WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-21 00:58:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3126 from VarunGore36/fix/reviewer-followups

Browse Source 
fix(security): security follow-ups for worker, installer, claw, hooks
This commit is contained in:
Affaan Mustafa
2026-09-19 19:58:43 -04:00
committed by GitHub
parent a0600a00fb d5dee31321
commit fc9273e5e0
16 changed files with 453 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/scripts/codex-hooks.test.js
+16 -3
View File
@@ -169,6 +169,7 @@ function runHermeticPrePush({
includeCorepack = true,
includePnpm = false,
audit = false,
runChecks = true,
} = {}) {
const tempDir = createTempDir('codex-pre-push-');
const binDir = path.join(tempDir, 'bin');
@@ -204,6 +205,7 @@ ${includePnpm ? functionStub('pnpm', false) : ''}
PATH: toBashPath(binDir),
BASH_ENV: toBashPath(bashEnv),
ECC_PREPUSH_AUDIT: audit ? '1' : '0',
ECC_PREPUSH_RUN_CHECKS: runChecks ? '1' : '0',
ECC_SKIP_GIT_HOOKS: '0',
ECC_SKIP_PREPUSH: '0',
MSYS_NO_PATHCONV: '1',
@@ -221,7 +223,7 @@ ${includePnpm ? functionStub('pnpm', false) : ''}
if (
test('pre-push uses Corepack pinned pnpm and runs every required verification script', () => {
const { result, calls } = runHermeticPrePush();
const { result, calls } = runHermeticPrePush({ runChecks: true });
assert.strictEqual(result.status, 0, JSON.stringify(result, null, 2));
assert.deepStrictEqual(calls, [
'pnpm run lint',
@@ -264,7 +266,7 @@ else failed++;
if (
test('pre-push stops immediately when a required verification script fails', () => {
const { result, calls } = runHermeticPrePush({ failScript: 'typecheck' });
const { result, calls } = runHermeticPrePush({ runChecks: true, failScript: 'typecheck' });
assert.notStrictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
assert.deepStrictEqual(calls, ['pnpm run lint', 'pnpm run typecheck']);
assert.match(result.stderr, /typecheck failed/);
@@ -273,9 +275,20 @@ if (
passed++;
else failed++;
if (
test('pre-push skips verification scripts by default when opt-in is not set', () => {
const { result, calls } = runHermeticPrePush({ runChecks: false });
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
assert.deepStrictEqual(calls, []);
assert.match(result.stderr, /ECC_PREPUSH_RUN_CHECKS!=1/);
})
)
passed++;
else failed++;
if (
test('pre-push runs the production audit through Corepack pnpm', () => {
const { result, calls } = runHermeticPrePush({ audit: true });
const { result, calls } = runHermeticPrePush({ runChecks: true, audit: true });
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
assert.deepStrictEqual(calls, [
'pnpm run lint',