qa-engineer 0.9.2 → 0.11.0

package/shared/analysis/lib/qa_analysis/junit.py

@@ -1,104 +0,0 @@
-"""JUnit XML parser.
-
-Framework-agnostic: Playwright, Selenium, Cypress, WebdriverIO, and most unit
-runners emit JUnit XML, so this one parser normalizes them all into the pack's
-per-test result shape. This is the concrete proof that different frameworks
-share one contract — only where the file lives differs, not how it is read.
-
-Parses deterministically; a malformed document raises rather than guessing.
-"""
-
-import xml.etree.ElementTree as ET
-
-from .redaction import redact_text
-
-
-class MalformedArtifact(ValueError):
-    """Raised when an artifact cannot be parsed. Never swallowed into a guess."""
-
-
-def _int(value, default=0):
-    try:
-        return int(value)
-    except (TypeError, ValueError):
-        return default
-
-
-def _duration_ms(raw, path):
-    """`time` in seconds as whole milliseconds.
-
-    An absent or empty attribute is zero — plenty of runners omit it. A value
-    that is present but not a finite number means the document is not what it
-    claims to be, so it raises: found by the Node port's parity corpus, where
-    `time="not-a-number"` escaped as a bare ValueError and `time="nan"` as
-    "cannot convert float NaN to integer". Both reached the caller as a traceback
-    and exit 1, while the CLI's documented failure mode is exit 2 with
-    {error, detail}.
-    """
-    if raw is None or raw == "":
-        return 0
-    try:
-        seconds = float(raw)
-    except (TypeError, ValueError):
-        raise MalformedArtifact(
-            f"testcase time={raw!r} is not a number at {path}"
-        ) from None
-    if seconds != seconds or seconds in (float("inf"), float("-inf")):
-        raise MalformedArtifact(f"testcase time={raw!r} is not a finite number at {path}")
-    return int(round(seconds * 1000))
-
-
-def parse_junit(path):
-    """Parse a JUnit XML file into a normalized result.
-
-    Returns a dict: {tests: {total, passed, failed, skipped}, executed: [...]}.
-    Each executed entry: {title, file, status, durationMs, message?}.
-    Raises MalformedArtifact if the XML is unreadable or not JUnit-shaped.
-    """
-    try:
-        tree = ET.parse(path)
-    except (ET.ParseError, OSError) as exc:
-        raise MalformedArtifact(f"could not parse JUnit XML at {path}: {exc}") from exc
-
-    root = tree.getroot()
-    # Accept either a <testsuites> root or a single <testsuite> root.
-    if root.tag == "testsuites":
-        suites = root.findall("testsuite")
-    elif root.tag == "testsuite":
-        suites = [root]
-    else:
-        raise MalformedArtifact(f"not a JUnit document (root <{root.tag}>) at {path}")
-
-    executed = []
-    for suite in suites:
-        for case in suite.findall("testcase"):
-            failure = case.find("failure")
-            error = case.find("error")
-            skipped = case.find("skipped")
-            if failure is not None or error is not None:
-                status = "failed"
-                node = failure if failure is not None else error
-                message = redact_text((node.get("message") or node.text or "").strip())
-            elif skipped is not None:
-                status = "skipped"
-                message = redact_text((skipped.get("message") or "").strip())
-            else:
-                status = "passed"
-                message = ""
-            entry = {
-                "title": case.get("name", ""),
-                "file": case.get("classname", ""),
-                "status": status,
-                "durationMs": _duration_ms(case.get("time"), path),
-            }
-            if message:
-                entry["message"] = message
-            executed.append(entry)
-
-    counts = {
-        "total": len(executed),
-        "passed": sum(1 for e in executed if e["status"] == "passed"),
-        "failed": sum(1 for e in executed if e["status"] == "failed"),
-        "skipped": sum(1 for e in executed if e["status"] == "skipped"),
-    }
-    return {"tests": counts, "executed": executed}

