codna 0.1.32__tar.gz → 0.1.34__tar.gz

{codna-0.1.32 → codna-0.1.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.32
+Version: 0.1.34
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.32 → codna-0.1.34}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.32"
+__version__ = "0.1.34"

{codna-0.1.32 → codna-0.1.34}/codna/cli.py

@@ -464,7 +464,10 @@ def cmd_secure(args) -> None:
     manifest = None
     if args.verification:
         from .manifest import load_manifest, ManifestError
-        manifest = load_manifest(args.verification)
+        try:
+            manifest = load_manifest(args.verification)
+        except ManifestError as exc:
+            _die(f"invalid verification manifest {args.verification}: {exc}")
         policy, config_digest = manifest.policy, manifest.scanner.configuration_digest
         if args.open_pr:
             try:

{codna-0.1.32 → codna-0.1.34}/codna/manifest.py

@@ -29,6 +29,44 @@ class ManifestError(Exception):
     pass
 
 
+def _require_string(value: object, field: str) -> str:
+    if isinstance(value, str) and value:
+        return value
+    raise ManifestError(f"{field} must be a non-empty string")
+
+
+def _command_list(value: object, field: str) -> list[str]:
+    if not isinstance(value, list) or not value:
+        raise ManifestError(f"{field} must be a non-empty command array")
+    command: list[str] = []
+    for index, part in enumerate(value):
+        if not isinstance(part, str) or not part:
+            raise ManifestError(f"{field}[{index}] must be a non-empty string")
+        command.append(part)
+    return command
+
+
+def _command_matrix(value: object, field: str) -> list[list[str]]:
+    if value is None:
+        return []
+    if not isinstance(value, list):
+        raise ManifestError(f"{field} must be a list of command arrays")
+    return [_command_list(command, f"{field}[{index}]") for index, command in enumerate(value)]
+
+
+def _exit_codes(value: object, field: str) -> tuple[int, ...]:
+    if value is None:
+        return (0,)
+    if not isinstance(value, list) or not value:
+        raise ManifestError(f"{field} must be a non-empty list of integer exit codes")
+    codes: list[int] = []
+    for index, code in enumerate(value):
+        if not isinstance(code, int) or isinstance(code, bool):
+            raise ManifestError(f"{field}[{index}] must be an integer exit code")
+        codes.append(code)
+    return tuple(codes)
+
+
 @dataclass
 class ScannerSpec:
     id: str
@@ -105,11 +143,11 @@ class VerificationManifest:
         if not sc.get("id") or not sc.get("command") or not sc.get("output"):
             raise ManifestError("scanner.{id,command,output} are required")
         scanner = ScannerSpec(
-            id=sc["id"],
+            id=_require_string(sc["id"], "scanner.id"),
             image=sc.get("image", ""),
-            command=list(sc["command"]),
-            output=sc["output"],
-            accepted_exit_codes=tuple(sc.get("accepted_exit_codes", [0])),
+            command=_command_list(sc["command"], "scanner.command"),
+            output=_require_string(sc["output"], "scanner.output"),
+            accepted_exit_codes=_exit_codes(sc.get("accepted_exit_codes", [0]), "scanner.accepted_exit_codes"),
             rules_digest=sc.get("rules_digest"),
             configuration_digest=sc.get("configuration_digest"),
         )
@@ -123,8 +161,8 @@ class VerificationManifest:
         )
         return cls(
             scanner=scanner,
-            build=[list(c) for c in (ver.get("build") or [])],
-            tests=[list(c) for c in (ver.get("tests") or [])],
+            build=_command_matrix(ver.get("build"), "verification.build"),
+            tests=_command_matrix(ver.get("tests"), "verification.tests"),
             sandbox=sandbox,
             policy=Policy.from_dict(d.get("policy")),
         )

{codna-0.1.32 → codna-0.1.34}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.32
+Version: 0.1.34
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.32 → codna-0.1.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.32"
+version = "0.1.34"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.32 → codna-0.1.34}/tests/test_cli_parser.py

