mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-27 23:27:44 +09:00
Thomas Vincent
e2a5f32ee9
* security(ci): constrain dependency installs and container build boundaries Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(docker): retain shipped runtime libraries in build context Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(tooling): quote gettext paths and honor Docker base selection Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(auth): use certificate expiry truth in rendering assertions Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(tooling): finish Docker layer and regex scan findings Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(ci): preserve documentation badge anchors without alternation Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(ci): preserve contributor badges and enforce Python coverage Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: share changed-code coverage contracts and enforce shell policy Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(ci): enforce private review files and run path regressions Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: measure changed gettext shell coverage Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: pin coverage to the reviewed PR revision Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
35 lines
1.3 KiB
Python
35 lines
1.3 KiB
Python
"""Instrument unchanged shell fixture copies when coverage is requested.
|
|
|
|
Copyright (C) 2026 The Cacti Group. GPL-2.0-or-later.
|
|
"""
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import shutil
|
|
import uuid
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def shell_command(script, original, interpreter='/bin/sh'):
|
|
script, original = Path(script).resolve(), Path(original).resolve()
|
|
if not os.getenv('CACTI_SHELL_COVERAGE'):
|
|
return [interpreter, str(script)]
|
|
if script.read_bytes() != original.read_bytes():
|
|
raise ValueError('Shell fixture must retain the original source bytes')
|
|
kcov = shutil.which('kcov')
|
|
if not kcov:
|
|
raise RuntimeError('Shell coverage requires kcov')
|
|
directory = Path(os.environ['CACTI_SHELL_COVERAGE']) / uuid.uuid4().hex
|
|
directory.mkdir(parents=True)
|
|
(directory / 'source.json').write_text(json.dumps({
|
|
'source': str(original.relative_to(ROOT)),
|
|
'native_source': str(script),
|
|
'sha256': hashlib.sha256(original.read_bytes()).hexdigest(),
|
|
}))
|
|
return [kcov, '--bash-parser=/bin/bash', '--cobertura-only',
|
|
'--include-pattern=' + str(script),
|
|
'--replace-src-path=' + str(script) + ':' + str(original),
|
|
'--strip-path=' + str(ROOT), str(directory), str(script)]
|