specfuse-loop 0.23.1__tar.gz → 0.23.3__tar.gz

{specfuse_loop-0.23.1/specfuse_loop.egg-info → specfuse_loop-0.23.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.23.1
+Version: 0.23.3
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.23.1 → specfuse_loop-0.23.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specfuse-loop"
-version = "0.23.1"
+version = "0.23.3"
 description = "Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology."
 readme = "README.md"
 requires-python = ">=3.10"

specfuse_loop-0.23.3/specfuse/loop/data/VERSION

@@ -0,0 +1 @@
+0.23.3

{specfuse_loop-0.23.1 → specfuse_loop-0.23.3}/specfuse/loop/loop.py

@@ -125,7 +125,7 @@ SPECFUSE_DIR = Path(".specfuse")
 REPO_ROOT = SPECFUSE_DIR.parent
 FEATURES_DIR = SPECFUSE_DIR / "features"
 VERIFICATION_PATH = SPECFUSE_DIR / "verification.yml"
-DRIVER_VERSION = "0.23.1"
+DRIVER_VERSION = "0.23.3"
 # Oldest scaffold layout this driver can drive. init.sh stamps the scaffold's own
 # version into `.specfuse/VERSION`; check_scaffold_version() fails loud at startup if
 # the consumer's scaffold is older than this, pointing at `specfuse upgrade`. Bump

{specfuse_loop-0.23.1 → specfuse_loop-0.23.3}/specfuse/loop/red_on_base.py

@@ -27,6 +27,13 @@ Three deliberate constraints:
 * **Never guess the command.** The operator declares it. A guessed command that
   silently matched no tests would exit non-zero, read as "red on base", and
   wave every PR through -- strictly worse than the gap it was meant to close.
+* **Run it through a shell.** Operator-authored commands use pipes, `||`, `$(...)`
+  and inline environment overrides, exactly as the gate commands in
+  `verification.yml` do -- `_run_gate_set` runs those with `shell=True` for the
+  same stated reason. A first cut of this module used `shlex.split` and no
+  shell, which could not express the command of the very repository it was
+  built for: every merge would have declined `red_on_base_unverified` while
+  looking configured.
 * **Fail closed.** Every unknown returns `None`, which the guardrail reads as
   unverified and declines. An unverifiable claim is not a satisfied one.
 
@@ -45,6 +52,12 @@ from pathlib import Path
 from typing import Any, Callable, Optional
 
 
+#: POSIX reserves these for the shell's own failure to run the command: 126 is
+#: "found but not executable", 127 is "not found". Neither says anything about
+#: the test, so neither may be read as a verdict on it (#3403).
+_COULD_NOT_EXECUTE = frozenset({126, 127})
+
+
 def select_test_files(changed_files: Any, test_paths: Any) -> list:
     """The changed files that live under a declared test root.
 
@@ -77,9 +90,16 @@ def test_was_red_on_base(
     """`True` if *test_files* fail at *base_sha*, `False` if they pass, else `None`.
 
     `command_template` is the operator's own command with a `{tests}`
-    placeholder -- `pytest {tests}`, `mvn -q test -Dtest={tests}`, whatever the
-    repository actually uses. Absent, this returns `None` and the merge
-    declines: see the module docstring on why guessing is worse than the gap.
+    placeholder, run through `sh -c` so pipes, `||` and `$(...)` all work --
+    a Maven repository needs `$(...)` just to turn the changed file paths into
+    the class names `-Dtest=` accepts. Absent, this returns `None` and the
+    merge declines: see the module docstring on why guessing is worse than the
+    gap.
+
+    `sh -c` rather than `subprocess(shell=True)` so the command still arrives
+    through the injected runner as an argv, which is what makes this testable
+    without executing anything. It also means the template is POSIX shell; a
+    Windows runner would need its own spelling, and none is invented here.
 
     `None` means "could not establish", never "fine". A worktree that will not
     create, a runner that raises, no declared command and no test file in the
@@ -103,14 +123,28 @@ def test_was_red_on_base(
         return None
 
     try:
-        rendered = command_template.replace("{tests}", " ".join(files))
+        rendered = command_template.replace(
+            "{tests}", " ".join(shlex.quote(p) for p in files))
         try:
-            result = runner(shlex.split(rendered), cwd=str(root), check=False)
+            result = runner(["sh", "-c", rendered], cwd=str(root), check=False)
         except Exception:  # noqa: BLE001 - same reason as above
             return None
         code = getattr(result, "returncode", None)
         if not isinstance(code, int):
             return None
+        if code in _COULD_NOT_EXECUTE:
+            # The shell could not run the command at all. That is "the check
+            # never ran", not "the test failed" -- and the difference is the
+            # whole point of keeping those two declining reasons apart.
+            #
+            # Measured: an operator whose command is a committed script hits
+            # this on every PR whose merge base predates that script. The
+            # worktree is the BASE tree, so the script is simply absent there,
+            # `sh` exits 127, and reading that as red would let the merge
+            # through on the strength of a command that never ran. Fail-open,
+            # in the one guardrail whose entire job is to be harder to satisfy
+            # than the others.
+            return None
         # Non-zero at the base is the proof we want: the test the PR adds does
         # not hold on the tree the fix was written against.
         return code != 0

