plugin-scanner 3.0.0a162__tar.gz → 3.1.0a12__tar.gz

plugin_scanner-3.1.0a12/.github/workflows/ci.yml

@@ -0,0 +1,416 @@
+name: CI
+on:
+  push:
+    branches: [main, release/3.0, release/3.1]
+  pull_request:
+    branches: [main, release/3.0, release/3.1]
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - name: Set up uv
+        id: setup-uv-primary
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - name: Retry uv setup after transient download failure
+        if: steps.setup-uv-primary.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python 3.12
+      - name: Validate protected test invariants
+        run: uv run --no-sync python scripts/ci/test_inventory.py --output test-inventory.json
+      - name: Publish test inventory
+        run: cat test-inventory.json
+      - name: Enforce test-suite size ratchet
+        run: |
+          uv run --no-sync python scripts/ci/test_suite_ratchet.py \
+            --baseline ci/test-suite-ratchet-baseline.json \
+            --inventory test-inventory.json
+      - name: Publish exact test-body duplicate candidates
+        run: |
+          uv run --no-sync python scripts/ci/test_duplicate_candidates.py \
+            --output test-duplicate-candidates.json
+          cat test-duplicate-candidates.json
+      - run: uv run --no-sync python -m ruff check src/
+      - run: uv run --no-sync python -m ruff format --check src/
+      - run: uv run --no-sync basedpyright --level error
+      - name: Dead-code scan (L329)
+        run: uv run --no-sync python -m ruff check src/codex_plugin_scanner/guard/ --select=F401,F811,F841
+      - name: TODO/FIXME scan (L330)
+        run: |
+          count=$(grep -rn "TODO\|FIXME\|HACK\|XXX" src/codex_plugin_scanner/guard/ --include="*.py" | grep -v "# type: ignore" | wc -l | tr -d ' ')
+          echo "Guard TODO/FIXME count: $count"
+          if [ "$count" -gt "0" ]; then
+            grep -rn "TODO\|FIXME\|HACK\|XXX" src/codex_plugin_scanner/guard/ --include="*.py" | grep -v "# type: ignore"
+            exit 1
+          fi
+
+  tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12"]
+        shard-index: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Set up uv
+        id: setup-uv-primary
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - name: Retry uv setup after transient download failure
+        if: steps.setup-uv-primary.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      - name: Secure the CI virtualenv interpreter
+        shell: bash
+        run: |
+          interpreter="$(uv run --no-sync python -c 'import sys; print(sys.executable)')"
+          target="$(realpath "$interpreter")"
+          mode="$(stat -c '%a' "$target")"
+          if (( (8#$mode & 2) != 0 )); then
+            replacement="${interpreter}.guard-ci"
+            cp --dereference "$target" "$replacement"
+            chmod 0755 "$replacement"
+            mv "$replacement" "$target"
+          fi
+          secured_mode="$(stat -c '%a' "$(realpath "$interpreter")")"
+          (( (8#$secured_mode & 2) == 0 ))
+      - name: Run pytest shard ${{ matrix.shard-index }}
+        shell: bash
+        run: |
+          uv run --no-sync python scripts/ci/pytest_shard.py \
+            --shard-index "${{ matrix.shard-index }}" \
+            --shard-count 16 \
+            --granularity node \
+            --duration-manifest ci/pytest-duration-manifest.json.gz \
+            --max-manifest-age-days 28 > pytest-nodes.txt
+          test -s pytest-nodes.txt
+          PYTHONPATH=scripts/ci GUARD_PYTEST_DURATION_OUTPUT=pytest-durations.json \
+            uv run --no-sync pytest -p pytest_duration_report @pytest-nodes.txt --tb=short
+      - name: Upload pytest duration artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: pytest-durations-${{ matrix.shard-index }}
+          path: pytest-durations.json
+          if-no-files-found: warn
+
+  duration-manifest-candidate:
+    if: needs.tests.result == 'success'
+    needs: tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python 3.12
+      - name: Download pytest duration reports
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          pattern: pytest-durations-*
+          path: duration-reports
+      - name: Build duration manifest candidate
