coulomb/policy-nexus
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix release-builder Git dependency and isolate guardrail fixture sources

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
This commit is contained in:
tegwick 2026-10-19 15:03:35 +02:00
parent 8af92bf648
commit 9fabcce1cb
2 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Containerfile
View file

@ -24,6 +24,8 @@ FROM runtime-base AS local-artifact
COPY --chown=101:101 build/ /usr/share/nginx/html/ COPY --chown=101:101 build/ /usr/share/nginx/html/
FROM docker.io/library/python@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31 AS release-builder FROM docker.io/library/python@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31 AS release-builder
# Staged-source review tests exercise real Git index semantics. Builder only.
RUN apk add --no-cache git
ARG SOURCE_SET_DIGEST ARG SOURCE_SET_DIGEST
ENV POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources ENV POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources
WORKDIR /workspace/policy-nexus WORKDIR /workspace/policy-nexus

6
tests/test_guardrails.py
View file

@ -2,10 +2,12 @@ from __future__ import annotations
import json import json
import hashlib import hashlib
import os
from pathlib import Path from pathlib import Path
import sys import sys
import tempfile import tempfile
import unittest import unittest
from unittest import mock
ROOT = Path(__file__).parents[1] ROOT = Path(__file__).parents[1]
sys.path.insert(0, str(ROOT / 'tools')) sys.path.insert(0, str(ROOT / 'tools'))
@ -20,6 +22,10 @@ CANON_FIXTURE = '---\nid: canon-build-mode-change-authorization\ntitle: Build-Mo
class GuardrailTest(unittest.TestCase): class GuardrailTest(unittest.TestCase):
def setUp(self): def setUp(self):
# Synthetic fixtures must not inherit the CI release source lock.
source_env = mock.patch.dict(os.environ, {"POLICY_NEXUS_SOURCE_ROOT": ""})
source_env.start()
self.addCleanup(source_env.stop)
self.source = CANON_FIXTURE self.source = CANON_FIXTURE
self.rule = extract_rule(self.source) self.rule = extract_rule(self.source)
self.record = {'categories': [], 'diff_ref': 'reviewed.patch', 'rollback': 'revert source/image', self.record = {'categories': [], 'diff_ref': 'reviewed.patch', 'rollback': 'revert source/image',