mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-08-26 00:53:48 +00:00
19a4b973eb
* fix(ci): back-port the checkout-heal wipe guard to the triage and serve-ab wipes The "empty the workspace, keep the directory" idiom exists in three copies; only the review workflow's copy received the #9220 hardening (canonicalization, trailing-slash strip, RUNNER_WORKSPACE allowlist). Measured on main for #9265, the two triage guards let non-canonical spellings of the guarded roots through (/home/, /home/., //usr, /root/, /var/ all reached the rm), and serve-ab's wipe had no guard at all — even `/home` or an empty string arrived at `find … -exec rm -rf`. Port the reference guard to all three sites, keeping each site's exit contract: triage fails loud both before and after external code, serve-ab stays bare under the job's `-eo pipefail` so an unclearable workspace fails before either checkout builds on top of the leftovers. Pin each ported copy with its own tests: bad-path batteries under an rm recorder (the destructive primitive cannot fire under any edit), an allowlist-escaping `..` case gated on a GNU-realpath host probe (the lesson from 90fa6bb4), a realpath-absent trailing-slash RUNNER_WORKSPACE case, and text pins on the ported layers. Every pin was mutation-verified red against a deletion of the layer it guards. * test(ci): pin guarded serve wipe * fix(ci): close wipe guard fallback gaps * fix(ci): fail closed without realpath * fix(ci): keep wipe guards portable * test(ci): pin wipe-guard RWS layers and unmask the pre-run battery - run the rewritten pre-run sweep battery under -e -o pipefail so a failing sweep can no longer report success (bare bash -c masked it) - pin the RWS '..' refusal and degenerate-root refusal text in all copies, and add RUNNER_WORKSPACE='/' exec cases to both copy suites - exercise both pre-run and post-run copies in the realpath-absent refusal test - replace the '..' escape vector with a symlink escape that only the realpath line can refuse, and correct the mutant-outcome comments - add the serve-ab wipe-before-checkouts ordering pin from the sister suite and a happy-path RWS canonicalization pin * test(ci): correct wipe-guard mutant-outcome comments for find -P The symlink-escape comments claimed that with the WS realpath line deleted, find reaches rm through the link target. GNU find's default -P mode does not descend symlink operands: the mutant passes every guard, wipes nothing, and exits 0, so only the non-zero-status assertion catches it — the rm-log assertion passes vacuously. Reword both twin comments (R5-1). --------- Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com>
47 lines
1.6 KiB
TypeScript
47 lines
1.6 KiB
TypeScript
/**
|
|
* @license
|
|
* Copyright 2025 Google LLC
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
import { configDefaults, defineConfig } from 'vitest/config';
|
|
|
|
export default defineConfig({
|
|
test: {
|
|
globals: true,
|
|
environment: 'node',
|
|
include: ['scripts/tests/**/*.test.{js,ts}'],
|
|
// Script tests that drive Linux-only CI (ubuntu-latest workflow jobs, or
|
|
// bash/shell fixtures Windows cannot express) fail on a Windows runner.
|
|
// Linux CI remains their authoritative coverage.
|
|
exclude:
|
|
process.platform === 'win32'
|
|
? [
|
|
...configDefaults.exclude,
|
|
'scripts/tests/pr-self-report-label.test.js',
|
|
// Bash-driven workflow suites cannot run on Windows; pure
|
|
// YAML-parse workflow suites still do.
|
|
'scripts/tests/qwen-*-workflow.test.js',
|
|
'scripts/tests/serve-ab-workflow.test.js',
|
|
]
|
|
: [...configDefaults.exclude],
|
|
setupFiles: ['scripts/tests/test-setup.ts'],
|
|
// Several tests in install-script.test.js shell out to `node` to run
|
|
// create-standalone-package.js, which on Windows runs a full
|
|
// tar+gzip pass under antivirus inspection. Real runtimes observed on
|
|
// Windows CI: 4780ms / 1666ms / 1079ms — the 4.8s one is right at
|
|
// vitest's 5s default and flakes. Bump the suite timeout so a single
|
|
// slow subprocess startup doesn't fail an otherwise-healthy test run.
|
|
testTimeout: 30_000,
|
|
coverage: {
|
|
provider: 'v8',
|
|
reporter: ['text', 'lcov'],
|
|
},
|
|
poolOptions: {
|
|
threads: {
|
|
minThreads: 8,
|
|
maxThreads: 16,
|
|
},
|
|
},
|
|
},
|
|
});
|