+        shell: bash
+        run: |
+          shopt -s globstar nullglob
+          reports=(duration-reports/**/pytest-durations.json)
+          test "${#reports[@]}" -eq 16
+          uv run --no-sync python scripts/ci/build_pytest_duration_manifest.py \
+            --output pytest-duration-manifest-candidate.json.gz \
+            --observed-at "$(date --utc +%Y-%m-%dT%H:%M:%SZ)" \
+            "${reports[@]}"
+      - name: Upload pytest duration manifest candidate
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: pytest-duration-manifest-candidate
+          path: pytest-duration-manifest-candidate.json.gz
+          if-no-files-found: error
+
+  compatibility:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      - name: Run cross-version compatibility contracts
+        run: >-
+          uv run --no-sync pytest
+          tests/test_cli.py
+          tests/test_verification.py
+          tests/test_action_runner.py
+          tests/test_cisco_install_surfaces.py
+          tests/test_policy.py
+          tests/test_policy_bundle_parser.py
+          --tb=short
+
+  deep-compatibility:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.13"]
+        shard-index: [0, 1, 2, 3]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      # Current GitHub toolcache images ship 3.10/3.11/3.13 interpreters with
+      # mode 777 (other-writable); the hook manifest integrity check rightly
+      # refuses them. Replace with a private 0755 copy, same as the tests job.
+      - name: Secure the CI virtualenv interpreter
+        shell: bash
+        run: |
+          interpreter="$(uv run --no-sync python -c 'import sys; print(sys.executable)')"
+          target="$(realpath "$interpreter")"
+          mode="$(stat -c '%a' "$target")"
+          if (( (8#$mode & 2) != 0 )); then
+            replacement="${interpreter}.guard-ci"
+            cp --dereference "$target" "$replacement"
+            chmod 0755 "$replacement"
+            mv "$replacement" "$target"
+          fi
+          secured_mode="$(stat -c '%a' "$(realpath "$interpreter")")"
+          (( (8#$secured_mode & 2) == 0 ))
+      - name: Run deep compatibility shard ${{ matrix.shard-index }}
+        shell: bash
+        run: |
+          uv run --no-sync python scripts/ci/pytest_shard.py \
+            --shard-index "${{ matrix.shard-index }}" \
+            --shard-count 4 \
+            --granularity file > pytest-files.txt
+          test -s pytest-files.txt
+          uv run --no-sync pytest @pytest-files.txt --tb=short
+
+  mutation-baseline:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python 3.12
+      - name: Run command parser mutation baseline
+        run: uv run --no-sync mutmut run --max-children 4
+      - name: Validate mutation baseline
+        run: |
+          uv run --no-sync mutmut export-cicd-stats
+          uv run --no-sync python scripts/ci/mutation_gate.py --target command-model
+
+  ci-python-312:
+    name: ci (3.12)
+    if: always()
+    needs: [quality, tests, compatibility]
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Verify Python CI dependencies
+        env:
+          QUALITY_RESULT: ${{ needs.quality.result }}
+          TESTS_RESULT: ${{ needs.tests.result }}
+          COMPATIBILITY_RESULT: ${{ needs.compatibility.result }}
+        run: |
+          test "$QUALITY_RESULT" = "success"
+          test "$TESTS_RESULT" = "success"
+          test "$COMPATIBILITY_RESULT" = "success"
+
+  dashboard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: "1.3.14"
+      - run: cd dashboard && bun install --frozen-lockfile
+      - run: cd dashboard && bun run test
+      - name: Dashboard build and bundle-size report (L331)
+        run: |
+          cd dashboard && bun run build
+          git diff --exit-code -- ../src/codex_plugin_scanner/guard/daemon/static
+          js_size=$(du -sh dist/assets/*.js 2>/dev/null | awk '{print $1}' | head -1)
+          css_size=$(du -sh dist/assets/*.css 2>/dev/null | awk '{print $1}' | head -1)
+          echo "Bundle JS: ${js_size:-unknown}, CSS: ${css_size:-unknown}"
+
+  cisco-full:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.13"
+      - name: Set up uv
+        id: setup-uv-primary
