mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-13 05:10:48 +01:00
Krzysztof kuhy Rudnicki
bca70b67b5
The gate was a presence check -- 'a run_all.sh exists beside this lib' -- which an empty suite that asserts nothing satisfies. It now measures. 100% is reachable with no suppressions and no production source changes: run the suite inside a user+mount namespace and the sudo-writes, systemd units and nftables rules execute for real against a throwaway /etc. - meta/scripts/shell_coverage_jail.sh: the runner, promoted out of a session scratchpad. Two fixes it needed on the way: bind targets mirror the real directory tree (an empty bind makes writes fail with ENOENT, which reads as unreachable code), and sudo gets a pass-through stub because real sudo cannot setresuid inside a userns. - It fingerprints git status before and after and fails the run if a write escapes the jail. Verified with a deliberate escapee. - dot_resolver_install.sh: 39/39 = 100.00%, 28 assertions. Picked by scoring every allowlisted lib on root ops, system writes and destructive calls -- it scored highest in the repo. Allowlist 106 -> 105. - jscpd was already over its own threshold at 2.45% and would have rejected every commit staging a .sh file. Excluding vendored .venv/ shell alone gives 1.67%; also excluding lib/tests/ gives 1.47%. The gate is deliberately NOT wired into the hook chain yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DbD4nco3EgL1UFoZKmKsLE |
||
|---|---|---|
| .. | ||
| tests | ||
| aw_autostart.sh | ||
| aw_install.sh | ||
| aw_service.sh | ||
| dns_dhcp.sh | ||
| dns_firewall.sh | ||
| dns_units.sh | ||
| dot_resolver_install.sh | ||
| dwm_config.sh | ||
| gitea_network.sh | ||
| kcd2_autorebuild.sh | ||
| kcd2_expose.sh | ||
| kcd2_serve.sh | ||
| local_llm_model.sh | ||
| mobile_service.sh | ||
| nc_discover.sh | ||
| nc_flash.sh | ||
| nc_image.sh | ||
| nc_packages.sh | ||
| nc_php.sh | ||
| nc_remote_flash.sh | ||
| nc_remote.sh | ||
| nc_services.sh | ||
| pi_flash_exec.sh | ||
| pi_flash_image.sh | ||
| pi_flash_remote.sh | ||
| rpi_nc_ca.sh | ||
| rpi_nc_deps.sh | ||
| rpi_nc_fixes.sh | ||
| rpi_nc_install.sh | ||
| rpi_nc_ssl_remote.sh | ||
| rpi_nc_ssl.sh | ||
| rpi_nc_system.sh | ||
| searxng_expose.sh | ||
| searxng_limiter.sh | ||
| searxng_settings.sh | ||
| searxng_stack.sh | ||
| searxng_start.sh | ||
| searxng_status.sh | ||
| syncyomi_expose.sh | ||
| syncyomi_stack.sh | ||
| unreal_mcp_repo.sh | ||
| website_build.sh | ||
| wg_firewall.sh | ||
| wg_keys.sh | ||
| wg_sshd.sh | ||