From 9fabcce1cb4c83165bcaba8be58d76788b4d87a1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 19 Oct 2026 15:03:35 +0200 Subject: [PATCH] Fix release-builder Git dependency and isolate guardrail fixture sources Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181 --- Containerfile | 2 ++ tests/test_guardrails.py | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/Containerfile b/Containerfile index 42d1bd4..c8b545c 100644 --- a/Containerfile +++ b/Containerfile @@ -24,6 +24,8 @@ FROM runtime-base AS local-artifact COPY --chown=101:101 build/ /usr/share/nginx/html/ FROM docker.io/library/python@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31 AS release-builder +# Staged-source review tests exercise real Git index semantics. Builder only. +RUN apk add --no-cache git ARG SOURCE_SET_DIGEST ENV POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources WORKDIR /workspace/policy-nexus diff --git a/tests/test_guardrails.py b/tests/test_guardrails.py index fa5e6dd..5504b98 100644 --- a/tests/test_guardrails.py +++ b/tests/test_guardrails.py @@ -2,10 +2,12 @@ from __future__ import annotations import json import hashlib +import os from pathlib import Path import sys import tempfile import unittest +from unittest import mock ROOT = Path(__file__).parents[1] sys.path.insert(0, str(ROOT / 'tools')) @@ -20,6 +22,10 @@ CANON_FIXTURE = '---\nid: canon-build-mode-change-authorization\ntitle: Build-Mo class GuardrailTest(unittest.TestCase): def setUp(self): + # Synthetic fixtures must not inherit the CI release source lock. + source_env = mock.patch.dict(os.environ, {"POLICY_NEXUS_SOURCE_ROOT": ""}) + source_env.start() + self.addCleanup(source_env.stop) self.source = CANON_FIXTURE self.rule = extract_rule(self.source) self.record = {'categories': [], 'diff_ref': 'reviewed.patch', 'rollback': 'revert source/image',