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - name: Retry uv setup after transient download failure
+        if: steps.setup-uv-primary.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: python3.13 -m pip install --dry-run --no-deps --require-hashes -r docker-requirements.txt
+      - run: uv sync --frozen --extra dev --extra cisco --group cisco-mcp --python 3.13
+      - run: uv run --no-sync pytest tests/test_cisco_install_surfaces.py tests/test_mcp_security.py tests/test_cli.py tests/test_action_runner.py tests/test_live_cisco_smoke.py --tb=short
+
+  cross-platform:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [macos-latest, windows-latest]
+        python-version: ["3.12"]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Set up uv
+        id: setup-uv-primary
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - name: Retry uv setup after transient download failure
+        if: steps.setup-uv-primary.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      - name: Run cross-platform Guard regressions
+        run: >-
+          uv run --no-sync pytest
+          tests/test_cli.py
+          tests/test_verification.py
+          tests/test_action_runner.py
+          tests/test_guard_skill_directory_identity.py
+          tests/test_guard_skill_directory_identity_discovery.py
+          tests/test_guard_skill_directory_identity_downstream.py
+          tests/test_guard_skill_directory_identity_links.py
+          tests/test_guard_consumer_skill_directory_identity.py
+          tests/test_guard_runner_skill_directory_identity.py
+          tests/test_gemini_adapter.py
+          tests/test_gemini_skill_directory_identity.py
+          tests/test_antigravity_adapter.py
+          tests/test_guard_aibom_detection.py
+          tests/test_guard_aibom_content_upload_batches.py
+          tests/test_guard_aibom_skill_directory_identity.py
+          --tb=short
+      - name: Run Windows Codex hook process-tree regressions
+        if: runner.os == 'Windows'
+        run: >-
+          uv run --no-sync pytest
+          tests/test_codex_hook_fallback_isolation.py
+          -k "isolated_process_timeout_kills_descendants or isolated_process_closes_descendant_held_pipes_after_parent_exit"
+          --tb=short
+
+  windows-updater:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: windows-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Set up uv
+        id: setup-uv-primary
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - name: Retry uv setup after transient download failure
+        if: steps.setup-uv-primary.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      - name: Run trusted updater and daemon regressions
+        run: >-
+          uv run --no-sync pytest
+          tests/test_guard_update_artifact.py
+          tests/test_guard_update_subprocess.py
+          tests/test_guard_update_isolation.py
+          tests/test_guard_phase03_local_install.py
+          tests/test_guard_phase03_remainder.py
+          tests/test_dashboard_update.py
+          tests/test_guard_daemon_manager.py
+          tests/test_guard_mdm_policy.py
+          --tb=short

plugin_scanner-3.1.0a12/.github/workflows/mdm-local-lab.yml

@@ -0,0 +1,44 @@
+name: MDM local conformance lab
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/mdm-local-lab.yml"
+      - "scripts/mdm/**"
+      - "src/codex_plugin_scanner/guard/mdm/**"
+      - "tests/test_guard_mdm_*.py"
+      - "tests/test_guard_self_protection_schemas.py"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  conformance:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            suites: ""
+          - os: macos-14
+            suites: ""
+          - os: windows-2022
+            suites: "--suite adapter-contract --suite enterprise-network"
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          enable-cache: true
+      - run: uv sync --python 3.12 --extra dev --frozen
+      - run: uv run --python 3.12 --no-sync python scripts/mdm/run-local-lab.py --json --output mdm-local-conformance.json ${{ matrix.suites }}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: mdm-local-conformance-${{ matrix.os }}
+          path: mdm-local-conformance.json
+          if-no-files-found: error
+          retention-days: 30