mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-12 21:53:00 -06:00
test(deps): clean dependency evidence temp roots
This commit is contained in:
Vincent Koc
@@ -1,4 +1,4 @@
|
||||
import { mkdtemp, writeFile } from "node:fs/promises";
|
||||
import { mkdtemp, rm, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import path from "node:path";
|
||||
import { describe, expect, it } from "vitest";
|
||||
@@ -97,47 +97,51 @@ describe("dependency-vulnerability-gate", () => {
|
||||
|
||||
it("queries full and production lockfile graphs separately", async () => {
|
||||
const rootDir = await mkdtemp(path.join(tmpdir(), "openclaw-vuln-gate-"));
|
||||
await writeLockfile(rootDir);
|
||||
const payloads: Record<string, string[]>[] = [];
|
||||
try {
|
||||
await writeLockfile(rootDir);
|
||||
const payloads: Record<string, string[]>[] = [];
|
||||
|
||||
const report = await runDependencyVulnerabilityGate({
|
||||
rootDir,
|
||||
fetchImpl: async (_url, init) => {
|
||||
const payload = JSON.parse(String(init?.body));
|
||||
payloads.push(payload);
|
||||
const packages = Object.keys(payload);
|
||||
const body: Record<string, unknown[]> = {};
|
||||
if (packages.includes("runtime-high")) {
|
||||
body["runtime-high"] = [
|
||||
advisory({ id: "GHSA-runtime-high", severity: "high", title: "runtime high" }),
|
||||
];
|
||||
}
|
||||
if (packages.includes("dev-high")) {
|
||||
body["dev-high"] = [
|
||||
advisory({ id: "GHSA-dev-high", severity: "high", title: "dev high" }),
|
||||
];
|
||||
}
|
||||
return new Response(JSON.stringify(body), {
|
||||
status: 200,
|
||||
headers: { "content-type": "application/json" },
|
||||
});
|
||||
},
|
||||
});
|
||||
const report = await runDependencyVulnerabilityGate({
|
||||
rootDir,
|
||||
fetchImpl: async (_url, init) => {
|
||||
const payload = JSON.parse(String(init?.body));
|
||||
payloads.push(payload);
|
||||
const packages = Object.keys(payload);
|
||||
const body: Record<string, unknown[]> = {};
|
||||
if (packages.includes("runtime-high")) {
|
||||
body["runtime-high"] = [
|
||||
advisory({ id: "GHSA-runtime-high", severity: "high", title: "runtime high" }),
|
||||
];
|
||||
}
|
||||
if (packages.includes("dev-high")) {
|
||||
body["dev-high"] = [
|
||||
advisory({ id: "GHSA-dev-high", severity: "high", title: "dev high" }),
|
||||
];
|
||||
}
|
||||
return new Response(JSON.stringify(body), {
|
||||
status: 200,
|
||||
headers: { "content-type": "application/json" },
|
||||
});
|
||||
},
|
||||
});
|
||||
|
||||
expect(payloads).toHaveLength(2);
|
||||
expect(payloads[0]).toEqual({
|
||||
"dev-high": ["1.0.0"],
|
||||
"runtime-high": ["1.0.0"],
|
||||
"transitive-critical": ["1.0.0"],
|
||||
});
|
||||
expect(payloads[1]).toEqual({
|
||||
"runtime-high": ["1.0.0"],
|
||||
});
|
||||
expect(report.blockers.map((finding) => finding.id)).toEqual(["GHSA-runtime-high"]);
|
||||
expect(report.findings.map((finding) => finding.id)).toEqual([
|
||||
"GHSA-dev-high",
|
||||
"GHSA-runtime-high",
|
||||
]);
|
||||
expect(payloads).toHaveLength(2);
|
||||
expect(payloads[0]).toEqual({
|
||||
"dev-high": ["1.0.0"],
|
||||
"runtime-high": ["1.0.0"],
|
||||
"transitive-critical": ["1.0.0"],
|
||||
});
|
||||
expect(payloads[1]).toEqual({
|
||||
"runtime-high": ["1.0.0"],
|
||||
});
|
||||
expect(report.blockers.map((finding) => finding.id)).toEqual(["GHSA-runtime-high"]);
|
||||
expect(report.findings.map((finding) => finding.id)).toEqual([
|
||||
"GHSA-dev-high",
|
||||
"GHSA-runtime-high",
|
||||
]);
|
||||
} finally {
|
||||
await rm(rootDir, { force: true, recursive: true });
|
||||
}
|
||||
});
|
||||
|
||||
it("documents the resolved transitive dependency graph scope in Markdown", () => {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { mkdtemp, readFile, writeFile } from "node:fs/promises";
|
||||
import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import path from "node:path";
|
||||
import { describe, expect, it } from "vitest";
|
||||
@@ -105,68 +105,72 @@ describe("generate-dependency-release-evidence", () => {
|
||||
|
||||
it("collects report counts and renders human summaries", async () => {
|
||||
const dir = await mkdtemp(path.join(tmpdir(), "openclaw-release-dependency-evidence-test-"));
|
||||
await writeJson(dir, "dependency-vulnerability-gate.json", {
|
||||
blockers: [{ id: "GHSA-blocker" }],
|
||||
findings: [{ id: "GHSA-blocker" }, { id: "GHSA-report" }],
|
||||
});
|
||||
await writeJson(dir, "transitive-manifest-risk-report.json", {
|
||||
findingCount: 17,
|
||||
workspaceExcludedFindingCount: 3,
|
