coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: verify fetched source revisions from lock
Some checks failed
Build and publish policy-nexus image / build-and-push (push) Failing after 54s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-09-01 00:35:33 +02:00
parent 641eda8a37
commit a0e4964b46
4 changed files with 74 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

50
tests/test_publication.py
View file

@ -85,6 +85,56 @@ class PublicationTest(unittest.TestCase):
with self.assertRaisesRegex(ValueError, "clean 40-hex Git commit"):
build_site._source_revision(repo, source)
def test_archive_build_uses_fetched_source_lock_revision(self) -> None:
with tempfile.TemporaryDirectory() as directory:
root = Path(directory)
repo = root / "the-custodian"
source = repo / "canon/example.md"
source.parent.mkdir(parents=True)
source.write_text("example", encoding="utf-8")
revision = "b" * 40
(root / "source-lock.json").write_text(
json.dumps(
{
"schema_version": 1,
"repositories": {
"the-custodian": {"revision": revision}
},
}
),
encoding="utf-8",
)
with mock.patch.dict(
os.environ, {"POLICY_NEXUS_SOURCE_ROOT": str(root)}, clear=False
):
self.assertEqual(revision, build_site._source_revision(repo, source))
def test_archive_build_rejects_invalid_fetched_source_lock_revision(self) -> None:
with tempfile.TemporaryDirectory() as directory:
root = Path(directory)
repo = root / "the-custodian"
source = repo / "canon/example.md"
source.parent.mkdir(parents=True)
source.write_text("example", encoding="utf-8")
(root / "source-lock.json").write_text(
json.dumps(
{
"schema_version": 1,
"repositories": {
"the-custodian": {"revision": "sha256:" + "b" * 64}
},
}
),
encoding="utf-8",
)
with mock.patch.dict(
os.environ, {"POLICY_NEXUS_SOURCE_ROOT": str(root)}, clear=False
):
with self.assertRaisesRegex(ValueError, "clean 40-hex Git commit"):
build_site._source_revision(repo, source)
def test_manifest_builds_index_current_revision_and_legacy_alias(self) -> None:
with tempfile.TemporaryDirectory() as directory:
root = Path(directory)