qa-engineer 0.9.0 → 0.9.2

package/shared/analysis/lib/qa_analysis/junit.py

@@ -24,6 +24,30 @@ def _int(value, default=0):
         return default
 
 
+def _duration_ms(raw, path):
+    """`time` in seconds as whole milliseconds.
+
+    An absent or empty attribute is zero — plenty of runners omit it. A value
+    that is present but not a finite number means the document is not what it
+    claims to be, so it raises: found by the Node port's parity corpus, where
+    `time="not-a-number"` escaped as a bare ValueError and `time="nan"` as
+    "cannot convert float NaN to integer". Both reached the caller as a traceback
+    and exit 1, while the CLI's documented failure mode is exit 2 with
+    {error, detail}.
+    """
+    if raw is None or raw == "":
+        return 0
+    try:
+        seconds = float(raw)
+    except (TypeError, ValueError):
+        raise MalformedArtifact(
+            f"testcase time={raw!r} is not a number at {path}"
+        ) from None
+    if seconds != seconds or seconds in (float("inf"), float("-inf")):
+        raise MalformedArtifact(f"testcase time={raw!r} is not a finite number at {path}")
+    return int(round(seconds * 1000))
+
+
 def parse_junit(path):
     """Parse a JUnit XML file into a normalized result.
 
@@ -65,7 +89,7 @@ def parse_junit(path):
                 "title": case.get("name", ""),
                 "file": case.get("classname", ""),
                 "status": status,
-                "durationMs": int(round(float(case.get("time", "0") or "0") * 1000)),
+                "durationMs": _duration_ms(case.get("time"), path),
             }
             if message:
                 entry["message"] = message

package/shared/analysis/lib/qa_analysis/redaction.py

@@ -18,8 +18,16 @@ _RULES = [
     ("openai-key", re.compile(r"sk-[A-Za-z0-9]{20,}")),
     ("bearer", re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]+=*")),
     # Sensitive header lines: keep the header name, mask the value.
-    ("auth-header", re.compile(r"(?im)^(\s*(?:authorization|proxy-authorization)\s*[:=]\s*).+$")),
-    ("cookie-header", re.compile(r"(?im)^(\s*(?:set-cookie|cookie)\s*[:=]\s*).+$")),
+    #
+    # The value is `[^\r\n]+` rather than `.+$`, and the indent is `[ \t]*` rather
+    # than `\s*`, for one reason: on CRLF text, `.+` swallows the carriage return
+    # and `$` matches before the newline, so redacting a header silently rewrote
+    # the line ending to LF and corrupted the rest of the document's endings.
+    # Horizontal whitespace is also what a header indent actually is. Found by the
+    # Node port's parity corpus, where the two languages disagreed here and
+    # JavaScript was right.
+    ("auth-header", re.compile(r"(?im)^([ \t]*(?:authorization|proxy-authorization)[ \t]*[:=][ \t]*)[^\r\n]+")),
+    ("cookie-header", re.compile(r"(?im)^([ \t]*(?:set-cookie|cookie)[ \t]*[:=][ \t]*)[^\r\n]+")),
     # Secret-like assignments: key=value / "key": "value".
     ("assigned-secret", re.compile(
         r'(?i)(\b(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b\s*[:=]\s*["\']?)'