didericis
4462863d56
Replace the hand-maintained INTEGRATION_NAMES classifier (and the
bespoke run_tests.py around it) with a directory-driven split:
tests/unit/ unit tests, always run
tests/integration/ Docker-dependent, skip cleanly without Docker
tests/canaries/ upstream-regression checks, opt-in via
CLAUDE_BOTTLE_RUN_CANARIES=1
The pinned-pipelock-image check moves to the canary suite — it tests
upstream packaging, not our code, so it shouldn't gate every dev push.
A scheduled canaries.yml workflow runs it weekly.
The manifest-runtime tests collapse the four assertRaises cases for
distinct 'runtime' values into one subTest loop and drop the
error-message-wording assertions; the contract is "any value is
rejected", not "the error literally contains 'auto-detect'".
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
83 lines
3.1 KiB
Python
83 lines
3.1 KiB
Python
"""Unit: allowlist resolution — pipelock_bottle_allowlist,
|
|
pipelock_bottle_ssh_hostnames, pipelock_bottle_ssh_ip_cidrs,
|
|
pipelock_bottle_ssh_trusted_domains, pipelock_effective_allowlist."""
|
|
|
|
import unittest
|
|
|
|
from claude_bottle.log import Die
|
|
from claude_bottle.manifest import Manifest
|
|
from claude_bottle.pipelock import (
|
|
pipelock_bottle_allowlist,
|
|
pipelock_bottle_ssh_hostnames,
|
|
pipelock_bottle_ssh_ip_cidrs,
|
|
pipelock_bottle_ssh_trusted_domains,
|
|
pipelock_effective_allowlist,
|
|
)
|
|
from tests.fixtures import fixture_minimal, fixture_with_egress, fixture_with_ssh
|
|
|
|
|
|
class TestBottleAllowlist(unittest.TestCase):
|
|
def test_egress_allowlist_present(self):
|
|
out = pipelock_bottle_allowlist(fixture_with_egress().bottles["dev"])
|
|
self.assertIn("github.com", out)
|
|
self.assertIn("gitlab.com", out)
|
|
self.assertIn("registry.npmjs.org", out)
|
|
|
|
def test_empty_when_no_egress_block(self):
|
|
out = pipelock_bottle_allowlist(fixture_minimal().bottles["dev"])
|
|
self.assertEqual([], out)
|
|
|
|
def test_rejects_non_string_entry(self):
|
|
bad = {
|
|
"bottles": {"dev": {"egress": {"allowlist": ["github.com", 42]}}},
|
|
"agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
|
|
}
|
|
with self.assertRaises(Die):
|
|
Manifest.from_json_obj(bad)
|
|
|
|
|
|
class TestSSHHostnames(unittest.TestCase):
|
|
def test_hostnames_include_both(self):
|
|
hosts = pipelock_bottle_ssh_hostnames(fixture_with_ssh().bottles["dev"])
|
|
self.assertIn("100.78.141.42", hosts)
|
|
self.assertIn("github.com", hosts)
|
|
|
|
def test_ip_cidrs_only_ipv4(self):
|
|
cidrs = pipelock_bottle_ssh_ip_cidrs(fixture_with_ssh().bottles["dev"])
|
|
self.assertIn("100.78.141.42/32", cidrs)
|
|
self.assertNotIn("github.com", cidrs)
|
|
|
|
def test_trusted_domains_only_hostnames(self):
|
|
trusted = pipelock_bottle_ssh_trusted_domains(fixture_with_ssh().bottles["dev"])
|
|
self.assertIn("github.com", trusted)
|
|
self.assertNotIn("100.78.141.42", trusted)
|
|
|
|
|
|
class TestEffectiveAllowlist(unittest.TestCase):
|
|
def test_union_and_dedup(self):
|
|
manifest = Manifest.from_json_obj({
|
|
"bottles": {
|
|
"dev": {
|
|
"egress": {"allowlist": ["registry.npmjs.org"]},
|
|
"ssh": [
|
|
{"Host": "ts", "IdentityFile": "/dev/null",
|
|
"Hostname": "100.78.141.42", "User": "git", "Port": 30009},
|
|
{"Host": "gh", "IdentityFile": "/dev/null",
|
|
"Hostname": "github.com", "User": "git", "Port": 22},
|
|
],
|
|
}
|
|
},
|
|
"agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
|
|
})
|
|
eff = pipelock_effective_allowlist(manifest.bottles["dev"])
|
|
self.assertIn("api.anthropic.com", eff)
|
|
self.assertIn("registry.npmjs.org", eff)
|
|
self.assertIn("100.78.141.42", eff)
|
|
self.assertIn("github.com", eff)
|
|
self.assertEqual(len(eff), len(set(eff)), "deduplicated")
|
|
self.assertEqual(eff, sorted(eff), "sorted")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|