mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 17:14:08 +01:00
Krzysztof kuhy Rudnicki
0091608b08
Two defects found in review, both of which made checks PASS more easily, so neither ever went red. GATE: is_covered() hardcoded its jail flags and never read the jail_args marker that ci_mirror.sh and shell-tests.yml both consume. The features/lib suite needs /usr/local/share and /etc/pki and aborts under set -e without them -- but the coverage number still printed, because kcov had already recorded whatever the dead run reached. The gate would have graded 44 libs on a suite that never finished. It now reads the marker, keeps the historical defaults for suites without one, fails closed on an empty marker, and passes --fail-on-case-error. Negative control: stripping the binds makes the gate exit 1 and restoring them returns exit 0. Before this commit both cases exited 0 -- the gate could not fail on an aborting suite. HASH CACHE: the _t_unstub helper written earlier today for the transcribe harness was needed in features_harness.sh too. Two assertions were vacuous -- test_dwm_config's "verify still reports when dwm is absent", and test_rpi_nc_ca's uname removal, where a cached uname left every later branch running under a faked Darwin. All four `rm -f "$TEST_TMPDIR/bin/` sites in the repo were audited; the other two are sound (one probes with [[ -f ]], the other runs in a subshell). No measured figure moved: dot_resolver_install.sh still 39/39 = 100.00% with real absence enforced, so its off-allowlist clearance holds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016sxxsDHWgdRhmdmzNMA6XM
73 lines
2.9 KiB
Bash
Executable File
73 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# ============================================================================
|
|
# The coverage bar for check_shell_coverage.sh.
|
|
#
|
|
# Split out of that script on 2026-08-22 to keep both files under the repo's
|
|
# 250-line cap. Sourced, not executed.
|
|
# ============================================================================
|
|
|
|
# A lib is covered when its directory has a suite AND that suite drives the
|
|
# lib to COVERAGE_BAR% line coverage.
|
|
#
|
|
# This was a presence check until 2026-08-22 -- "a run_all.sh exists beside
|
|
# it" -- which is satisfiable by an empty suite that sources the lib and
|
|
# asserts nothing. The bar is a measured percentage because that is the only
|
|
# version a suite cannot trivially pass.
|
|
#
|
|
# 100% is reachable without suppressions and without touching production
|
|
# source: run the suite inside the user+mount namespace of
|
|
# shell_coverage_jail.sh and the sudo-writes, systemd units and nftables rules
|
|
# execute for real against a throwaway /etc. Measured on the repo's hardest
|
|
# library, dot_resolver_install.sh (15 root ops, 5 system writes): 39/39.
|
|
readonly COVERAGE_BAR=100
|
|
|
|
is_covered() {
|
|
local path="$1"
|
|
local suite
|
|
suite="$(dirname "$path")/tests/run_all.sh"
|
|
[[ -f "$suite" ]] || return 1
|
|
|
|
# Presence alone is enough when the measurement cannot be made: kcov is a
|
|
# developer dependency, and a hook that hard-fails on a missing tool would
|
|
# block commits on any machine without it. The CI job carries the tool and
|
|
# enforces the number, so nothing merges on presence alone.
|
|
command -v kcov >/dev/null 2>&1 || return 0
|
|
command -v unshare >/dev/null 2>&1 || return 0
|
|
|
|
# A suite declares the mounts and seeds it needs in a `jail_args` file
|
|
# beside its run_all.sh -- the same marker ci_mirror.sh and
|
|
# shell-tests.yml read. Hardcoding flags here was a latent gate failure:
|
|
# the features/lib suite needs /usr/local/share and /etc/pki, and without
|
|
# them it ABORTS partway under `set -e`. The coverage number still printed
|
|
# (kcov had already recorded the lines the dead run reached), so the gate
|
|
# would have passed a lib whose suite never finished.
|
|
local jail_args=()
|
|
local args_file
|
|
args_file="$(dirname "$suite")/jail_args"
|
|
if [[ -f "$args_file" ]]; then
|
|
local arg
|
|
while IFS= read -r arg; do
|
|
jail_args+=("$arg")
|
|
done < <(grep -v '^#\|^$' "$args_file" || true)
|
|
if [[ ${#jail_args[@]} -eq 0 ]]; then
|
|
echo "Error: jail_args is present but empty: $args_file" >&2
|
|
return 1
|
|
fi
|
|
else
|
|
# No marker: the suite runs without needing anything mounted, so give
|
|
# it the historical defaults rather than nothing.
|
|
jail_args=(--bind /etc --bind /usr/local/bin --bind /var/lib)
|
|
fi
|
|
|
|
# --fail-on-case-error: a suite that dies partway must fail the gate, not
|
|
# be graded on however many lines it managed to reach first.
|
|
"$REPO_ROOT/meta/scripts/shell_coverage_jail.sh" \
|
|
--subject "$suite" \
|
|
"${jail_args[@]}" \
|
|
--measure "$(basename "$path")" \
|
|
--min "$COVERAGE_BAR" \
|
|
--fail-on-case-error \
|
|
-- "" >/dev/null 2>&1
|
|
}
|