle = auto_detect.auto_detect_bundle_id(
+                root, "Proj.xcodeproj", "", "MyApp", "Release"
+            )
+        self.assertEqual(bundle, "com.example.myapp")
+
+    def test_returns_none_when_bundle_id_empty(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            result.stdout = self._show_settings("")
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            bundle = auto_detect.auto_detect_bundle_id(
+                root, "Proj.xcodeproj", "", "MyApp", "Release"
+            )
+        self.assertIsNone(bundle)
+
+    def test_rejects_unresolved_variable_reference(self):
+        # $(…) or $… patterns mean xcodebuild couldn't evaluate — reject.
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            result.stdout = self._show_settings("$(PRODUCT_NAME)")
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            bundle = auto_detect.auto_detect_bundle_id(
+                root, "Proj.xcodeproj", "", "MyApp", "Release"
+            )
+        self.assertIsNone(bundle)
+
+    def test_returns_none_when_xcodebuild_fails(self):
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 65
+            result.stdout = ""
+            result.stderr = "xcodebuild error: scheme not found"
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            bundle = auto_detect.auto_detect_bundle_id(
+                root, "Proj.xcodeproj", "", "MyApp", "Release"
+            )
+        self.assertIsNone(bundle)
+
+
+class CachingTests(unittest.TestCase):
+    """xcodebuild -list output and showBuildSettings output must be cached."""
+
+    def setUp(self):
+        auto_detect._clear_caches()
+
+    def test_list_schemes_cached_across_calls(self):
+        calls = {"count": 0}
+
+        def fake_run(cmd, **kw):
+            result = mock.MagicMock()
+            result.returncode = 0
+            if "-list" in cmd:
+                calls["count"] += 1
+                result.stdout = json.dumps(
+                    {"project": {"name": "MyApp", "schemes": ["MyApp"]}}
+                )
+            else:
+                result.stdout = json.dumps(
+                    [{"buildSettings": {"PRODUCT_TYPE": APP_TYPE,
+                                          "PRODUCT_BUNDLE_IDENTIFIER": "com.x"}}]
+                )
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+            auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+        self.assertEqual(calls["count"], 1, "xcodebuild -list should be cached")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_cfg_resolve_credentials.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from cfg_resolve import find_p8, parse_p8_filename
+
+
+class CredentialFilenameTest(unittest.TestCase):
+    def test_parses_canonical_name(self):
+        parsed = parse_p8_filename(
+            "AuthKey_SG24AB2JHM_Issuer_f24f1629-3461-4a57-8807-8f7c9964d652.p8"
+        )
+        self.assertEqual(
+            parsed,
+            ("SG24AB2JHM", "f24f1629-3461-4a57-8807-8f7c9964d652"),
+        )
+
+    def test_parses_metadata_rich_existing_name(self):
+        parsed = parse_p8_filename(
+            "AE2(key_id_SG24AB2JHM_issuer_"
+            "f24f1629-3461-4a57-8807-8f7c9964d652_vendor_id_92561414).p8"
+        )
+        self.assertEqual(
+            parsed,
+            ("SG24AB2JHM", "f24f1629-3461-4a57-8807-8f7c9964d652"),
+        )
+
+    def test_find_p8_accepts_metadata_rich_name(self):
+        with tempfile.TemporaryDirectory() as directory:
+            workspace = Path(directory)
+            creds = workspace / "creds"
+            creds.mkdir()
+            key = creds / (
+                "AE2(key_id_SG24AB2JHM_issuer_"
+                "f24f1629-3461-4a57-8807-8f7c9964d652_vendor_id_92561414).p8"
+            )
+            key.write_text("private-key-placeholder")
+
+            self.assertEqual(
+                find_p8(workspace),
+                (key, "SG24AB2JHM", "f24f1629-3461-4a57-8807-8f7c9964d652"),
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_compute_next_version.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""
+Tests for ``version_utils.compute_next_version`` -- 'rollover' policy.
+
+This file holds the rollover-policy scenarios. Strictness invariants and
+legacy-'patch' backcompat regressions live in sibling files (round 2
+codex review split):
+
+  - ``test_compute_next_version_strictness`` -- ``result > floor`` AND
+    ``result > current`` invariant guard across all policies.
