feat(ql3): establish 3.0 incubation baseline

2026-09-20 16:07:11 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,126 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const {
+  PROFILE_IMPORTERS,
+  auditProfileVulnerabilities,
+} = require('../../scripts/ql3-profile-vulnerability-audit.cjs');
+
+function advisory({ id, moduleName, severity, version = '1.0.0', paths }) {
+  return {
+    id,
+    module_name: moduleName,
+    severity,
+    findings: [{ version, paths }],
+  };
+}
+
+function document(...advisories) {
+  return {
+    advisories: Object.fromEntries(
+      advisories.map((item) => [String(item.id), item]),
+    ),
+  };
+}
+
+test('separates legacy debt from clean 3.0 Profile importers', () => {
+  const report = auditProfileVulnerabilities(
+    document(
+      advisory({
+        id: 1,
+        moduleName: 'legacy-risk',
+        severity: 'critical',
+        paths: ['. > legacy-risk@1.0.0'],
+      }),
+      advisory({
+        id: 2,
+        moduleName: 'bounded-moderate',
+        severity: 'moderate',
+        paths: ['packages/ql3-worker-runtime > bounded-moderate@1.0.0'],
+      }),
+    ),
+  );
+
+  assert.equal(report.compatible, true);
+  assert.equal(report.legacyRoot.compatible, false);
+  assert.equal(report.legacyRoot.advisories.critical, 1);
+  assert.equal(
+    report.profileImporters['packages/ql3-worker-runtime'].advisories.moderate,
+    1,
+  );
+  assert.deepEqual(report.findings, []);
+  assert.deepEqual(Object.keys(report.profileImporters), PROFILE_IMPORTERS);
+});
+
+test('blocks a high or critical advisory in any reviewed Profile', () => {
+  const report = auditProfileVulnerabilities(
+    document(
+      advisory({
+        id: 'GHSA-profile',
+        moduleName: 'profile-risk',
+        severity: 'high',
+        paths: [
+          'packages/ql3-cluster-postgres > profile-risk@1.0.0',
+          'packages/ql3-cluster-control > @qinglong/cluster-postgres@3.0.0 > profile-risk@1.0.0',
+        ],
+      }),
+    ),
+  );
+
+  assert.equal(report.compatible, false);
+  assert.deepEqual(
+    report.findings.map(({ code, importer, moduleName, severity }) => ({
+      code,
+      importer,
+      moduleName,
+      severity,
+    })),
+    [
+      {
+        code: 'PROFILE_HIGH_CRITICAL_ADVISORY',
+        importer: 'packages/ql3-cluster-control',
+        moduleName: 'profile-risk',
+        severity: 'high',
+      },
+      {
+        code: 'PROFILE_HIGH_CRITICAL_ADVISORY',
+        importer: 'packages/ql3-cluster-postgres',
+        moduleName: 'profile-risk',
+        severity: 'high',
+      },
+    ],
+  );
+});
+
+test('fails closed for unreviewed importers and malformed audit data', () => {
+  const unreviewed = auditProfileVulnerabilities(
+    document(
+      advisory({
+        id: 3,
+        moduleName: 'unknown-risk',
+        severity: 'critical',
+        paths: ['packages/ql3-new-profile > unknown-risk@1.0.0'],
+      }),
+    ),
+  );
+  assert.equal(unreviewed.compatible, false);
+  assert.deepEqual(unreviewed.unknownImporters, ['packages/ql3-new-profile']);
+  assert.equal(
+    unreviewed.findings[0].code,
+    'UNREVIEWED_IMPORTER_HIGH_CRITICAL_ADVISORY',
+  );
+
+  assert.throws(
+    () =>
+      auditProfileVulnerabilities({
+        advisories: {
+          4: {
+            id: 4,
+            module_name: 'broken',
+            severity: 'high',
+            findings: [{ version: '1.0.0' }],
+          },
+        },
+      }),
+    /finding paths is invalid/,
+  );
+});