test_git_check.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_git/test_git_check.py
 
"""
Purpose
-------
Integration tests for ``oct git check`` (Phase 4B / G-B3).
Validates all six exit codes, the profile matrix, ``--fix`` round-trip,
``--staged-only`` / ``--all`` scope, protected-branch override,
audit trail, and AI-Trace emission.
 
Responsibilities
----------------
- One test per exit code (0 through 5).
- "Secrets override" test: lint + secret → exit code 5, not 1.
- Profile matrix: ``proto``/``compact``/``strict`` × violation type.
- ``--fix`` auto-fix then re-verify.
- ``--fix`` cannot bypass secrets.
- Protected-branch override forces ``strict`` despite ``--profile proto``.
- Audit row written to ``logs/git-audit-*.jsonl`` after every run.
 
Diagnostics
-----------
Domain: GIT-TESTS
Levels:
    L2 — test lifecycle
    L3 — assertion details
    L4 — deep tracing
 
Contracts
---------
- Every test uses ``temp_git_project`` (real git repo on branch ``main``
  by default).
- Tests that need a non-protected branch create one explicitly.
"""
 
import json
import subprocess
import sys
from pathlib import Path
 
import pytest
 
from tests.tests_git.conftest import _git, commit_file
 
 
# =====================================================================
# Helpers
# =====================================================================
 
 
def _run_check(
    root: Path, *extra_args: str,
) -> subprocess.CompletedProcess:
    """Run ``oct git check`` in a subprocess and return the result."""
    return subprocess.run(
        [sys.executable, "-m", "oct.cli", "git", "check", *extra_args],
        cwd=root,
        capture_output=True,
        text=True,
    )
 
 
def _run_check_json(root: Path, *extra_args: str) -> dict:
    """Run ``oct git check --json`` and return the parsed output."""
    result = _run_check(root, "--json", *extra_args)
    return json.loads(result.stdout)
 
 
def _switch_to_feature_branch(root: Path, branch: str = "feature/test"):
    """Create and switch to a non-protected branch."""
    _git(root, "checkout", "-b", branch)
 
 
def _latest_audit_record(root: Path) -> dict | None:
    """Read the last JSONL record from the newest audit file."""
    logs_dir = root / "logs"
    files = sorted(logs_dir.glob("git-audit-*.jsonl"))
    if not files:
        return None
    lines = files[-1].read_text(encoding="utf-8").strip().splitlines()
    if not lines:
        return None
    return json.loads(lines[-1])
 
 
# =====================================================================
# Tests: Exit codes
# =====================================================================
 
 
class TestExitCodes:
    """One test per exit code defined in blueprint §5.3."""
 
    def test_exit_0_all_pass(self, temp_git_project, make_compliant_py):
        """Clean file on a non-protected branch → exit 0."""
        _switch_to_feature_branch(temp_git_project)
        make_compliant_py("src/clean.py")
        _git(temp_git_project, "add", "src/clean.py")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        assert data["exit_code"] == 0
        assert data["lint_violations"] == 0
        assert data["format_violations"] == 0
        assert data["secrets_findings"] == []
 
    def test_exit_1_or_3_lint_violation(
        self, temp_git_project, make_noncompliant_py
    ):
        """Lint violation (missing header) → exit 1 (lint) or 3 (lint+format).
 
        A missing-header file typically fails both lint and format checks
        since the formatter also validates the header path. Exit code is
        1 (lint only) or 3 (lint + format) depending on the file.
        """
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        assert data["exit_code"] in (1, 3)
        assert data["lint_violations"] > 0
 
    def test_exit_2_format_only(self, temp_git_project, make_noncompliant_py):
        """Format violation (wrong path in header) → exit includes format.
 
