coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden production authorization and service auth
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
This commit is contained in:
tegwick 2026-08-23 14:15:42 +02:00
parent f579f3761c
commit 70371649af
20 changed files with 1268 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

34
tests/test_decisions.py
View file

@ -72,3 +72,37 @@ def test_privileged_lane_helper_accepts_local_approval(tmp_path, monkeypatch):
monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
decision = _require_lane_approval(SimpleNamespace(hub_url=""), _approved())
assert decision.id == "x"
def test_production_action_fails_closed_before_legacy_decision(monkeypatch):
import secrets_engine.cli as cli
entry = validate_entry(dict(VALID, stage="prod", approval={"model": "bootstrap-only"}))
cfg = SimpleNamespace(hub_url="http://127.0.0.1:8000", bao_addr="http://127.0.0.1:8200")
monkeypatch.delenv("SECRETS_ENGINE_UNSAFE_DEMO", raising=False)
with pytest.raises(DecisionError, match="production action 'apply'"):
_require_lane_approval(cfg, entry, "apply")
def test_production_demo_requires_all_three_safety_conditions(tmp_path, monkeypatch):
import secrets_engine.cli as cli
(tmp_path / ".decisions").mkdir()
(tmp_path / ".decisions" / "x.yaml").write_text(
"id: x\ntitle: approved\nstatus: resolved\nsuperseded_by: null\n"
)
entry = validate_entry(
dict(VALID, stage="prod", approval={"model": "decision", "decision_ref": "x"})
)
monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
monkeypatch.setenv("SECRETS_ENGINE_UNSAFE_DEMO", "1")
allowed = SimpleNamespace(hub_url="", bao_addr="http://127.0.0.1:8200")
assert _require_lane_approval(allowed, entry, "apply").id == "x"
for cfg in (
SimpleNamespace(hub_url="http://127.0.0.1:8000", bao_addr="http://127.0.0.1:8200"),
SimpleNamespace(hub_url="", bao_addr="https://bao.example.test"),
):
with pytest.raises(DecisionError, match="live production remains disabled"):
_require_lane_approval(cfg, entry, "apply")