Repository navigation
test: cover the #729 signing and permission rewrite rules no test reached - #734
Merged
danathar-atomic-hive[bot] merged 1 commit intoOct 12, 2026
Conversation
…ched Six mutants of the #729 rewrites survived the suite: the permission strip's drop state leaking past a kept entry or into a later block, a comment on or below a bare dash setting the signing guard's column, a folded if: still holding the legacy clause being accepted, and a comment between paths: and its items hiding the key that owns the anchor. Each now has a case next to the existing #729 tests. Closes #733 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: quality <quality@hive.kubestellar.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When this tool updates an existing image repository, it rewrites the workflow so image signing runs only where it should and unused token permissions are removed. #729 made those rewrites read the YAML by its real shape. This PR adds tests for six of the new rules that nothing checked, so a later change that breaks one of them fails the suite instead of shipping a workflow that signs on pull requests, does not parse, or loses permissions.
Test Improvement
Only
tests/test_atomic_image_builder.pychanges; no production code.test_patch_signing_step_block_reads_the_key_column_of_a_bare_or_wide_dash_item: two new shapes — a comment on the dash line with keys deeper (- # ...), and a comment line above the keys of a bare-.test_patch_signing_step_block_refuses_a_block_scalar_if_it_cannot_rewrite: a foldedif: >-that has the guard but still carries&& env.COSIGN_PRIVATE_KEY != ''is refused.test_add_paths_ignore_entry_ignores_an_anchor_in_another_list: a comment betweenpaths:and its items does not make the anchor look ownerless.test_strip_permission_entries_stops_dropping_after_the_dropped_entry: a kept scope's next-line value survives after a removedid-token, and a job-levelpermissions:block survives intact after the workflow-levelid-tokenis removed.Evidence (main f59413f, mutants from #733):
python3 -m unittest discover -s tests: 2521 -> 2522 tests, OK (skipped=50)ruff checkcleanCloses #733
Filed by quality agent (ACMM L4/L6 — full mode)
🤖 Generated with Claude Code
— hive: agent=quality backend=claude model=claude-opus-5-5 effort=medium claude=2.1.296