        Note: a format violation also implies a lint violation for the
        header check, so the actual exit code will be 3 (lint + format).
        This test seeds a format-error file and asserts exit code >= 2.
        """
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/fmterr.py", "format_error")
        _git(temp_git_project, "add", "src/fmterr.py")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        assert data["exit_code"] in (2, 3)  # format or lint+format
        assert data["format_violations"] > 0
 
    def test_exit_3_lint_and_format(
        self, temp_git_project, make_noncompliant_py
    ):
        """Both lint and format violations → exit 3."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/both.py", "format_error")
        _git(temp_git_project, "add", "src/both.py")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        # format_error has wrong header path → lint fail + format fail.
        assert data["lint_violations"] > 0
        assert data["format_violations"] > 0
        assert data["exit_code"] == 3
 
    def test_exit_5_secrets(self, temp_git_project, make_noncompliant_py):
        """Hardcoded secret → exit 5 (always blocking)."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        assert data["exit_code"] == 5
        assert len(data["secrets_findings"]) > 0
 
    def test_exit_5_filename_pattern(self, temp_git_project):
        """A ``.env`` file in staging → exit 5 (filename pattern)."""
        _switch_to_feature_branch(temp_git_project)
        (temp_git_project / ".env").write_text(
            "SECRET_KEY=abc123\n", encoding="utf-8",
        )
        _git(temp_git_project, "add", ".env")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        assert data["exit_code"] == 5
        findings = data["secrets_findings"]
        assert any("secret file pattern" in f["reason"] for f in findings)
 
 
# =====================================================================
# Tests: Secrets override (5 beats everything)
# =====================================================================
 
 
class TestSecretsOverride:
    def test_secrets_overrides_lint(
        self, temp_git_project, make_noncompliant_py
    ):
        """Lint violation + secret → exit 5, not 1."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/bad_lint.py", "missing_header")
        make_noncompliant_py("src/has_secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "-A")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        assert data["exit_code"] == 5
 
 
# =====================================================================
# Tests: Profile matrix
# =====================================================================
 
 
class TestProfileMatrix:
    """Verify enforcement per profile.
 
    On a non-protected branch, the CLI --profile flag controls
    which checks block.
    """
 
    def test_proto_lint_does_not_block(
        self, temp_git_project, make_noncompliant_py
    ):
        """Proto: lint is warn-only → exit 0 despite violations."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--profile", "proto",
        )
        # Proto: lint=warn, format=skip, secrets=blocking.
        # Missing header is a lint violation but not blocking under proto.
        assert data["exit_code"] == 0
        assert data["profile"] == "proto"
 
    def test_proto_secrets_still_blocks(
        self, temp_git_project, make_noncompliant_py
    ):
        """Proto: secrets are ALWAYS blocking → exit 5."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--profile", "proto",
        )
        assert data["exit_code"] == 5
 
    def test_compact_lint_blocks(
        self, temp_git_project, make_noncompliant_py
    ):
        """Compact: lint is blocking → exit 1."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--profile", "compact",
        )
        assert data["exit_code"] in (1, 3)  # lint or lint+format
        assert data["lint_violations"] > 0
 
    def test_strict_everything_blocks(
        self, temp_git_project, make_noncompliant_py
    ):
        """Strict: all checks blocking."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--profile", "strict",
        )
        assert data["exit_code"] in (1, 3)  # lint or lint+format
        assert data["lint_violations"] > 0
 
 
# =====================================================================
# Tests: Scope
# =====================================================================
 
 
class TestScope:
    def test_staged_only(self, temp_git_project, make_compliant_py):
        """--staged-only checks only the index, not unstaged changes."""
        _switch_to_feature_branch(temp_git_project)
        # Stage a clean file.
        path = make_compliant_py("src/staged.py")
        _git(temp_git_project, "add", "src/staged.py")
 
        # Write a dirty (noncompliant) file but don't stage it.
        (temp_git_project / "src" / "dirty.py").write_text(
            "bad\n", encoding="utf-8",
        )
 
        data = _run_check_json(temp_git_project, "--staged-only")
        # Only staged.py checked (1 file), and it's clean.
        assert data["files_checked"] == 1
        assert data["exit_code"] == 0
 
    def test_all_checks_everything(self, temp_git_project, make_compliant_py):
        """--all checks every Python file in the project."""
        _switch_to_feature_branch(temp_git_project)
        make_compliant_py("src/a.py")
        make_compliant_py("src/b.py")
        commit_file(
            temp_git_project, "src/a.py",
            (temp_git_project / "src" / "a.py").read_text(encoding="utf-8"),
            "add a",
        )
        commit_file(
            temp_git_project, "src/b.py",
            (temp_git_project / "src" / "b.py").read_text(encoding="utf-8"),
            "add b",
        )
 
        data = _run_check_json(temp_git_project, "--all")
        assert data["files_checked"] >= 2
 
