sixfold-space/madtea

SHA256

Fork 0

test(hooks): audit hooks/tests for absence-scored crashed subjects, harden the affected suites #465

Merged

hexajon merged 1 commit from issue-417-hooks-tests-audit into main

2026-08-27 21:28:33 +00:00

hexajon commented

2026-08-27 21:28:31 +00:00

Owner

Summary

#366 hardened the eight hooks/tests suites that run their subject as bash "$HOOK", but scoped the file list on that name and missed release-gate.test.sh (subject $GATE), which scored a crashed/empty gate as allow - a real CI instance failed over-threshold-stale with "expected deny, got allow" when the gate produced no output under load.

Full audit, derived from the defect SHAPE (subject-under-test with stderr discarded, exit status unchecked, verdict by absence of an expected string), not from a name. Classification, stated in the lib-hook-harness.sh header:

ALREADY-HARDENED (8, untouched): the #366 suites.
AFFECTED (4, fixed): releasable-score (a crash became a "0" score), release-due (a crashed script scored as legitimate silence), release-gate (the CI-proven case), and assemble-plugin-artifact's change-detected case (a name-scope miss of the same class, using $SCRIPT).
CLEAN (4, with reasons): check-go-version, check-satellite-readiness, gate-selfheal, no-optout-guard - each inspects the exit status or scores by positive evidence.

lib-hook-harness.sh gains two shared subject wrappers, script_exec_in_repo and gate_exec: they capture the subject's exit status and stderr, surface the stderr on failure, and report a non-zero exit, empty output, or missing subject as a named error - never allow or block. Three affected suites route their subject through them; assemble-plugin-artifact is fixed inline because its tested path legitimately exits non-zero, so it scores by a positive forge-shim marker instead. Six new self-test cases in lib-hook-harness.test.sh prove a subject stubbed to exit non-zero or produce no output is now reported as an error, not scored as allow. All suites keep their exact pass counts (12/11/13/39 identical before and after). No hook or gate script changed. Full gate green.

Closes #417

## Summary #366 hardened the eight hooks/tests suites that run their subject as bash "$HOOK", but scoped the file list on that name and missed release-gate.test.sh (subject $GATE), which scored a crashed/empty gate as allow - a real CI instance failed over-threshold-stale with "expected deny, got allow" when the gate produced no output under load. Full audit, derived from the defect SHAPE (subject-under-test with stderr discarded, exit status unchecked, verdict by absence of an expected string), not from a name. Classification, stated in the lib-hook-harness.sh header: - ALREADY-HARDENED (8, untouched): the #366 suites. - AFFECTED (4, fixed): releasable-score (a crash became a "0" score), release-due (a crashed script scored as legitimate silence), release-gate (the CI-proven case), and assemble-plugin-artifact's change-detected case (a name-scope miss of the same class, using $SCRIPT). - CLEAN (4, with reasons): check-go-version, check-satellite-readiness, gate-selfheal, no-optout-guard - each inspects the exit status or scores by positive evidence. lib-hook-harness.sh gains two shared subject wrappers, script_exec_in_repo and gate_exec: they capture the subject's exit status and stderr, surface the stderr on failure, and report a non-zero exit, empty output, or missing subject as a named error - never allow or block. Three affected suites route their subject through them; assemble-plugin-artifact is fixed inline because its tested path legitimately exits non-zero, so it scores by a positive forge-shim marker instead. Six new self-test cases in lib-hook-harness.test.sh prove a subject stubbed to exit non-zero or produce no output is now reported as an error, not scored as allow. All suites keep their exact pass counts (12/11/13/39 identical before and after). No hook or gate script changed. Full gate green. Closes #417

hexajon added 1 commit

2026-08-27 21:28:31 +00:00

test(hooks): audit hooks/tests for absence-scored crashed subjects, harden the affected suites (#417 )

drift / govulncheck (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 45s

Details

drift / forgejo-smoke (pull_request) Has been skipped

Details

ci / mcp-conformance (pull_request) Successful in 2m5s

Details

ci / mcp-conformance (push) Successful in 24s

Details

drift / govulncheck (push) Has been skipped

Details

drift / surface-diff (push) Successful in 2s

Details

drift / forgejo-smoke (push) Has been skipped

Details

ci / gate (push) Successful in 12m30s

Details

ci / gate (pull_request) Successful in 17m44s

Details

0a09345903

hexajon merged commit 0a09345903 into main

2026-08-27 21:28:33 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!465

No description provided.

Rows
Columns