Jon Chery
7f4b79593a
plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46), forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports CKV_AWS_7/33) over terraform show -json output. meta/ policies (2): block-on-any-critical (declarative source of truth for critical-block; confidence_signal hard-override stays as defense-in-depth, D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj KJ_REQUIRE_TAGGING_STANDARD, D-118). scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips gracefully when kj absent (D-120). tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj), test_run_platform_plan_json_policies.py (script-substring assertion, no skip). ---ci--- project: acdl phase: 3 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-300, REQ-301, REQ-302, REQ-303] partial: [] ---/ci---
59 lines
1.9 KiB
Python
59 lines
1.9 KiB
Python
"""Tests for run_platform.sh Step 5b kyverno-json wiring (REQ-302, v1.25).
|
|
|
|
Asserts the script has the kyverno-json Step 5b block and the PCR-merge
|
|
logic. Pattern from tests/test_pipeline.py:79-95 (read script text +
|
|
assert substrings).
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
|
|
|
|
SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "run_platform.sh"
|
|
|
|
|
|
def _read_script():
|
|
with open(SCRIPT, "r", encoding="utf-8") as fh:
|
|
return fh.read()
|
|
|
|
|
|
class TestStep5bKyvernoJsonWiring:
|
|
def test_step_5b_block_present(self):
|
|
s = _read_script()
|
|
assert "Step 5b: kyverno-json plan-JSON policies" in s, \
|
|
"run_platform.sh must have a Step 5b kyverno-json block (REQ-301)"
|
|
|
|
def test_kj_scan_invocation_present(self):
|
|
s = _read_script()
|
|
assert "adapters/kyverno-json/policies/plan-json" in s, \
|
|
"Step 5b must reference the plan-json policy dir"
|
|
|
|
def test_kj_not_installed_skip_present(self):
|
|
s = _read_script()
|
|
assert "kyverno-json not installed; skipping plan-JSON policies" in s, \
|
|
"Step 5b must skip gracefully when kj is absent (D-120)"
|
|
assert "D-120 graceful degradation" in s
|
|
|
|
def test_pcr_merge_logic_present(self):
|
|
s = _read_script()
|
|
assert "merged PCR list" in s, \
|
|
"Step 5b must merge the Checkov/Wiz + kj PCR lists"
|
|
|
|
def test_command_v_kj_guard_present(self):
|
|
s = _read_script()
|
|
assert "command -v kj" in s, \
|
|
"Step 5b must guard on `command -v kj` (is_configured)"
|
|
|
|
|
|
class TestExistingPipelineUnchanged:
|
|
def test_step_5_still_present(self):
|
|
s = _read_script()
|
|
assert "Step 5: runtime policy scan" in s
|
|
|
|
def test_step_7_confidence_still_present(self):
|
|
s = _read_script()
|
|
assert "Step 7: confidence signal compute" in s |