open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 10:32:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

test(ql3): audit plugin recovery evidence

Browse Source
This commit is contained in:
whyour
2026-08-14 14:24:29 +08:00
parent 2485d61e8a
commit 1c75ac0f45
9 changed files with 952 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs
+35 -1
View File
@@ -122,9 +122,33 @@ test('package script and independent CI job execute the full gate', () => {
const job = workflow.jobs['cluster-plugin-package-recovery-e2e'];
assert.ok(job);
assert.equal(job['timeout-minutes'], 35);
assert.equal(
packageJson.scripts['audit:plugin-package-recovery-e2e:ql3'],
'node scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs',
);
assert.ok(
job.steps.some(
(step) => step.run === 'pnpm test:plugin-package-recovery-e2e:ql3',
(step) =>
String(step.run).includes(
'pnpm test:plugin-package-recovery-e2e:ql3',
) &&
String(step.run).includes('--report=') &&
String(step.run).includes('pnpm audit:plugin-package-recovery-e2e:ql3'),
),
);
assert.ok(
job.steps.some(
(step) =>
step.env?.QL3_SOURCE_REVISION === '${{ github.sha }}' &&
step.env?.QL3_PLUGIN_PACKAGE_RECOVERY_E2E_LIVE === '1',
),
);
assert.ok(
job.steps.some(
(step) =>
step.if === 'always()' &&
String(step.uses).startsWith('actions/upload-artifact@') &&
step.with?.['retention-days'] === 14,
),
);
assert.ok(
@@ -136,6 +160,16 @@ test('package script and independent CI job execute the full gate', () => {
);
});
test('gate persists only a source-bound low-sensitive private report', () => {
assert.match(live, /privateReportPath\(argv\)/);
assert.match(live, /writePrivateReport\(reportFile, report\)/);
assert.match(live, /QL3_SOURCE_REVISION/);
assert.match(live, /org\.opencontainers\.image\.revision/);
assert.match(live, /activeJsonDigest/);
assert.doesNotMatch(live, /activePointer: pointerAfterRejection/);
assert.match(live, /reportWritten: true/);
});
test('private Registry evidence uses one exact Secret file and authenticated requests', () => {
assert.match(fixture, /request\.headers\.authorization !== authorization/);
assert.match(fixture, /www-authenticate/);