|
| 1 | +#!/usr/bin/env bash |
| 2 | +# tests/hooks/test-mechanical-amend-bypass.sh |
| 3 | +# Behavioral tests for DSO_MECHANICAL_AMEND bypass in pre-commit hooks. |
| 4 | +# |
| 5 | +# Validates that: |
| 6 | +# 1. pre-commit-review-gate.sh exits 0 when DSO_MECHANICAL_AMEND=1 |
| 7 | +# 2. pre-commit-test-gate.sh exits 0 when DSO_MECHANICAL_AMEND=1 |
| 8 | +# 3. merge-to-main.sh sets DSO_MECHANICAL_AMEND=1 before git commit --amend |
| 9 | +# 4. review-gate-bypass-sentinel.sh blocks DSO_MECHANICAL_AMEND on non-amend commits |
| 10 | +# |
| 11 | +# Usage: bash tests/hooks/test-mechanical-amend-bypass.sh |
| 12 | + |
| 13 | +set -uo pipefail |
| 14 | + |
| 15 | +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" |
| 16 | +REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)" |
| 17 | +DSO_PLUGIN_DIR="$REPO_ROOT/plugins/dso" |
| 18 | +REVIEW_GATE="$DSO_PLUGIN_DIR/hooks/pre-commit-review-gate.sh" |
| 19 | +TEST_GATE="$DSO_PLUGIN_DIR/hooks/pre-commit-test-gate.sh" |
| 20 | +MERGE_SCRIPT="$DSO_PLUGIN_DIR/scripts/merge-to-main.sh" |
| 21 | +SENTINEL_LIB="$DSO_PLUGIN_DIR/hooks/lib/review-gate-bypass-sentinel.sh" |
| 22 | + |
| 23 | +source "$REPO_ROOT/tests/lib/assert.sh" |
| 24 | + |
| 25 | +# ============================================================================= |
| 26 | +# Helper: extract function body from a script file |
| 27 | +# ============================================================================= |
| 28 | +_extract_fn() { |
| 29 | + local fn_name="$1" script="$2" |
| 30 | + awk "/^${fn_name}\\(\\)/{found=1} found{print; if(/^\\}$/){exit}}" "$script" |
| 31 | +} |
| 32 | + |
| 33 | +# ============================================================================= |
| 34 | +# Test 1: pre-commit-review-gate.sh checks DSO_MECHANICAL_AMEND |
| 35 | +# The review gate script must contain a check for DSO_MECHANICAL_AMEND that |
| 36 | +# exits 0 early. This is a structural test — the actual hook runs in a git |
| 37 | +# pre-commit context which is hard to simulate. |
| 38 | +# ============================================================================= |
| 39 | +echo "" |
| 40 | +echo "--- test_review_gate_has_mechanical_amend_check ---" |
| 41 | +_snapshot_fail |
| 42 | + |
| 43 | +_RG_HAS_CHECK="not_found" |
| 44 | +grep -q 'DSO_MECHANICAL_AMEND' "$REVIEW_GATE" 2>/dev/null && _RG_HAS_CHECK="found" |
| 45 | +assert_eq "test_review_gate_has_mechanical_amend_check" "found" "$_RG_HAS_CHECK" |
| 46 | + |
| 47 | +assert_pass_if_clean "test_review_gate_has_mechanical_amend_check" |
| 48 | + |
| 49 | +# ============================================================================= |
| 50 | +# Test 2: pre-commit-test-gate.sh checks DSO_MECHANICAL_AMEND |
| 51 | +# The test gate script must contain a check for DSO_MECHANICAL_AMEND that |
| 52 | +# exits 0 early. |
| 53 | +# ============================================================================= |
| 54 | +echo "" |
| 55 | +echo "--- test_test_gate_has_mechanical_amend_check ---" |
| 56 | +_snapshot_fail |
| 57 | + |
| 58 | +_TG_HAS_CHECK="not_found" |
| 59 | +grep -q 'DSO_MECHANICAL_AMEND' "$TEST_GATE" 2>/dev/null && _TG_HAS_CHECK="found" |
| 60 | +assert_eq "test_test_gate_has_mechanical_amend_check" "found" "$_TG_HAS_CHECK" |
| 61 | + |
| 62 | +assert_pass_if_clean "test_test_gate_has_mechanical_amend_check" |
| 63 | + |
| 64 | +# ============================================================================= |
