test(guard-pack): isolate the env-passthrough test from the runner's git branch - #49
Merged
Merged
Conversation
The env-passthrough test asserts a default-mode force-push to a feature
branch returns {} (allowed), but git-safety's push-on-protected guard reads
the current branch via git in process.cwd(). runHook spawned the child
without a cwd, so it inherited the runner's working dir. On push-to-main CI
runs HEAD is main, the guard fired, and the test saw a deny instead of {}.
PR runs checked out a detached merge ref, so they stayed green and the
failure only ever showed on pushes to main.
Spawn the child in the isolated TMP_HOME (not a git repo), so branchOnly
guards read '' for the branch regardless of where CI is sitting. Test-only;
git-safety's production behavior is unchanged (in real use the hook process
cwd is the project dir). Full suite 1584/0 with HEAD on main, the exact
condition that was failing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The symptom
Tests on main (push)has been red on every push to main (e.g. the run after #48 merged, and identically on Aug 18 before it). The PR checks were always green, so it only ever showed up after merge.Root cause
One test fails:
guard-pack.test.js->Integration: env passthrough-> "HOOK_SAFETY_LEVEL=strict tightens every guard in the pack". It runsgit push --force origin feature-branchand asserts default mode returns{}(a force-push to a feature branch is only a strict-tier concern).The actual output on main-push runs is a deny:
[push-on-protected] Pushing from main is not allowed. That is git-safety'spush-on-protectedguard, which isbranchOnlyand resolves the branch withgit branch --show-currentinprocess.cwd().runHookspawned the hook child without acwd, so it inherited the runner's working directory:main-> guard fires -> test sees a deny instead of{}-> red.main-> guard stays quiet ->{}-> green.So the test was coupled to whatever branch CI happened to be sitting on. Reproduced locally by running the suite with HEAD on
main.The fix
Spawn the hook child in the already-isolated
TMP_HOME(created withmkdtemp, not a git repo).getCurrentBranch()then returns'', sobranchOnlyguards behave deterministically regardless of the runner's branch. This also makes the child's cwd match thecwdthe payload already advertises.Test-only change. git-safety's production behavior is unchanged: in real use the hook process runs from the project directory, so reading the branch from
process.cwd()is correct.Verified
Full suite 1584 pass / 0 fail with HEAD on
main, the exact condition that was failing. The other test files that spawn the hook were checked and pass on main (their branch-dependent assertions pass an explicit branch tocheckCommand).