@@ -262,3 +262,42 @@ def test_secure_malformed_sarif_is_user_error(tmp_path, capsys):
     assert "Traceback" not in captured.err
     assert "could not ingest SARIF" in captured.err
     assert "malformed SARIF JSON" in captured.err
+
+
+def test_secure_invalid_manifest_is_user_error(tmp_path, capsys):
+    sarif = tmp_path / "ok.sarif"
+    sarif.write_text(
+        json.dumps({
+            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [{
+                "tool": {"driver": {"name": "CodeQL", "version": "2.15.0", "rules": []}},
+                "versionControlProvenance": [{"revisionId": "a" * 40, "repositoryUri": "https://x/y"}],
+                "results": [],
+            }],
+        }),
+        encoding="utf-8",
+    )
+    manifest = tmp_path / "codna-security.yaml"
+    manifest.write_text(
+        "scanner:\n  id: smoke\n  command: [true]\n  output: ok.sarif\n",
+        encoding="utf-8",
+    )
+
+    rc = cli_module.main([
+        "secure",
+        str(tmp_path),
+        "--from-sarif",
+        str(sarif),
+        "--engine",
+        "local",
+        "--fix",
+        "--verification",
+        str(manifest),
+    ])
+
+    assert rc == 1
+    captured = capsys.readouterr()
+    assert "Traceback" not in captured.err
+    assert "invalid verification manifest" in captured.err
+    assert "scanner.command[0]" in captured.err

{codna-0.1.32 → codna-0.1.34}/tests/test_manifest.py

@@ -2,6 +2,8 @@
 from __future__ import annotations
 
 
+import re
+
 import pytest
 
 from codna.manifest import ManifestError, VerificationManifest
@@ -74,3 +76,19 @@ def test_image_pinned_detection():
     assert VerificationManifest.from_dict(d).scanner.image_pinned is True
     d["scanner"]["image"] = "semgrep:1.2.3"
     assert VerificationManifest.from_dict(d).scanner.image_pinned is False
+
+
+@pytest.mark.parametrize(
+    "mutate,expected",
+    [
+        (lambda d: d["scanner"].__setitem__("command", ["semgrep", False]), "scanner.command[1]"),
+        (lambda d: d["verification"].__setitem__("build", [["npm", True]]), "verification.build[0][1]"),
+        (lambda d: d["verification"].__setitem__("tests", [[False]]), "verification.tests[0][0]"),
+        (lambda d: d["scanner"].__setitem__("accepted_exit_codes", [0, True]), "scanner.accepted_exit_codes[1]"),
+    ],
+)
+def test_manifest_rejects_non_string_commands_and_bool_exit_codes(mutate, expected):
+    d = _manifest_dict()
+    mutate(d)
+    with pytest.raises(ManifestError, match=re.escape(expected)):
+        VerificationManifest.from_dict(d)

{codna-0.1.32 → codna-0.1.34}/tests/test_release_readiness.py

@@ -397,14 +397,14 @@ def test_safe_publish_accepts_real_publish_when_pypi_reports_source_version():
         head_sha="abc",
         run_details_by_id=run_details,
         pypi_token_secret_scopes=["environment"],
-        source_version="0.1.32",
-        public_version="0.1.32",
+        source_version="0.1.34",
+        public_version="0.1.34",
     )
 
     assert check.status == "pass"
     assert "publish=true" in check.message
-    assert check.details["source_version"] == "0.1.32"
-    assert check.details["public_version"] == "0.1.32"
+    assert check.details["source_version"] == "0.1.34"
+    assert check.details["public_version"] == "0.1.34"
     assert check.details["pypi_token_secret_scopes"] == ["environment"]
 
 
@@ -433,14 +433,14 @@ def test_safe_publish_real_publish_fails_until_pypi_reports_source_version():
         runs,
         head_sha="abc",
         run_details_by_id=run_details,
-        source_version="0.1.32",
-        public_version="0.1.31",
+        source_version="0.1.34",
+        public_version="0.1.33",
     )
 
     assert check.status == "fail"
     assert "PyPI does not report the source version" in check.message
-    assert check.details["source_version"] == "0.1.32"
-    assert check.details["public_version"] == "0.1.31"
+    assert check.details["source_version"] == "0.1.34"
+    assert check.details["public_version"] == "0.1.33"
 
 
 def test_safe_publish_reports_completed_oidc_failure_precisely():