47 lines
2.3 KiB
JavaScript
47 lines
2.3 KiB
JavaScript
// Step 4 test — re-rooted .gitignore, M7 gitleaks fingerprint, .mailmap copy, no-fingerprint plugin.
|
|
// Pattern: plugins/config-audit/tests/lib/*.test.mjs. Runs against freshly extracted repos in $WORK.
|
|
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { existsSync, readFileSync } from 'node:fs';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
const here = path.dirname(fileURLToPath(import.meta.url));
|
|
const SCRIPT = path.join(here, '20-rehome-config.sh');
|
|
const WORK = process.env.WORK || '/tmp/polyrepo-migration';
|
|
|
|
function rehome(key) {
|
|
const r = spawnSync('bash', [SCRIPT, key], { encoding: 'utf8', env: { ...process.env, WORK } });
|
|
if (r.status !== 0) throw new Error(`rehome ${key} failed (${r.status}):\n${r.stdout}\n${r.stderr}`);
|
|
return path.join(WORK, key);
|
|
}
|
|
|
|
const llm = rehome('llm-security');
|
|
const gh = rehome('graceful-handoff');
|
|
|
|
test('re-rooted .gitignore ignores .claude/ and carries no plugins/ prefix', () => {
|
|
const gi = readFileSync(path.join(llm, '.gitignore'), 'utf8');
|
|
assert.match(gi, /^\.claude\/$/m, '.gitignore should ignore a root-level .claude/');
|
|
assert.ok(!gi.includes('plugins/'), '.gitignore must not contain a plugins/ prefix');
|
|
});
|
|
|
|
test('llm-security .gitleaksignore fingerprint is re-rooted with rule-id retained (M7)', () => {
|
|
const gli = readFileSync(path.join(llm, '.gitleaksignore'), 'utf8');
|
|
assert.match(
|
|
gli,
|
|
/^examples\/malicious-skill-demo\/evil-project-health\/lib\/telemetry\.mjs:generic-api-key:18$/m,
|
|
'fingerprint must be the exact re-rooted path:rule-id:line'
|
|
);
|
|
assert.ok(!gli.includes('plugins/llm-security/'), 'the plugins/llm-security/ prefix must be dropped');
|
|
assert.ok(gli.includes(':generic-api-key:'), 'the rule-id must be retained (else the suppression breaks)');
|
|
});
|
|
|
|
test('.mailmap is copied into the extract', () => {
|
|
assert.ok(existsSync(path.join(llm, '.mailmap')), '.mailmap should exist in the extract');
|
|
});
|
|
|
|
test('a plugin with no fingerprint (graceful-handoff) gets .gitleaks.toml but no .gitleaksignore', () => {
|
|
assert.ok(existsSync(path.join(gh, '.gitleaks.toml')), 'graceful-handoff should have .gitleaks.toml');
|
|
assert.ok(!existsSync(path.join(gh, '.gitleaksignore')), 'graceful-handoff should have no .gitleaksignore');
|
|
});
|