{specfuse_loop-0.23.1 → specfuse_loop-0.23.3/specfuse_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.23.1
+Version: 0.23.3
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.23.1 → specfuse_loop-0.23.3}/tests/test_red_on_base_probe.py

@@ -178,5 +178,117 @@ class TheProbe(unittest.TestCase):
             self.assertNotIn("reset", argv)
 
 
+class TheCommandGetsAShell(unittest.TestCase):
+    """Operator commands use shell features; the probe must provide them.
+
+    The first cut of this module ran `shlex.split(rendered)` with no shell. It
+    passed every test above, because none of them used a shell feature — and it
+    could not express the command of the repository it was built for. A Maven
+    project needs `$(...)` just to turn changed file paths into the class names
+    `-Dtest=` accepts, so turning the guardrail on there would have declined
+    every merge as `red_on_base_unverified` while looking configured.
+    """
+
+    def _tmp(self) -> Path:
+        tmp = TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        return Path(tmp.name)
+
+    def _capture(self, template):
+        seen = {}
+
+        def runner(argv, **kw):
+            if argv[:2] == ["git", "worktree"]:
+                return SimpleNamespace(returncode=0, stdout="", stderr="")
+            seen["argv"] = list(argv)
+            return SimpleNamespace(returncode=1, stdout="", stderr="")
+
+        test_was_red_on_base(
+            runner, base_sha="abc123", test_files=["src/test/java/FooTest.java"],
+            command_template=template, worktree_root=self._tmp(),
+        )
+        return seen["argv"]
+
+    def test_the_command_is_handed_to_a_shell(self):
+        argv = self._capture("pytest {tests}")
+
+        self.assertEqual(["sh", "-c"], argv[:2])
+        self.assertEqual(3, len(argv), "the whole command is one shell string")
+
+    def test_shell_syntax_survives_intact(self):
+        template = (
+            './mvnw test -Dtest=$(echo "{tests}" | sed -E "s@.*/([^/]+)\\.java@\\1@")'
+            ' || { echo failed; exit 1; }'
+        )
+
+        argv = self._capture(template)
+
+        self.assertIn("$(", argv[2])
+        self.assertIn("||", argv[2])
+        self.assertIn("|", argv[2])
+
+    def test_a_path_needing_quoting_is_quoted(self):
+        seen = {}
+
+        def runner(argv, **kw):
+            if argv[:2] == ["git", "worktree"]:
+                return SimpleNamespace(returncode=0, stdout="", stderr="")
+            seen["argv"] = list(argv)
+            return SimpleNamespace(returncode=1, stdout="", stderr="")
+
+        test_was_red_on_base(
+            runner, base_sha="abc", test_files=["tests/a b.py", "tests/c;d.py"],
+            command_template="pytest {tests}", worktree_root=self._tmp(),
+        )
+
+        # Unquoted, `a b.py` would become two arguments and `c;d.py` would end
+        # the command — a path the repository controls must not be able to do
+        # either.
+        self.assertIn("'tests/a b.py'", seen["argv"][2])
+        self.assertIn("'tests/c;d.py'", seen["argv"][2])
+
+
+class ACommandThatCannotRunIsUnverified(unittest.TestCase):
+    """127 is the shell saying it could not run the command, not a verdict.
+
+    Reading it as "red on base" is fail-OPEN, in the one guardrail whose whole
+    job is to be harder to satisfy than the other six.
+
+    Measured on a real repository: the operator's command was a committed
+    script, the probe's worktree is the BASE tree, and on every PR whose merge
+    base predates that script the file is simply absent. `sh` exits 127 and the
+    merge proceeded on the strength of a command that never ran.
+    """
+
+    def _tmp(self) -> Path:
+        tmp = TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        return Path(tmp.name)
+
+    def _verdict_for(self, exit_code):
+        def runner(argv, **kw):
+            if argv[:2] == ["git", "worktree"]:
+                return SimpleNamespace(returncode=0, stdout="", stderr="")
+            return SimpleNamespace(returncode=exit_code, stdout="", stderr="")
+
+        return test_was_red_on_base(
+            runner, base_sha="abc123", test_files=["tests/test_a.py"],
+            command_template="./scripts/probe.sh {tests}",
+            worktree_root=self._tmp(),
+        )
+
+    def test_command_not_found_is_unverified(self):
+        self.assertIsNone(self._verdict_for(127))
+
+    def test_command_not_executable_is_unverified(self):
+        self.assertIsNone(self._verdict_for(126))
+
+    def test_an_ordinary_test_failure_is_still_red(self):
+        self.assertIs(True, self._verdict_for(1))
+
+    def test_a_pass_is_still_not_red(self):
+        self.assertIs(False, self._verdict_for(0))
+
+
 if __name__ == "__main__":  # pragma: no cover
     unittest.main()

specfuse_loop-0.23.1/specfuse/loop/data/VERSION

@@ -1 +0,0 @@
-0.23.1