+  - ``test_compute_next_version_patch_backcompat`` -- guards that the
+    legacy unbounded 'patch' policy is unchanged for consumers pinning
+    the historical default.
+
+Splitting keeps each file under the project's 10-functions-per-file cap.
+
+Rollover semantics: patch+1 with carry. At the resulting patch>9 it
+rolls into the next minor (1.0.9 -> 1.1.0); at the resulting minor>9 it
+cascades into the next major (1.9.9 -> 2.0.0). Major has no upper limit
+(9.9.9 -> 10.0.0). The carry uses ``>9`` (not ``==10``) so projects with
+inputs already past the boundary -- e.g. a 1.0.10 left from the legacy
+'patch' policy -- still cascade cleanly. Cross-train semantics inherited
+from 'patch' are preserved: floor on a higher major.minor train wins
+outright, and rollover bumps from there.
+"""
+
+from __future__ import annotations
+
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import version_utils  # noqa: E402
+
+
+class ComputeNextVersionRolloverTests(unittest.TestCase):
+    """Rollover policy: patch bumps with carry into minor / major."""
+
+    def test_compute_next_version_rollover_simple_patch_bump(self):
+        # Below the .9 boundary -> simple patch increment.
+        result = version_utils.compute_next_version("1.0.5", "1.0.5", "rollover")
+        self.assertEqual(result, "1.0.6")
+
+    def test_compute_next_version_rollover_patch_overflow(self):
+        # Patch at .9 must roll: 1.0.9 -> 1.1.0.
+        result = version_utils.compute_next_version("1.0.9", "1.0.9", "rollover")
+        self.assertEqual(result, "1.1.0")
+
+    def test_compute_next_version_rollover_minor_overflow(self):
+        # Both patch and minor at .9 must cascade: 1.9.9 -> 2.0.0.
+        result = version_utils.compute_next_version("1.9.9", "1.9.9", "rollover")
+        self.assertEqual(result, "2.0.0")
+
+    def test_compute_next_version_rollover_floor_higher_patch(self):
+        # Floor sits above current on the same train; rollover from floor.
+        # 1.0.5 vs floor 1.0.9 -> bump from .9 -> 1.1.0.
+        result = version_utils.compute_next_version("1.0.5", "1.0.9", "rollover")
+        self.assertEqual(result, "1.1.0")
+
+    def test_compute_next_version_rollover_cross_train(self):
+        # Floor on a higher major.minor train wins outright; rollover then
+        # bumps from floor's patch. 1.0.5 vs floor 2.0.5 -> 2.0.6.
+        result = version_utils.compute_next_version("1.0.5", "2.0.5", "rollover")
+        self.assertEqual(result, "2.0.6")
+
+    def test_compute_next_version_rollover_major_overflow_no_cap(self):
+        # Major has no rollover ceiling; 9.9.9 -> 10.0.0 (just keeps growing).
+        result = version_utils.compute_next_version("9.9.9", "9.9.9", "rollover")
+        self.assertEqual(result, "10.0.0")
+
+    def test_compute_next_version_rollover_two_component_equal(self):
+        # 2-component MARKETING_VERSION ("1.0") parses .patch=0 -> .1.
+        result = version_utils.compute_next_version("1.0", "1.0", "rollover")
+        self.assertEqual(result, "1.0.1")
+
+    def test_compute_next_version_rollover_over_nine_patch_input(self):
+        # Round-2 codex: a project previously on 'patch' may sit at
+        # 1.0.10 before switching to 'rollover'. The carry must use
+        # ``new_patch > 9`` (not ``== 10``) so 11 still cascades.
+        # 1.0.10 -> +1 -> patch=11 -> >9 -> patch=0, minor+=1 -> 1.1.0.
+        result = version_utils.compute_next_version("1.0.10", "1.0.10", "rollover")
+        self.assertEqual(result, "1.1.0")
+
+    def test_compute_next_version_rollover_over_nine_with_floor_higher(self):
+        # Round-2 codex: floor pulls patch_base above 9 too. trains
+        # match -> patch_base=max(15,20)=20 -> +1=21 -> >9 cascade.
+        # 1.0.15 vs floor 1.0.20 -> 1.1.0.