| 65 | +# Test 3: merge-to-main.sh _phase_version_bump sets DSO_MECHANICAL_AMEND=1 |
| 66 | +# The version bump phase must export DSO_MECHANICAL_AMEND=1 before git commit |
| 67 | +# --amend and unset it after. |
| 68 | +# ============================================================================= |
| 69 | +echo "" |
| 70 | +echo "--- test_version_bump_sets_mechanical_amend ---" |
| 71 | +_snapshot_fail |
| 72 | + |
| 73 | +_VB_FN=$(_extract_fn "_phase_version_bump" "$MERGE_SCRIPT" 2>/dev/null || echo "") |
| 74 | +_VB_HAS_AMEND_VAR="not_found" |
| 75 | +echo "$_VB_FN" | grep -q 'DSO_MECHANICAL_AMEND' 2>/dev/null && _VB_HAS_AMEND_VAR="found" |
| 76 | +assert_eq "test_version_bump_sets_mechanical_amend" "found" "$_VB_HAS_AMEND_VAR" |
| 77 | + |
| 78 | +assert_pass_if_clean "test_version_bump_sets_mechanical_amend" |
| 79 | + |
| 80 | +# ============================================================================= |
| 81 | +# Test 4: merge-to-main.sh _phase_validate sets DSO_MECHANICAL_AMEND=1 |
| 82 | +# The validate phase also uses git commit --amend and must set the var. |
| 83 | +# ============================================================================= |
| 84 | +echo "" |
| 85 | +echo "--- test_validate_phase_sets_mechanical_amend ---" |
| 86 | +_snapshot_fail |
| 87 | + |
| 88 | +_VAL_FN=$(_extract_fn "_phase_validate" "$MERGE_SCRIPT" 2>/dev/null || echo "") |
| 89 | +_VAL_HAS_AMEND_VAR="not_found" |
| 90 | +echo "$_VAL_FN" | grep -q 'DSO_MECHANICAL_AMEND' 2>/dev/null && _VAL_HAS_AMEND_VAR="found" |
| 91 | +assert_eq "test_validate_phase_sets_mechanical_amend" "found" "$_VAL_HAS_AMEND_VAR" |
| 92 | + |
| 93 | +assert_pass_if_clean "test_validate_phase_sets_mechanical_amend" |
| 94 | + |
| 95 | +# ============================================================================= |
| 96 | +# Test 5: review gate exits 0 early when DSO_MECHANICAL_AMEND=1 |
| 97 | +# The check must be an early exit (exit 0) not just a variable reference. |
| 98 | +# Look for the pattern: DSO_MECHANICAL_AMEND followed by exit 0 within ~3 lines. |
| 99 | +# ============================================================================= |
| 100 | +echo "" |
| 101 | +echo "--- test_review_gate_exits_early_on_mechanical_amend ---" |
| 102 | +_snapshot_fail |
| 103 | + |
| 104 | +# Check that the script has an exit 0 associated with DSO_MECHANICAL_AMEND |
| 105 | +_RG_EXIT_PATTERN=$(awk '/DSO_MECHANICAL_AMEND/{found=1} found && /exit 0/{print "yes"; exit}' "$REVIEW_GATE" 2>/dev/null || echo "") |
| 106 | +assert_eq "test_review_gate_exits_early_on_mechanical_amend" "yes" "$_RG_EXIT_PATTERN" |
| 107 | + |
| 108 | +assert_pass_if_clean "test_review_gate_exits_early_on_mechanical_amend" |
| 109 | + |
| 110 | +# ============================================================================= |
| 111 | +# Test 6: test gate exits 0 early when DSO_MECHANICAL_AMEND=1 |
| 112 | +# Same pattern as test 5 but for the test gate. |
| 113 | +# ============================================================================= |
| 114 | +echo "" |
| 115 | +echo "--- test_test_gate_exits_early_on_mechanical_amend ---" |
| 116 | +_snapshot_fail |
| 117 | + |
| 118 | +_TG_EXIT_PATTERN=$(awk '/DSO_MECHANICAL_AMEND/{found=1} found && /exit 0/{print "yes"; exit}' "$TEST_GATE" 2>/dev/null || echo "") |
| 119 | +assert_eq "test_test_gate_exits_early_on_mechanical_amend" "yes" "$_TG_EXIT_PATTERN" |
| 120 | + |
| 121 | +assert_pass_if_clean "test_test_gate_exits_early_on_mechanical_amend" |
