mirror of
https://github.com/trailofbits/algo.git
synced 2026-09-22 01:24:58 +02:00
21e21747ea
* ci: modernize tooling with prek, ty, and security scanning Migrate from pre-commit to prek (Rust-native, faster hooks) and add comprehensive CI improvements for code quality and security. Changes: - Replace pre-commit with prek for git hooks - Add ty type checker (Rust-based, replaces mypy) - Expand ruff rules: security (S), simplify (SIM), commented code (ERA) - Add pip-audit workflow for Python dependency CVE scanning - Add actionlint and zizmor for GitHub Actions linting/security - Add ruff format check to CI - Enable stricter ansible-lint rules (no-changed-when, risky-file-permissions) - Remove obsolete Claude workflow files - Apply ruff formatting fixes to test files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): resolve actionlint install and ty type errors - Use actionlint's official install script instead of broken URL pattern - Exclude test mock modules from ty type checking - Run workflows on push only for main/master to avoid duplicate PR runs Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): use glob pattern for actionlint, exclude all tests from ty - actionlint requires *.yml glob, not directory path - Exclude all tests from ty type checking (test code has looser typing) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): quote shell variables to fix shellcheck warnings Fix SC2046/SC2086 warnings in workflow scripts: - Quote $(uname -r) in apt-get install - Quote $(pwd) in docker volume mount - Quote $existing in gh issue comment Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): move key-order[task] to warn_list Too many existing violations in the codebase to enable as error. Move to warn_list for gradual fixes over time. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Tests
Running Tests
# Run all linters (same as CI)
ansible-lint . && yamllint . && ruff check . && shellcheck scripts/*.sh
# Run Python unit tests
pytest tests/unit/ -q
# Run E2E connectivity tests (requires deployed Algo on localhost)
sudo tests/e2e/test-vpn-connectivity.sh both
Directory Structure
tests/
├── unit/ # Python unit tests (pytest)
│ ├── test_basic_sanity.py
│ ├── test_config_validation.py
│ ├── test_template_rendering.py
│ └── ...
├── e2e/ # End-to-end connectivity tests
│ └── test-vpn-connectivity.sh
├── integration/ # Integration test helpers
│ └── mock_modules/
├── fixtures/ # Shared test data
│ └── test_variables.yml
└── conftest.py # Pytest configuration
Test Coverage
| Category | Tests | What's Verified |
|---|---|---|
| Sanity | test_basic_sanity.py |
Python version, config syntax, playbook validity |
| Config | test_config_validation.py |
WireGuard/IPsec config formats, key validation |
| Templates | test_template_rendering.py |
Jinja2 template syntax, filter compatibility |
| Certificates | test_certificate_validation.py |
OpenSSL compatibility, PKCS#12 export |
| Cloud Providers | test_cloud_provider_configs.py |
Region formats, instance types, OS images |
| E2E | test-vpn-connectivity.sh |
WireGuard handshake, IPsec connection, DNS through VPN |
CI Workflows
| Workflow | Trigger | What It Does |
|---|---|---|
lint.yml |
All PRs | ansible-lint, yamllint, ruff, shellcheck |
main.yml |
Push to master | Syntax check, unit tests, Docker build |
integration-tests.yml |
PRs to roles/ | Full localhost deployment + E2E tests |
smart-tests.yml |
All PRs | Runs subset based on changed files |
Writing Tests
Python Unit Tests
Place in tests/unit/. Use fixtures from conftest.py:
def test_something(mock_ansible_module, jinja_env):
# mock_ansible_module - mocked AnsibleModule
# jinja_env - Jinja2 environment with Ansible filters
pass
Shell Scripts
Use bash strict mode and pass shellcheck:
#!/bin/bash
set -euo pipefail
Troubleshooting
E2E tests fail with "namespace already exists"
sudo ip netns del algo-client
Template tests fail with "filter not found"
Add the filter to the mock in conftest.py.
CI fails but local passes Check Python/Ansible versions match CI (Python 3.11, Ansible 12+).