+        result = version_utils.compute_next_version("1.0.15", "1.0.20", "rollover")
+        self.assertEqual(result, "1.1.0")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_compute_next_version_patch_backcompat.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+"""
+Backcompat regression tests for the legacy 'patch' policy.
+
+Split from ``test_compute_next_version`` (round 2 codex review) so the
+rollover-policy file stays under the project's 10-functions-per-file
+cap. Guards that the historical unbounded 'patch' bump (1.0.9 -> 1.0.10)
+is preserved verbatim -- existing 0.0.27 consumers that pin
+``marketing-version-auto-bump: 'patch'`` MUST keep their current
+behavior even after rollover ships as the new default. Any future
+refactor that silently grafts rollover semantics onto the 'patch'
+branch should fail HERE first.
+"""
+
+from __future__ import annotations
+
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import version_utils  # noqa: E402
+
+
+class ComputeNextVersionPatchBackcompatTests(unittest.TestCase):
+    """Confirm the historical 'patch' policy is unchanged."""
+
+    def test_compute_next_version_patch_no_rollover_at_nine(self):
+        # 'patch' must NOT roll over: 1.0.9 -> 1.0.10 (legacy behavior).
+        result = version_utils.compute_next_version("1.0.9", "1.0.9", "patch")
+        self.assertEqual(result, "1.0.10")
+
+    def test_compute_next_version_patch_no_rollover_at_minor_nine(self):
+        # 'patch' stays on its train even when minor=9: 1.9.9 -> 1.9.10.
+        result = version_utils.compute_next_version("1.9.9", "1.9.9", "patch")
+        self.assertEqual(result, "1.9.10")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_compute_next_version_strictness.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""
+Strictness invariant tests for ``version_utils.compute_next_version``.
+
+Split from ``test_compute_next_version`` (round 2 codex review) so the
+rollover-policy file stays under the project's 10-functions-per-file
+cap. ``compute_next_version`` MUST return a value STRICTLY greater
+than BOTH ``current`` and ``floor`` -- never equal. Equality would
+re-collide with the row that triggered auto-bump (e.g. the
+READY_FOR_SALE row that started the auto-roll), defeating the whole
+purpose of the bump. This file iterates the invariant across a small
+grid for every supported policy ('patch', 'minor', 'rollover').
+"""
+
+from __future__ import annotations
+
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import version_utils  # noqa: E402
+
+
+class ComputeNextVersionStrictnessTests(unittest.TestCase):
+    """Round-6 regression guard: result is STRICTLY > both inputs."""
+
+    def test_compute_next_version_equal_to_floor_patch(self):
+        result = version_utils.compute_next_version("1.0.5", "1.0.5", "patch")
+        self.assertEqual(result, "1.0.6")
+
+    def test_compute_next_version_equal_to_floor_minor(self):
+        result = version_utils.compute_next_version("1.0.5", "1.0.5", "minor")
+        self.assertEqual(result, "1.1.0")
+
+    def test_compute_next_version_two_component_equal(self):
+        # 2-component MARKETING_VERSION ("1.0") must auto-roll cleanly.
+        result = version_utils.compute_next_version("1.0", "1.0", "patch")
+        self.assertEqual(result, "1.0.1")
+
+    def test_compute_next_version_strictly_greater_invariant(self):
+        """Property check across a small grid: result > both inputs."""
+        cases = [
+            ("1.0.5", "1.0.5"), ("1.0.0", "1.0.5"),
+            ("1.0.5", "1.0.0"), ("0.0", "0.0"),
+            ("99.99.99", "99.99.99"), ("2.0.0", "1.0.5"),
+            ("1.0.5", "2.0.0"),
+        ]
+        for current, floor in cases:
+            for policy in ("patch", "minor", "rollover"):
+                result = version_utils.compute_next_version(
+                    current, floor, policy,
+                )
+                rt = version_utils._parse(result)
+                self.assertGreater(
+                    rt, version_utils._parse(current),
+                    msg=f"{policy}: {result} not > current={current}",
+                )
+                self.assertGreater(
+                    rt, version_utils._parse(floor),
+                    msg=f"{policy}: {result} not > floor={floor}",
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()