package/shared/analysis/lib/qa_analysis/redaction.py

@@ -1,107 +0,0 @@
-"""Credential, secret, token, and PII redaction.
-
-Every analyzer runs artifact text through redaction before it appears in a
-finding, a report, or stdout. Redaction happens as evidence is captured, not
-after — a secret must never reach a model's context or a log. Standard library
-only; deterministic.
-"""
-
-import re
-
-# Ordered (name, pattern, replacement). Order matters: match structured,
-# high-signal secrets (JWTs, provider keys) before generic fallbacks.
-_RULES = [
-    ("jwt", re.compile(r"eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}")),
-    ("aws-access-key", re.compile(r"AKIA[0-9A-Z]{16}")),
-    ("github-token", re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}")),
-    ("slack-token", re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}")),
-    ("openai-key", re.compile(r"sk-[A-Za-z0-9]{20,}")),
-    ("bearer", re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]+=*")),
-    # Sensitive header lines: keep the header name, mask the value.
-    #
-    # The value is `[^\r\n]+` rather than `.+$`, and the indent is `[ \t]*` rather
-    # than `\s*`, for one reason: on CRLF text, `.+` swallows the carriage return
-    # and `$` matches before the newline, so redacting a header silently rewrote
-    # the line ending to LF and corrupted the rest of the document's endings.
-    # Horizontal whitespace is also what a header indent actually is. Found by the
-    # Node port's parity corpus, where the two languages disagreed here and
-    # JavaScript was right.
-    ("auth-header", re.compile(r"(?im)^([ \t]*(?:authorization|proxy-authorization)[ \t]*[:=][ \t]*)[^\r\n]+")),
-    ("cookie-header", re.compile(r"(?im)^([ \t]*(?:set-cookie|cookie)[ \t]*[:=][ \t]*)[^\r\n]+")),
-    # Secret-like assignments: key=value / "key": "value".
-    ("assigned-secret", re.compile(
-        r'(?i)(\b(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b\s*[:=]\s*["\']?)'
-        r'([^\s"\'&]{4,})')),
-    # Credentials in URLs and query strings.
-    ("url-credential", re.compile(r"(?i)(://[^:/@\s]+:)([^@/\s]+)(@)")),
-    ("query-secret", re.compile(
-        r"(?i)([?&](?:password|passwd|pwd|token|secret|api[_-]?key|access[_-]?key)=)([^&\s#]+)")),
-    # PII: email addresses.
-    ("email", re.compile(r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b")),
-]
-
-# Rules whose replacement preserves a leading captured group (the label/prefix).
-_PREFIX_PRESERVING = {
-    "auth-header": r"\1[REDACTED:auth-header]",
-    "cookie-header": r"\1[REDACTED:cookie-header]",
-    "assigned-secret": r"\1[REDACTED:secret]",
-    "url-credential": r"\1[REDACTED:credential]\3",
-    "query-secret": r"\1[REDACTED:secret]",
-}
-
-
-def redact_text(text):
-    """Return text with every recognized secret or PII value masked."""
-    if not text:
-        return text
-    result = text
-    for name, pattern in _RULES:
-        if name in _PREFIX_PRESERVING:
-            result = pattern.sub(_PREFIX_PRESERVING[name], result)
-        else:
-            result = pattern.sub(f"[REDACTED:{name}]", result)
-    return result
-
-
-def detect_secrets(text):
-    """Return a list of {type, start, end} for secrets found — never the values.
-
-    Used to decide whether an artifact is safe to expose, without surfacing the
-    secret itself.
-    """
-    findings = []
-    if not text:
-        return findings
-    for name, pattern in _RULES:
-        for match in pattern.finditer(text):
-            findings.append({"type": name, "start": match.start(), "end": match.end()})
-    findings.sort(key=lambda f: f["start"])
-    return findings
-
-
-_SENSITIVE_HEADERS = {
-    "authorization", "proxy-authorization", "cookie", "set-cookie",
-    "x-api-key", "x-auth-token", "api-key", "x-csrf-token",
-}
-
-
-def redact_headers(headers):
-    """Mask the values of sensitive HTTP headers.
-
-    Accepts a dict, or a list of {"name","value"} entries (HAR shape), and
-    returns the same shape with sensitive values replaced.
-    """
-    def mask(name, value):
-        return "[REDACTED:header]" if name.strip().lower() in _SENSITIVE_HEADERS else redact_text(value)
-
-    if isinstance(headers, dict):
-        return {k: mask(k, str(v)) for k, v in headers.items()}
-    if isinstance(headers, list):
-        out = []
-        for entry in headers:
-            if isinstance(entry, dict) and "name" in entry:
-                out.append({**entry, "value": mask(str(entry["name"]), str(entry.get("value", "")))})
-            else:
-                out.append(entry)
-        return out
-    return headers