||||
metadataFailures: [{ packageName: "missing" }],
|
||||
});
|
||||
await writeJson(dir, "dependency-ownership-surface-report.json", {
|
||||
summary: {
|
||||
lockfilePackageCount: 101,
|
||||
buildRiskPackageCount: 8,
|
||||
},
|
||||
});
|
||||
await writeJson(dir, "dependency-changes-report.json", {
|
||||
summary: {
|
||||
try {
|
||||
await writeJson(dir, "dependency-vulnerability-gate.json", {
|
||||
blockers: [{ id: "GHSA-blocker" }],
|
||||
findings: [{ id: "GHSA-blocker" }, { id: "GHSA-report" }],
|
||||
});
|
||||
await writeJson(dir, "transitive-manifest-risk-report.json", {
|
||||
findingCount: 17,
|
||||
workspaceExcludedFindingCount: 3,
|
||||
metadataFailures: [{ packageName: "missing" }],
|
||||
});
|
||||
await writeJson(dir, "dependency-ownership-surface-report.json", {
|
||||
summary: {
|
||||
lockfilePackageCount: 101,
|
||||
buildRiskPackageCount: 8,
|
||||
},
|
||||
});
|
||||
await writeJson(dir, "dependency-changes-report.json", {
|
||||
summary: {
|
||||
dependencyFileChanges: 4,
|
||||
addedPackages: 5,
|
||||
removedPackages: 6,
|
||||
changedPackages: 7,
|
||||
},
|
||||
});
|
||||
|
||||
const counts = await collectDependencyEvidenceSummaryCounts(dir);
|
||||
expect(counts).toEqual({
|
||||
vulnerabilityBlockers: 1,
|
||||
vulnerabilityFindings: 2,
|
||||
transitiveRiskSignals: 17,
|
||||
workspaceExcludedTransitiveSignals: 3,
|
||||
transitiveMetadataFailures: 1,
|
||||
ownershipLockfilePackages: 101,
|
||||
ownershipBuildRiskPackages: 8,
|
||||
dependencyFileChanges: 4,
|
||||
addedPackages: 5,
|
||||
removedPackages: 6,
|
||||
changedPackages: 7,
|
||||
},
|
||||
});
|
||||
dependencyAddedPackages: 5,
|
||||
dependencyRemovedPackages: 6,
|
||||
dependencyChangedPackages: 7,
|
||||
});
|
||||
|
||||
const counts = await collectDependencyEvidenceSummaryCounts(dir);
|
||||
expect(counts).toEqual({
|
||||
vulnerabilityBlockers: 1,
|
||||
vulnerabilityFindings: 2,
|
||||
transitiveRiskSignals: 17,
|
||||
workspaceExcludedTransitiveSignals: 3,
|
||||
transitiveMetadataFailures: 1,
|
||||
ownershipLockfilePackages: 101,
|
||||
ownershipBuildRiskPackages: 8,
|
||||
dependencyFileChanges: 4,
|
||||
dependencyAddedPackages: 5,
|
||||
dependencyRemovedPackages: 6,
|
||||
dependencyChangedPackages: 7,
|
||||
});
|
||||
const summary = renderDependencyEvidenceSummary({
|
||||
releaseTag: "v2026.5.13",
|
||||
releaseSha: "abc123",
|
||||
baseRef: "v2026.5.1",
|
||||
counts,
|
||||
});
|
||||
expect(summary).toContain("- npm advisory vulnerability hard blockers: 1");
|
||||
expect(summary).toContain("- Transitive manifest reported risk signals: 17");
|
||||
expect(summary).toContain("- Dependency change baseline: `v2026.5.1`");
|
||||
expect(summary).toContain("- Resolved package changes: +5 -6 changed 7");
|
||||
|
||||
const summary = renderDependencyEvidenceSummary({
|
||||
releaseTag: "v2026.5.13",
|
||||
releaseSha: "abc123",
|
||||
baseRef: "v2026.5.1",
|
||||
counts,
|
||||
});
|
||||
expect(summary).toContain("- npm advisory vulnerability hard blockers: 1");
|
||||
expect(summary).toContain("- Transitive manifest reported risk signals: 17");
|
||||
expect(summary).toContain("- Dependency change baseline: `v2026.5.1`");
|
||||
expect(summary).toContain("- Resolved package changes: +5 -6 changed 7");
|
||||
const stepSummary = renderDependencyEvidenceStepSummary({
|
||||
evidenceArtifactName: "openclaw-release-dependency-evidence-v2026.5.13",
|
||||
baseRef: "v2026.5.1",
|
||||
counts,
|
||||
});
|
||||
expect(stepSummary).toContain(
|
||||
"- Evidence artifact: `openclaw-release-dependency-evidence-v2026.5.13`",
|
||||
);
|
||||
expect(stepSummary).toContain("- npm advisory vulnerability hard blockers: `1`");
|
||||
|
||||
const stepSummary = renderDependencyEvidenceStepSummary({
|
||||
evidenceArtifactName: "openclaw-release-dependency-evidence-v2026.5.13",
|
||||
baseRef: "v2026.5.1",
|
||||
counts,
|
||||
});
|
||||
expect(stepSummary).toContain(
|
||||
"- Evidence artifact: `openclaw-release-dependency-evidence-v2026.5.13`",
|
||||
);
|
||||
expect(stepSummary).toContain("- npm advisory vulnerability hard blockers: `1`");
|
||||
|
||||
await expect(
|
||||
readFile(path.join(dir, "dependency-vulnerability-gate.json"), "utf8"),
|
||||
).resolves.toContain("GHSA-blocker");
|
||||
await expect(
|
||||
readFile(path.join(dir, "dependency-vulnerability-gate.json"), "utf8"),
|
||||
).resolves.toContain("GHSA-blocker");
|
||||
} finally {
|
||||
await rm(dir, { force: true, recursive: true });
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user