test: reorganize suite into unit/integration/canaries directories

Replace the hand-maintained INTEGRATION_NAMES classifier (and the bespoke run_tests.py around it) with a directory-driven split: tests/unit/ unit tests, always run tests/integration/ Docker-dependent, skip cleanly without Docker tests/canaries/ upstream-regression checks, opt-in via CLAUDE_BOTTLE_RUN_CANARIES=1 The pinned-pipelock-image check moves to the canary suite — it tests upstream packaging, not our code, so it shouldn't gate every dev push. A scheduled canaries.yml workflow runs it weekly. The manifest-runtime tests collapse the four assertRaises cases for distinct 'runtime' values into one subTest loop and drop the error-message-wording assertions; the contract is "any value is rejected", not "the error literally contains 'auto-detect'". Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 16:23:02 -04:00
parent 83fe5741f5
commit 4462863d56
16 changed files with 157 additions and 207 deletions
@@ -0,0 +1,82 @@
+"""Unit: PipelockProxy.prepare — produces a pipelock YAML config
+containing the expected top-level keys and per-bottle entries. We
+don't fully parse YAML; we grep for content shape."""
+
+import os
+import tempfile
+import unittest
+from pathlib import Path
+
+from claude_bottle.backend.docker.pipelock import DockerPipelockProxy
+from claude_bottle.manifest import Manifest
+from tests.fixtures import fixture_minimal, fixture_with_ssh
+
+
+class TestPipelockProxyPrepare(unittest.TestCase):
+    def setUp(self):
+        self.out_dir = Path(tempfile.mkdtemp())
+        self.proxy = DockerPipelockProxy()
+
+    def tearDown(self):
+        import shutil
+        shutil.rmtree(self.out_dir, ignore_errors=True)
+
+    def test_minimal(self):
+        yaml_path = self.out_dir / "min.yaml"
+        self.proxy.prepare(fixture_minimal().bottles["dev"], "demo", yaml_path)
+        content = yaml_path.read_text()
+        self.assertIn("mode: strict", content)
+        self.assertIn("enforce: true", content)
+        self.assertIn("api_allowlist:", content)
+        self.assertIn("api.anthropic.com", content)
+        self.assertIn("raw.githubusercontent.com", content)
+        self.assertIn("forward_proxy:", content)
+        self.assertIn("enabled: true", content)
+        self.assertIn("dlp:", content)
+        self.assertIn("include_defaults: true", content)
+        self.assertIn("scan_env: true", content)
+        # No ssh entries → no trusted_domains nor ssrf block.
+        self.assertNotIn("trusted_domains:", content)
+        self.assertNotIn("ssrf:", content)
+
+    def test_ssh_blocks(self):
+        yaml_path = self.out_dir / "ssh.yaml"
+        self.proxy.prepare(fixture_with_ssh().bottles["dev"], "demo", yaml_path)
+        content = yaml_path.read_text()
+        self.assertIn("trusted_domains:", content)
+        self.assertIn("github.com", content)
+        self.assertIn("ssrf:", content)
+        self.assertIn("ip_allowlist:", content)
+        self.assertIn("100.78.141.42/32", content)
+        # ipv4 host should also be in api_allowlist (strict mode requires both).
+        self.assertIn("100.78.141.42", content)
+
+    def test_secret_hygiene(self):
+        manifest = Manifest.from_json_obj({
+            "bottles": {
+                "dev": {
+                    "env": {
+                        "MY_SECRET": "literal-value-should-not-appear",
+                        "ANOTHER": "?prompt-message",
+                    },
+                    "egress": {"allowlist": ["github.com"]},
+                }
+            },
+            "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+        })
+        yaml_path = self.out_dir / "secret.yaml"
+        self.proxy.prepare(manifest.bottles["dev"], "demo", yaml_path)
+        content = yaml_path.read_text()
+        self.assertNotIn("literal-value-should-not-appear", content)
+        self.assertNotIn("MY_SECRET", content)
+        self.assertNotIn("prompt-message", content)
+
+    def test_file_mode_is_600(self):
+        yaml_path = self.out_dir / "min.yaml"
+        self.proxy.prepare(fixture_minimal().bottles["dev"], "demo", yaml_path)
+        mode = os.stat(yaml_path).st_mode & 0o777
+        self.assertEqual(0o600, mode)
+
+
+if __name__ == "__main__":
+    unittest.main()