| 122 | + |
| 123 | +# ============================================================================= |
| 124 | +# Test 7: bypass sentinel blocks DSO_MECHANICAL_AMEND on non-amend commits |
| 125 | +# Layer 2 must detect DSO_MECHANICAL_AMEND=1 on raw "git commit" (without |
| 126 | +# --amend) and block it. This prevents misuse of the env var to bypass gates |
| 127 | +# on normal commits. |
| 128 | +# ============================================================================= |
| 129 | +echo "" |
| 130 | +echo "--- test_sentinel_blocks_mechanical_amend_on_raw_commit ---" |
| 131 | +_snapshot_fail |
| 132 | + |
| 133 | +_SENT_HAS_CHECK="not_found" |
| 134 | +grep -q 'DSO_MECHANICAL_AMEND' "$SENTINEL_LIB" 2>/dev/null && _SENT_HAS_CHECK="found" |
| 135 | +assert_eq "test_sentinel_has_mechanical_amend_check" "found" "$_SENT_HAS_CHECK" |
| 136 | + |
| 137 | +# Functionally test: source the sentinel and call with a raw git commit that |
| 138 | +# has DSO_MECHANICAL_AMEND=1 as an inline prefix in the command string. |
| 139 | +# NOTE: The sentinel is a PreToolUse hook running in Claude Code's process, NOT |
| 140 | +# a child of the git subprocess. The env var must be detected in the command |
| 141 | +# string — exporting it to the test subshell would test the wrong execution model. |
| 142 | +_SENT_RC=0 |
| 143 | +( |
| 144 | + source "$SENTINEL_LIB" 2>/dev/null |
| 145 | + # Simulate "DSO_MECHANICAL_AMEND=1 git commit -m test" (non-amend) — sentinel should block |
| 146 | + _INPUT='{"tool_name":"Bash","tool_input":{"command":"DSO_MECHANICAL_AMEND=1 git commit -m test"}}' |
| 147 | + hook_review_bypass_sentinel "$_INPUT" 2>/dev/null |
| 148 | +) || _SENT_RC=$? |
| 149 | + |
| 150 | +assert_eq "test_sentinel_blocks_mechanical_amend_on_raw_commit" "2" "$_SENT_RC" |
| 151 | + |
| 152 | +assert_pass_if_clean "test_sentinel_blocks_mechanical_amend_on_raw_commit" |
| 153 | + |
| 154 | +# ============================================================================= |
| 155 | +# Test 8: bypass sentinel allows DSO_MECHANICAL_AMEND on --amend --no-edit |
| 156 | +# Layer 2 must allow the env var when the command is specifically |
| 157 | +# "git commit --amend --no-edit" (the pattern used by merge-to-main.sh). |
| 158 | +# ============================================================================= |
| 159 | +echo "" |
| 160 | +echo "--- test_sentinel_allows_mechanical_amend_on_amend_noedit ---" |
| 161 | +_snapshot_fail |
| 162 | + |
| 163 | +_SENT_ALLOW_RC=0 |
| 164 | +( |
| 165 | + source "$SENTINEL_LIB" 2>/dev/null |
| 166 | + # Simulate "DSO_MECHANICAL_AMEND=1 git commit --amend --no-edit --quiet" — sentinel should allow |
| 167 | + # The env var is in the command string (inline prefix), not exported to the environment, |
| 168 | + # matching the actual runtime model where the sentinel is a PreToolUse hook process. |
| 169 | + _INPUT='{"tool_name":"Bash","tool_input":{"command":"DSO_MECHANICAL_AMEND=1 git commit --amend --no-edit --quiet"}}' |
| 170 | + hook_review_bypass_sentinel "$_INPUT" 2>/dev/null |
| 171 | +) || _SENT_ALLOW_RC=$? |
| 172 | + |
| 173 | +assert_eq "test_sentinel_allows_mechanical_amend_on_amend_noedit" "0" "$_SENT_ALLOW_RC" |
| 174 | + |
| 175 | +assert_pass_if_clean "test_sentinel_allows_mechanical_amend_on_amend_noedit" |
| 176 | + |
| 177 | +# ============================================================================= |
| 178 | +print_summary |
0 commit comments