test_check_required_checks.py

#!/usr/bin/env python3
# FLOOR
"""Red floor for check_required_checks -- the deterministic core.

Proves the confront rules offline (no filesystem, no network): RC1 (a decisional
name with no runner), RC2 (a decisional name not in required), and RC3 (the
ruleset required_status_checks contexts do not match `required` as a set, either
direction). Mutating confront turns one of these red. Runs standalone (exit 0/1)
and under pytest.
"""

from __future__ import annotations

import sys

from check_required_checks import CODES, confront

RUNNERS = frozenset({"quality", "tests", "security"})
REQUIRED = ("quality", "tests", "security", "Analyze (python)")
DECISIONAL = ("quality", "tests", "security")
RULESET = frozenset(REQUIRED)  # a conforming ruleset mirrors `required` exactly


def _codes(findings):
    return [f.code for f in findings]


def test_conforming_policy_has_no_finding():
    assert confront(DECISIONAL, REQUIRED, RUNNERS, RULESET) == []


def test_decisional_without_runner_is_RC1():
    required = REQUIRED + ("ghost",)
    assert _codes(confront(("quality", "ghost"), required, RUNNERS, frozenset(required))) == ["RC1"]


def test_decisional_not_in_required_is_RC2():
    # 'tests' has a runner but is (here) not listed in required -> RC2 only.
    required = ("quality", "security")
    assert _codes(confront(("tests",), required, RUNNERS, frozenset(required))) == ["RC2"]


def test_codeql_as_decisional_is_RC1_only():
    # "Analyze (python)" IS required but has no runner, so making it decisional
    # fires RC1 (not RC2) -- exactly why it must stay out of `decisional`.
    findings = confront(("Analyze (python)",), REQUIRED, RUNNERS, RULESET)
    assert _codes(findings) == ["RC1"]


def test_findings_follow_decisional_order():
    required = ("quality",)
    codes = _codes(confront(("ghost", "tests"), required, RUNNERS, frozenset(required)))
    # ghost: no runner (RC1) + not required (RC2); tests: not required (RC2).
    assert codes == ["RC1", "RC2", "RC2"]


def test_required_missing_from_ruleset_is_RC3():
    # a name in `required` the ruleset payload omits -> under-enforcement.
    required = REQUIRED + ("docs-privacy",)
    ruleset = frozenset(REQUIRED)  # omits docs-privacy
    assert _codes(confront(DECISIONAL, required, RUNNERS, ruleset)) == ["RC3"]


def test_ruleset_extra_context_is_RC3():
    # a context the ruleset enforces that `required` no longer lists -> stale.
    ruleset = frozenset(REQUIRED) | {"stale"}
    assert _codes(confront(DECISIONAL, REQUIRED, RUNNERS, ruleset)) == ["RC3"]


def test_declared_vocabulary_is_RC1_RC2_RC3():
    assert CODES == frozenset({"RC1", "RC2", "RC3"})


def _run() -> int:
    fns = [v for k, v in sorted(globals().items()) if k.startswith("test_") and callable(v)]
    failed = 0
    for fn in fns:
        try:
            fn()
            print(f"PASS {fn.__name__}")
        except AssertionError as exc:
            failed += 1
            print(f"FAIL {fn.__name__}: {exc}")
    print(f"\n{len(fns) - failed}/{len(fns)} green")
    return 1 if failed else 0


if __name__ == "__main__":
    sys.exit(_run())