Jon Chery
3b1181f39b
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) + 1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security posture hardened (swallowed errors, account ID externalized, IAM scoped, schema validation, credential hygiene). Stubs resolved (kyverno --kube- version removed). 7 untested scripts gained coverage. Documentation synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13, GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral recorded). Platform VPC parameterized. 561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified. 6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001) auto-resolved at full autonomy (D-101). ---ci--- project: acdl phase: 21 milestone: v1.14 status: complete ---/ci---
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
"""v1.14 (REQ-146): no credential-looking files are tracked by git."""
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parent.parent
|
|
|
|
CREDENTIAL_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".cer", ".crt", ".jks", ".keystore"]
|
|
|
|
|
|
def test_no_credential_files_tracked():
|
|
"""Assert no file with a credential extension is tracked by git."""
|
|
result = subprocess.run(
|
|
["git", "ls-files"],
|
|
cwd=str(ROOT),
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
if result.returncode != 0:
|
|
pytest.skip("git not available or not a repo")
|
|
tracked = result.stdout.strip().split("\n")
|
|
cred_files = [
|
|
f for f in tracked
|
|
if any(f.endswith(ext) for ext in CREDENTIAL_EXTENSIONS)
|
|
]
|
|
assert cred_files == [], f"credential files tracked by git: {cred_files}"
|
|
|
|
|
|
def test_gitignore_has_credential_patterns():
|
|
"""Assert .gitignore contains the credential-pattern catch-all."""
|
|
gitignore = (ROOT / ".gitignore").read_text()
|
|
for ext in [".pem", ".key", ".p12", ".pfx"]:
|
|
assert f"*{ext}" in gitignore, f".gitignore missing credential pattern *{ext}" |