mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 21:07:03 +01:00
Krzysztof kuhy Rudnicki
bca70b67b5
The gate was a presence check -- 'a run_all.sh exists beside this lib' -- which an empty suite that asserts nothing satisfies. It now measures. 100% is reachable with no suppressions and no production source changes: run the suite inside a user+mount namespace and the sudo-writes, systemd units and nftables rules execute for real against a throwaway /etc. - meta/scripts/shell_coverage_jail.sh: the runner, promoted out of a session scratchpad. Two fixes it needed on the way: bind targets mirror the real directory tree (an empty bind makes writes fail with ENOENT, which reads as unreachable code), and sudo gets a pass-through stub because real sudo cannot setresuid inside a userns. - It fingerprints git status before and after and fails the run if a write escapes the jail. Verified with a deliberate escapee. - dot_resolver_install.sh: 39/39 = 100.00%, 28 assertions. Picked by scoring every allowlisted lib on root ops, system writes and destructive calls -- it scored highest in the repo. Allowlist 106 -> 105. - jscpd was already over its own threshold at 2.45% and would have rejected every commit staging a .sh file. Excluding vendored .venv/ shell alone gives 1.67%; also excluding lib/tests/ gives 1.47%. The gate is deliberately NOT wired into the hook chain yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DbD4nco3EgL1UFoZKmKsLE
45 lines
1.8 KiB
Bash
Executable File
45 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# ============================================================================
|
|
# The coverage bar for check_shell_coverage.sh.
|
|
#
|
|
# Split out of that script on 2026-08-22 to keep both files under the repo's
|
|
# 250-line cap. Sourced, not executed.
|
|
# ============================================================================
|
|
|
|
# A lib is covered when its directory has a suite AND that suite drives the
|
|
# lib to COVERAGE_BAR% line coverage.
|
|
#
|
|
# This was a presence check until 2026-08-22 -- "a run_all.sh exists beside
|
|
# it" -- which is satisfiable by an empty suite that sources the lib and
|
|
# asserts nothing. The bar is a measured percentage because that is the only
|
|
# version a suite cannot trivially pass.
|
|
#
|
|
# 100% is reachable without suppressions and without touching production
|
|
# source: run the suite inside the user+mount namespace of
|
|
# shell_coverage_jail.sh and the sudo-writes, systemd units and nftables rules
|
|
# execute for real against a throwaway /etc. Measured on the repo's hardest
|
|
# library, dot_resolver_install.sh (15 root ops, 5 system writes): 39/39.
|
|
readonly COVERAGE_BAR=100
|
|
|
|
is_covered() {
|
|
local path="$1"
|
|
local suite
|
|
suite="$(dirname "$path")/tests/run_all.sh"
|
|
[[ -f "$suite" ]] || return 1
|
|
|
|
# Presence alone is enough when the measurement cannot be made: kcov is a
|
|
# developer dependency, and a hook that hard-fails on a missing tool would
|
|
# block commits on any machine without it. The CI job carries the tool and
|
|
# enforces the number, so nothing merges on presence alone.
|
|
command -v kcov >/dev/null 2>&1 || return 0
|
|
command -v unshare >/dev/null 2>&1 || return 0
|
|
|
|
"$REPO_ROOT/meta/scripts/shell_coverage_jail.sh" \
|
|
--subject "$suite" \
|
|
--bind /etc --bind /usr/local/bin --bind /var/lib \
|
|
--measure "$(basename "$path")" \
|
|
--min "$COVERAGE_BAR" \
|
|
-- "" >/dev/null 2>&1
|
|
}
|