test_quality_gate_all_scope.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_git/test_quality_gate_all_scope.py
 
"""
Purpose
-------
OI-505 regression coverage — at ``scope="all"`` the quality gate must see
non-Python files whose filename matches
``oct.core.exclusions.NEVER_EXPORT_FILE_PATTERNS`` (e.g. ``.env``,
``*.pem``, ``credentials.json``) so the filename-pattern secrets rule
can flag them. Before this fix ``_resolve_scope`` only returned
``.py`` files at ``scope="all"``, leaving those sensitive files invisible.
 
Responsibilities
----------------
- Verify ``scope="all"`` includes ``.env`` and other sensitive-filename
  patterns in secrets scanning.
- Verify nested sensitive files below root are detected.
- Verify excluded directories (``.venv``, ``__pycache__``) are still
  pruned.
 
Diagnostics
-----------
Domain: GIT-TESTS
Levels:
    L2 — test lifecycle
    L3 — assertion details
    L4 — deep tracing
 
Contracts
---------
- A scaffolded project with a ``.env`` in its root must produce at
  least one ``secrets_findings`` entry when run with ``scope="all"``.
- ``scope="all"`` must not miss files that live below the root (e.g.
  ``config/.env``).
- Excluded directories (``.venv`` / ``__pycache__``) must still be
  pruned — a secret-named file inside them must not surface.
"""
 
from __future__ import annotations
 
from pathlib import Path
 
import pytest
 
from oct.git.quality_gate import (
    _resolve_scope,
    _run_secrets_pass,
    _walk_secret_filenames,
)
 
 
def _make_project(root: Path) -> None:
    """Create the minimal skeleton the quality gate expects."""
    (root / "oc_diagnostics").mkdir()
    (root / "tests").mkdir()
    (root / "docs").mkdir()
    (root / ".octrc.json").write_text('{"root_marker": true}', encoding="utf-8")
    (root / "src").mkdir()
    (root / "src" / "app.py").write_text(
        "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n"
        "# src/app.py\n\n\"\"\"Module.\"\"\"\n\n",
        encoding="utf-8",
    )
 
 
def test_resolve_all_scope_includes_env_file(tmp_path: Path):
    """OI-505: a root-level ``.env`` is returned by ``_resolve_scope('all')``."""
    _make_project(tmp_path)
    (tmp_path / ".env").write_text("SECRET=abc\n", encoding="utf-8")
 
    files = _resolve_scope(tmp_path, "all")
    names = {f.name for f in files}
    assert ".env" in names, f".env missing from scope result: {names}"
 
 
def test_resolve_all_scope_includes_nested_pem(tmp_path: Path):
    """OI-505: a nested ``*.pem`` file is captured too."""
    _make_project(tmp_path)
    (tmp_path / "config").mkdir()
    (tmp_path / "config" / "server.pem").write_text("-----KEY-----\n", encoding="utf-8")
 
    files = _resolve_scope(tmp_path, "all")
    names = {f.name for f in files}
    assert "server.pem" in names, f"server.pem missing: {names}"
 
 
def test_resolve_all_scope_prunes_excluded_dirs(tmp_path: Path):
    """OI-505: a ``.env`` inside ``.venv`` or ``__pycache__`` is ignored."""
    _make_project(tmp_path)
    (tmp_path / ".venv").mkdir()
    (tmp_path / ".venv" / ".env").write_text("IGNORE=1\n", encoding="utf-8")
    (tmp_path / "__pycache__").mkdir()
    (tmp_path / "__pycache__" / "credentials.json").write_text("{}", encoding="utf-8")
 
    files = _resolve_scope(tmp_path, "all")
    for f in files:
        rel = f.relative_to(tmp_path).as_posix()
        assert not rel.startswith(".venv/"), rel
        assert not rel.startswith("__pycache__/"), rel
 
 
def test_secrets_pass_flags_env_file(tmp_path: Path):
    """OI-505: end-to-end — secrets pass reports the ``.env`` finding."""
    _make_project(tmp_path)
    (tmp_path / ".env").write_text("TOKEN=abc\n", encoding="utf-8")
 
    files = _resolve_scope(tmp_path, "all")
    findings = _run_secrets_pass(files, tmp_path)
    assert any(rel == ".env" for rel, _line, _msg in findings), findings