|
| 1 | +import { assertEquals } from '@std/assert'; |
| 2 | +import { |
| 3 | + classifyTrackedBinary, |
| 4 | + credentialFileFailure, |
| 5 | + isActiveScanFile, |
| 6 | + isAllowedRemovedPackageMention, |
| 7 | + isAllowedTrackedIgnored, |
| 8 | + isForbiddenRootTracked, |
| 9 | + isForbiddenUntrackedResidue, |
| 10 | + LARGE_BINARY_LIMIT_BYTES, |
| 11 | +} from './check-repo-hygiene.ts'; |
| 12 | + |
| 13 | +// M15 (#1230): the hygiene gate's allow/deny classification is decision logic |
| 14 | +// that can turn a failure into a success (a too-broad template carve-out or |
| 15 | +// allowlist silently greens a tracked credential or binary). Pin it. |
| 16 | + |
| 17 | +Deno.test('hygiene: tracked credential files fail, placeholder templates pass', () => { |
| 18 | + // Real credentials are always failures. |
| 19 | + assertEquals(typeof credentialFileFailure('.env'), 'string'); |
| 20 | + assertEquals(typeof credentialFileFailure('packages/app/.env'), 'string'); |
| 21 | + assertEquals(typeof credentialFileFailure('.env.production'), 'string'); |
| 22 | + assertEquals(typeof credentialFileFailure('certs/server.pem'), 'string'); |
| 23 | + assertEquals(typeof credentialFileFailure('.ssh/id_rsa'), 'string'); |
| 24 | + assertEquals(typeof credentialFileFailure('id_rsa.pub'), 'string'); |
| 25 | + // The template carve-out is exact: only .env.example/.sample/.template. |
| 26 | + assertEquals(credentialFileFailure('.env.example'), undefined); |
| 27 | + assertEquals(credentialFileFailure('examples/x/.env.sample'), undefined); |
| 28 | + assertEquals(credentialFileFailure('.env.template'), undefined); |
| 29 | + // Non-credentials pass. |
| 30 | + assertEquals(credentialFileFailure('README.md'), undefined); |
| 31 | + assertEquals(credentialFileFailure('tools/environment.ts'), undefined); |
| 32 | +}); |
| 33 | + |
| 34 | +Deno.test('hygiene: large tracked binaries fail outside the allowed asset dirs', () => { |
| 35 | + const over = LARGE_BINARY_LIMIT_BYTES + 1; |
| 36 | + // Over-limit binaries are failures outside the allowlist... |
| 37 | + assertEquals(typeof classifyTrackedBinary('packages/element/logo.png', over), 'string'); |
| 38 | + // ...and allowed in the intentional asset directories. |
| 39 | + assertEquals(classifyTrackedBinary('www/design/mockups/home.png', over), undefined); |
| 40 | + assertEquals( |
| 41 | + classifyTrackedBinary('www/e2e/visual-baselines.spec.ts-snapshots/home.png', over), |
| 42 | + undefined, |
| 43 | + ); |
| 44 | + assertEquals(classifyTrackedBinary('examples/x/fixtures/banner.mp4', over), undefined); |
| 45 | + assertEquals(classifyTrackedBinary('www/public/assets/dragon-hero.mp4', over), undefined); |
| 46 | + // Under the limit or non-binary extensions are not this check's concern. |
| 47 | + assertEquals(classifyTrackedBinary('packages/element/logo.png', 1024), undefined); |
| 48 | + assertEquals(classifyTrackedBinary('packages/element/big.ts', over), undefined); |
| 49 | +}); |
| 50 | + |
| 51 | +Deno.test('hygiene: root generated artifacts are tracked-file failures, nested ones are not', () => { |
| 52 | + assertEquals(isForbiddenRootTracked('dist/server/index.js'), true); |
| 53 | + assertEquals(isForbiddenRootTracked('playwright-report/index.html'), true); |
| 54 | + assertEquals(isForbiddenRootTracked('debug.log'), true); |
| 55 | + // Anchored at the repo root: package-level build output is gitignored, not |
| 56 | + // this tripwire's concern. |
| 57 | + assertEquals(isForbiddenRootTracked('packages/element/dist/mod.js'), false); |
| 58 | + assertEquals(isForbiddenRootTracked('packages/element/src/mod.ts'), false); |
| 59 | +}); |
| 60 | + |
| 61 | +Deno.test('hygiene: untracked workflow residue fails, other untracked files pass', () => { |
| 62 | + assertEquals(isForbiddenUntrackedResidue('.github/workflows/debug.yml'), true); |
| 63 | + assertEquals(isForbiddenUntrackedResidue('hub-submission.json'), true); |
| 64 | + assertEquals(isForbiddenUntrackedResidue('notes.md'), false); |
| 65 | +}); |
| 66 | + |
| 67 | +Deno.test('hygiene: only vendored license attributions may be tracked-and-ignored', () => { |
| 68 | + assertEquals(isAllowedTrackedIgnored('vendor/jsr.io/@std/fs/LICENSE'), true); |
| 69 | + assertEquals(isAllowedTrackedIgnored('vendor/jsr.io/std/LICENSE'), true); |
| 70 | + assertEquals(isAllowedTrackedIgnored('vendor/jsr.io/@std/fs/mod.ts'), false); |
| 71 | +}); |
| 72 | + |
| 73 | +Deno.test('hygiene: removed-package mention scan covers active roots only', () => { |
| 74 | + assertEquals(isActiveScanFile('deno.json'), true); |
| 75 | + assertEquals(isActiveScanFile('packages/element/src/mod.ts'), true); |
| 76 | + assertEquals(isActiveScanFile('tools/check-repo-hygiene.ts'), true); |
| 77 | + // docs/audit, docs/release and other historical trees are not scanned. |
| 78 | + assertEquals(isActiveScanFile('docs/audit/2026-01-01-x.md'), false); |
| 79 | + assertEquals(isActiveScanFile('packages/element/README.png'), false); |
| 80 | + // The allowlist is exact-path, not substring. |
| 81 | + assertEquals(isAllowedRemovedPackageMention('tools/check-repo-hygiene.ts'), true); |
| 82 | + assertEquals(isAllowedRemovedPackageMention('tools/check-repo-hygiene-extra.ts'), false); |
| 83 | +}); |
0 commit comments