mirror of
https://github.com/affaan-m/ECC.git
synced 2026-09-20 16:47:59 +02:00
Merge pull request #3159 from jgaribay01/fix/prepush-venv-pytest
fix(hooks): pre-push skipped every Python project that uses a virtualenv
This commit is contained in:
Affaan Mustafa
@@ -117,16 +117,172 @@ if [[ -f "go.mod" ]] && command -v go >/dev/null 2>&1; then
|
||||
go test ./... || fail "go test failed"
|
||||
fi
|
||||
|
||||
# Resolve how this project runs pytest, into PYTEST_CMD as an argv array.
|
||||
#
|
||||
# Looking only for `pytest` on PATH meant the hook skipped every project that keeps
|
||||
# its tools in a virtualenv -- which is most of them -- and reported "pytest is not
|
||||
# installed" while sitting next to a .venv with pytest in it. A gate that silently
|
||||
# declines to gate is worse than no gate, because the skip line reads like a pass.
|
||||
#
|
||||
# An array rather than one string, because a virtualenv path may contain spaces:
|
||||
# a scalar command splits `/home/me/my env/bin/python` into two paths that do not
|
||||
# exist, and the hook then rejects the push for a reason that has nothing to do
|
||||
# with the code being pushed.
|
||||
#
|
||||
# Echoes the command it will run, so the reason for a skip is always visible.
|
||||
PYTEST_CMD=()
|
||||
|
||||
# Does this command actually run pytest? Accepting `--version` is not evidence --
|
||||
# plenty of programs take it and exit 0 -- so the output has to name pytest. The
|
||||
# version is captured rather than piped: under `set -o pipefail` a `| grep -q` can
|
||||
# report the SIGPIPE of the program it just matched.
|
||||
#
|
||||
# Only ever called on a command this script composed itself. Probing an arbitrary
|
||||
# operator-supplied command is not safe: a wrapper that ignores `--version` and
|
||||
# execs pytest runs the entire suite during the probe, and is then rejected for
|
||||
# not having printed a version.
|
||||
is_pytest() {
|
||||
local version
|
||||
version="$("$@" --version 2>&1)" || return 1
|
||||
grep -qiE 'pytest[[:space:]]+(version[[:space:]]+)?[0-9]' <<<"$version"
|
||||
}
|
||||
|
||||
# Does the repository itself ship this interpreter?
|
||||
#
|
||||
# A virtualenv is never committed -- it is platform-specific binaries, and every
|
||||
# Python project gitignores it. One that IS tracked is the repository handing this
|
||||
# hook an executable and asking it to run. The hook is installed globally, so
|
||||
# cloning a hostile repository and pushing it to your own fork would be enough,
|
||||
# and on a machine with no pytest on PATH this arm is the only thing that would
|
||||
# run at all. A developer's own venv is untracked, so nothing legitimate is lost.
|
||||
#
|
||||
# The path is resolved through symlinks before git is asked, because `git ls-files`
|
||||
# reports paths as indexed and does not follow links. A repository that commits
|
||||
# `.venv` as a symlink to `.` next to a tracked `bin/python` would otherwise be
|
||||
# queried for `.venv/bin/python`, a path git has never heard of, and the answer
|
||||
# would be "untracked". Measured: that shape ran the planted binary twice.
|
||||
repo_ships_interpreter() {
|
||||
local bindir real top
|
||||
bindir="$(cd -P -- "$1" 2>/dev/null && pwd -P)" || return 1
|
||||
[[ -n "$bindir" ]] || return 1
|
||||
real="$bindir/python"
|
||||
top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
|
||||
top="$(cd -P -- "$top" 2>/dev/null && pwd -P)" || return 1
|
||||
[[ -n "$top" && "$real" == "$top/"* ]] || return 1
|
||||
# `:(icase)` because git matches index pathspecs case-sensitively even where
|
||||
# core.ignorecase is set, while the filesystem underneath does not. On macOS's
|
||||
# APFS -- the platform this hook most often runs on -- a committed
|
||||
# `.venv/bin/Python` is what `$venv/bin/python` opens and executes, but a
|
||||
# case-sensitive query for the lowercase name finds nothing in the index and the
|
||||
# guard waves it through. Measured: that spelling ran the planted binary twice.
|
||||
git ls-files --error-unmatch -- ":(icase)${real#"$top"/}" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