 
# =====================================================================
# Tests: --fix round-trip
# =====================================================================
 
 
class TestFix:
    def test_fix_resolves_header_violation(
        self, temp_git_project, make_noncompliant_py
    ):
        """--fix auto-fixes a header violation → re-verify exit 0."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/fixme.py", "missing_header")
        _git(temp_git_project, "add", "src/fixme.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--fix",
        )
        # After fix + re-verify, header should be repaired.
        # Exit code should improve (may still have other issues).
        # At minimum, the command should run without error.
        assert "exit_code" in data
 
    def test_fix_cannot_bypass_secrets(
        self, temp_git_project, make_noncompliant_py
    ):
        """--fix with a secret → still exit 5 (secrets never auto-fixed)."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--fix",
        )
        assert data["exit_code"] == 5
        assert len(data["secrets_findings"]) > 0
 
 
# =====================================================================
# Tests: Protected-branch override
# =====================================================================
 
 
class TestProtectedBranch:
    def test_main_forces_strict(self, temp_git_project, make_noncompliant_py):
        """On main, --profile proto is overridden to strict."""
        # temp_git_project is on 'main' by default (protected branch).
        make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--profile", "proto",
        )
        # Profile should be forced to strict.
        assert data["profile"] == "strict"
        # Lint violations should block (strict profile).
        assert data["exit_code"] in (1, 3)
 
    def test_feature_branch_respects_cli_profile(
        self, temp_git_project, make_noncompliant_py
    ):
        """On a feature branch, --profile proto is respected."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
 
        data = _run_check_json(
            temp_git_project, "--staged-only", "--profile", "proto",
        )
        assert data["profile"] == "proto"
        # Proto: lint is warn-only → exit 0.
        assert data["exit_code"] == 0
 
 
# =====================================================================
# Tests: Audit trail
# =====================================================================
 
 
class TestAuditTrail:
    def test_audit_row_written(self, temp_git_project, make_compliant_py):
        """Every oct git check run writes an audit JSONL row."""
        _switch_to_feature_branch(temp_git_project)
        make_compliant_py("src/a.py")
        _git(temp_git_project, "add", "src/a.py")
 
        _run_check(temp_git_project, "--staged-only")
 
        record = _latest_audit_record(temp_git_project)
        assert record is not None
        assert record["command"] == "oct git check"
        assert "exit_code" in record
        assert "timestamp" in record
        assert "branch" in record
 
    def test_audit_row_on_failure(
        self, temp_git_project, make_noncompliant_py
    ):
        """Audit row is written even when checks fail."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
 
        _run_check(temp_git_project, "--staged-only")
 
        record = _latest_audit_record(temp_git_project)
        assert record is not None
        assert record["checks_passed"] is False
        assert record["exit_code"] != 0
 
 
# =====================================================================
# Tests: JSON output schema
# =====================================================================
 
 
class TestJsonSchema:
    def test_json_has_required_fields(
        self, temp_git_project, make_compliant_py
    ):
        """JSON output contains all required fields."""
        _switch_to_feature_branch(temp_git_project)
        make_compliant_py("src/a.py")
        _git(temp_git_project, "add", "src/a.py")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        required = {
            "scope", "profile", "files_checked", "lint_violations",
            "format_violations", "secrets_findings", "test_failures",
            "exit_code", "duration_ms",
        }
        assert required.issubset(data.keys())
 
    def test_json_secrets_findings_schema(
        self, temp_git_project, make_noncompliant_py
    ):
        """Each secrets finding has path, line, and reason."""
        _switch_to_feature_branch(temp_git_project)
        make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
 
        data = _run_check_json(temp_git_project, "--staged-only")
        for finding in data["secrets_findings"]:
            assert "path" in finding
            assert "line" in finding
            assert "reason" in finding