Jon Chery
255cde5002
P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies
(block-on-any-critical, tagging-rules-agree) over the merged PCR list after
Step 5b, appending the meta-PCRs to pcr.json before the confidence signal
runs. Closes the D-118/D-119 declarative-critical-block gap (the
confidence_signal.py hard-override stays as defense-in-depth).
P1-2 (testing): test_meta_policies.py behavioral assertions strengthened —
test_no_critical_passes asserts no fails, test_critical_fail_present asserts
a non-pass result, test_pcrs_validate_against_schema validates output.
P1-3 (correctness): _smoke.json assertion rewritten from malformed
'{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'.
---ci---
project: acdl
phase: 5
milestone: v1.25
status: execute
phase_role: final
---/ci---
64 lines
2.1 KiB
Python
64 lines
2.1 KiB
Python
"""Tests for run_platform.sh Step 5b kyverno-json wiring (REQ-302, v1.25).
|
|
|
|
Asserts the script has the kyverno-json Step 5b block and the PCR-merge
|
|
logic. Pattern from tests/test_pipeline.py:79-95 (read script text +
|
|
assert substrings).
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
|
|
|
|
SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "run_platform.sh"
|
|
|
|
|
|
def _read_script():
|
|
with open(SCRIPT, "r", encoding="utf-8") as fh:
|
|
return fh.read()
|
|
|
|
|
|
class TestStep5bKyvernoJsonWiring:
|
|
def test_step_5b_block_present(self):
|
|
s = _read_script()
|
|
assert "Step 5b: kyverno-json plan-JSON policies" in s, \
|
|
"run_platform.sh must have a Step 5b kyverno-json block (REQ-301)"
|
|
|
|
def test_step_5c_meta_block_present(self):
|
|
s = _read_script()
|
|
assert "Step 5c: kyverno-json meta-policies over the merged PCR list" in s, \
|
|
"run_platform.sh must have a Step 5c meta-policy block (REQ-303, P1-1 fix)"
|
|
|
|
def test_kj_scan_invocation_present(self):
|
|
s = _read_script()
|
|
assert "adapters/kyverno-json/policies/plan-json" in s, \
|
|
"Step 5b must reference the plan-json policy dir"
|
|
|
|
def test_kj_not_installed_skip_present(self):
|
|
s = _read_script()
|
|
assert "kyverno-json not installed; skipping plan-JSON policies" in s, \
|
|
"Step 5b must skip gracefully when kj is absent (D-120)"
|
|
assert "D-120 graceful degradation" in s
|
|
|
|
def test_pcr_merge_logic_present(self):
|
|
s = _read_script()
|
|
assert "merged PCR list" in s, \
|
|
"Step 5b must merge the Checkov/Wiz + kj PCR lists"
|
|
|
|
def test_command_v_kj_guard_present(self):
|
|
s = _read_script()
|
|
assert "command -v kj" in s, \
|
|
"Step 5b must guard on `command -v kj` (is_configured)"
|
|
|
|
|
|
class TestExistingPipelineUnchanged:
|
|
def test_step_5_still_present(self):
|
|
s = _read_script()
|
|
assert "Step 5: runtime policy scan" in s
|
|
|
|
def test_step_7_confidence_still_present(self):
|
|
s = _read_script()
|
|
assert "Step 7: confidence signal compute" in s |