open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 10:32:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): scope deployment-family release candidates

Browse Source
This commit is contained in:
whyour
2026-08-16 08:54:51 +08:00
parent d991deb7ee
commit 7130d77a76
27 changed files with 1332 additions and 303 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/back/ql3ImageOsVulnerabilityPolicy.test.cjs
+5 -7
View File
@@ -25,7 +25,8 @@ function exception(overrides = {}) {
owner: 'security/platform',
ticket: 'QLSEC-123',
expiresOn: '2026-08-15',
rationale: 'Temporary exposure accepted while the fixed base image is qualified.',
rationale:
'Temporary exposure accepted while the fixed base image is qualified.',
...overrides,
};
}
@@ -55,6 +56,7 @@ test('accepts the empty fail-closed production exception policy', () => {
control: 0,
'control-ai': 0,
local: 0,
worker: 0,
},
});
assert.equal(
@@ -132,10 +134,7 @@ test('rejects unscoped images and non-OS package purls', () => {
test('rejects duplicate, unsorted and extensible exception identities', () => {
for (const exceptions of [
[exception(), exception()],
[
exception({ id: 'CVE-2026-99999' }),
exception({ id: 'CVE-2026-12345' }),
],
[exception({ id: 'CVE-2026-99999' }), exception({ id: 'CVE-2026-12345' })],
[{ ...exception(), extra: true }],
]) {
const audit = auditImageOsVulnerabilityPolicy(policy(exceptions), {
@@ -144,8 +143,7 @@ test('rejects duplicate, unsorted and extensible exception identities', () => {
assert.equal(audit.compatible, false);
assert.equal(
audit.findings.some(
(finding) =>
finding.code === 'QL3_IMAGE_OS_VULNERABILITY_EXCEPTION_ID',
(finding) => finding.code === 'QL3_IMAGE_OS_VULNERABILITY_EXCEPTION_ID',
),
true,
);