From 994b2daf1fa257e281569ca53910e54c23fc0d77 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 21 Aug 2026 10:56:14 +0200 Subject: [PATCH] test: isolate git identity in CI --- WORK-RECORDS.md | 2 +- tests/test_rein_aharness.py | 24 ++++++++++++------- tests/test_rein_openweights.py | 20 +++++++++++----- ...0005-sandbox-boundary-runtime-hardening.md | 11 +++++---- 4 files changed, 37 insertions(+), 20 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 0a13cbd..3dcc50d 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -42,7 +42,7 @@ | task | GLAS-WP-0005-T01 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | | task | GLAS-WP-0005-T02 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | | task | GLAS-WP-0005-T03 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | -| task | GLAS-WP-0005-T04 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T04 | progress | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | | task | GLAS-WP-0005-T05 | wait | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | | intake | GLAS-IN-0001 | done | blue | docs/intakes/residuals.md | | intake | GLAS-IN-0002 | todo | red | docs/intakes/residuals.md | diff --git a/tests/test_rein_aharness.py b/tests/test_rein_aharness.py index 6b9791e..f0eac8b 100644 --- a/tests/test_rein_aharness.py +++ b/tests/test_rein_aharness.py @@ -11,6 +11,18 @@ from glas_harness.reins.rein_aharness import ReinAharness, ReinAharnessNotInstal from glas_harness.transport import ExecutionTransport, TransportError +def _init_repo(repo) -> None: + repo.mkdir() + subprocess.run(["git", "init", "-q"], cwd=repo, check=True) + subprocess.run(["git", "config", "user.name", "Glas Harness Tests"], cwd=repo, check=True) + subprocess.run( + ["git", "config", "user.email", "glas-harness-tests@example.invalid"], + cwd=repo, + check=True, + ) + subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True) + + def test_is_rein_subclass() -> None: assert issubclass(ReinAharness, Rein) @@ -25,9 +37,7 @@ def test_bin_raises_if_not_installed() -> None: def test_start_session_writes_task_file_and_captures_head(tmp_path) -> None: repo = tmp_path / "repo" - repo.mkdir() - subprocess.run(["git", "init", "-q"], cwd=repo, check=True) - subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True) + _init_repo(repo) rein = ReinAharness() sandbox = SandboxHandle( @@ -97,9 +107,7 @@ def test_dispatch_tool_reports_failure() -> None: def test_end_session_detects_new_commit(tmp_path) -> None: repo = tmp_path / "repo" - repo.mkdir() - subprocess.run(["git", "init", "-q"], cwd=repo, check=True) - subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True) + _init_repo(repo) rein = ReinAharness() head_before = subprocess.run( @@ -126,9 +134,7 @@ def test_end_session_detects_new_commit(tmp_path) -> None: def test_end_session_no_new_commit(tmp_path) -> None: repo = tmp_path / "repo" - repo.mkdir() - subprocess.run(["git", "init", "-q"], cwd=repo, check=True) - subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True) + _init_repo(repo) rein = ReinAharness() head = subprocess.run( diff --git a/tests/test_rein_openweights.py b/tests/test_rein_openweights.py index d270802..3b7a402 100644 --- a/tests/test_rein_openweights.py +++ b/tests/test_rein_openweights.py @@ -11,6 +11,18 @@ from glas_harness.reins.rein_openweights import ReinOpenWeights, ReinOpenWeights from glas_harness.transport import ExecutionTransport, TransportError +def _init_repo(repo) -> None: + repo.mkdir() + subprocess.run(["git", "init", "-q"], cwd=repo, check=True) + subprocess.run(["git", "config", "user.name", "Glas Harness Tests"], cwd=repo, check=True) + subprocess.run( + ["git", "config", "user.email", "glas-harness-tests@example.invalid"], + cwd=repo, + check=True, + ) + subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True) + + def test_is_rein_subclass() -> None: assert issubclass(ReinOpenWeights, Rein) @@ -25,9 +37,7 @@ def test_bin_raises_if_not_installed() -> None: def test_start_session_writes_task_file_and_captures_head(tmp_path) -> None: repo = tmp_path / "repo" - repo.mkdir() - subprocess.run(["git", "init", "-q"], cwd=repo, check=True) - subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True) + _init_repo(repo) rein = ReinOpenWeights() sandbox = SandboxHandle( @@ -129,9 +139,7 @@ def test_dispatch_tool_enforces_outer_timeout() -> None: def test_end_session_detects_new_commit(tmp_path) -> None: repo = tmp_path / "repo" - repo.mkdir() - subprocess.run(["git", "init", "-q"], cwd=repo, check=True) - subprocess.run(["git", "commit", "-q", "--allow-empty", "-m", "init"], cwd=repo, check=True) + _init_repo(repo) rein = ReinOpenWeights() head_before = subprocess.run( diff --git a/workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md b/workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md index 90cef2f..4e964d1 100644 --- a/workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md +++ b/workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md @@ -107,7 +107,7 @@ for direct and optional dependencies. ```task id: GLAS-WP-0005-T04 -status: done +status: progress priority: high ``` @@ -115,10 +115,13 @@ Make Forgejo CI check out the repository, install the project and its test dependencies, run the full unit suite, and run `glas-harness profiles`. Retain only routing probes that still provide operational value. -**Completed 2026-08-21:** replaced the two echo-only jobs with the estate's +**2026-08-21 progress:** replaced the two echo-only jobs with the estate's archive-checkout pattern, explicit Python/sand-boxer/project installation, the -full test suite, and packaged catalog validation. Forgejo Actions run `#45` on -commit `f773b5c` passed after publication. +full test suite, and packaged catalog validation. Run `#45` was superseded and +canceled; run `#46` exposed five tests that incorrectly relied on the host's +global Git author identity. The same job reproduced this cleanly in the runner's +`node:20-bookworm` image, and the test repositories now configure a local, +non-deliverable test identity. A green published rerun remains required. ## Task: Re-prove the sandbox boundary and close evidence