# `-I` isolates the probe: without it Python puts the working directory first on
|
||||
# sys.path, so a repository that commits a `pytest.py` in its root gets that file
|
||||
# imported -- and executed -- by a check whose only job is to answer whether pytest
|
||||
# exists. Measured: a committed pytest.py ran during the probe. Isolation does not
|
||||
# hide a real pytest, which lives in the interpreter's own site-packages.
|
||||
resolve_pytest() {
|
||||
# `${VAR+set}` rather than `-n "${VAR:-}"`, so that a variable set to nothing is
|
||||
# still an override: `ECC_PYTEST_CMD=` and `ECC_PYTEST_CMD=" "` now behave
|
||||
# alike, where the first used to fall through to discovery and the second failed
|
||||
# the push. Falling through is the wrong half of that pair -- an override that
|
||||
# evaluated empty (a command substitution that found nothing, say) would silently
|
||||
# run a different runner than the operator asked for, which is the substitution
|
||||
# this resolver refuses to make anywhere else.
|
||||
#
|
||||
# Not `[[ -v ECC_PYTEST_CMD ]]`: that is bash 4.2, and a stock macOS `/bin/bash`
|
||||
# is 3.2, where it is a syntax error rather than a false. This hook ships to
|
||||
# whatever `env bash` finds.
|
||||
if [[ -n "${ECC_PYTEST_CMD+set}" ]]; then
|
||||
# Taken as given. This is a deliberate override, and the hook cannot inspect it
|
||||
# without running it -- a wrapper script may ignore `--version` and run the
|
||||
# suite, so probing costs a duplicate test run and then blocks the push anyway.
|
||||
# Pointing this at something that is not pytest turns the gate off, and that is
|
||||
# the operator's call to make, not a misconfiguration for the hook to second
|
||||
# guess. Word-split, so the command names something on PATH or an interpreter
|
||||
# whose path has no spaces; a venv with spaces is found by the loop below.
|
||||
read -r -a PYTEST_CMD <<<"$ECC_PYTEST_CMD" || true
|
||||
[[ ${#PYTEST_CMD[@]} -gt 0 ]] || fail "ECC_PYTEST_CMD is set but names no command.\
|
||||
Point it at your test runner, or unset it to fall back to discovery."
|
||||
return 0
|
||||
fi
|
||||
local venv
|
||||
for venv in "${VIRTUAL_ENV:-}" .venv venv env; do
|
||||
if [[ -n "$venv" && -x "$venv/bin/python" ]]; then
|
||||
if repo_ships_interpreter "$venv/bin"; then
|
||||
log "Ignoring $venv/bin/python: the repository ships it."
|
||||
log " A committed virtualenv is an executable the repository controls, and"
|
||||
log " this hook runs on every push in every repository."
|
||||
continue
|
||||
fi
|
||||
if "$venv/bin/python" -I -c "import pytest" >/dev/null 2>&1; then
|
||||
PYTEST_CMD=("$venv/bin/python" -m pytest)
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
done
|
||||
if [[ -f "uv.lock" ]] && command -v uv >/dev/null 2>&1; then
|
||||
if uv run --no-sync python -I -c "import pytest" >/dev/null 2>&1; then
|
||||
PYTEST_CMD=(uv run --no-sync pytest)
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
if [[ -f "poetry.lock" ]] && command -v poetry >/dev/null 2>&1; then
|
||||
if poetry run python -I -c "import pytest" >/dev/null 2>&1; then
|
||||
PYTEST_CMD=(poetry run pytest)
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
# `command -v` proves only that a file of that name exists on PATH. This one the
|
||||
# script composed itself, so confirming it costs a harmless `pytest --version`.
|
||||
if command -v pytest >/dev/null 2>&1 && is_pytest pytest; then
|
||||
PYTEST_CMD=(pytest)
|
||||
return 0
|
||||
fi
|
||||
PYTEST_CMD=()
|
||||
return 1
|
||||
}
|
||||
|
||||
if [[ -f "pyproject.toml" || -f "requirements.txt" ]]; then
|
||||
if command -v pytest >/dev/null 2>&1; then
|
||||
if resolve_pytest; then
|
||||
ran_any_check=1
|
||||
log "Python project detected. Running: pytest -q"
|
||||
pytest -q || fail "pytest failed"
|
||||
log "Python project detected. Running: ${PYTEST_CMD[*]} -q"
|
||||
if [[ -n "${ECC_PYTEST_CMD+set}" ]]; then
|
||||
# resolve_pytest deliberately does not verify the override is pytest, because
|
||||
# probing it can run the operator's suite. What this gate can honestly do
|
||||
# about a stale override is refuse to be quiet about it: a bypass announced
|
||||
# on every push is not the silent gate this resolver exists to prevent.
|
||||
log " via ECC_PYTEST_CMD -- the hook runs what you pointed it at, and does"
|
||||
log " not check that it is pytest. Unset it to gate on the real suite."
|
||||
fi
|
||||
pytest_status=0
|
||||
"${PYTEST_CMD[@]}" -q || pytest_status=$?
|
||||
case "$pytest_status" in
|
||||
0) ;;
|
||||
# pytest reserves 5 for NO_TESTS_COLLECTED, which is not a red suite. A
|
||||
# pyproject.toml that only configures ruff or black is still a Python project
|
||||
# by this hook's test, and blocking those pushes would make the gate something
|
||||
# people switch off. Never silent, though: a bad rootdir, testpaths or a
|
||||
# conftest that fails to import also collects nothing, and swallowing that is
|
||||
# the same skip-reads-like-a-pass hole this resolver exists to close.
|
||||
5)
|
||||
log "pytest collected no tests (exit 5). Not gating this push."
|
||||
log " If this repository is supposed to have tests, that is the bug:"
|
||||
log " check rootdir, testpaths, and conftest.py import errors."
|
||||
;;
|
||||
# The code is in the message because 1 (tests failed) and 4 (usage error)
|
||||
# need different responses, and "pytest failed" alone cannot tell them apart.
|
||||
*) fail "pytest failed (exit $pytest_status)" ;;
|
||||
esac
|
||||
else
|
||||
log "Python project detected but pytest is not installed. Skipping."
|
||||
log "Python project detected but no pytest found (checked \$VIRTUAL_ENV, .venv,"
|
||||
log " venv, env, uv, poetry, PATH). Set ECC_PYTEST_CMD to point at it."
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
if [[ "$ran_any_check" -eq 0 ]]; then
|
||||
log "No supported checks found in this repository. Skipping."
|
||||
else
|
||||
|
||||
Reference in New Issue
Block a user