@@ -8,6 +8,8 @@ const CODEOWNERS = ".github/CODEOWNERS";
8899type WorkflowStep = {
1010env?: Record<string, string>;
11+id?: string;
12+if?: string;
1113name?: string;
1214run?: string;
1315uses?: string;
@@ -22,6 +24,7 @@ type WorkflowJob = {
2224};
23252426type Workflow = {
27+env?: Record<string, string>;
2528jobs?: Record<string, WorkflowJob>;
2629name?: string;
2730permissions?: Record<string, string>;
@@ -74,10 +77,42 @@ describe("security-sensitive guard workflow", () => {
7477const jobs = readWorkflow().jobs ?? {};
7578for (const jobName of ["security-sensitive-guard-detect", "security-sensitive-guard"]) {
7679const steps = jobs[jobName]?.steps ?? [];
77-expect(steps[0].uses).toBe("actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd");
78-expect(steps[0].with?.ref).toBe("${{ github.event.pull_request.base.sha }}");
79-expect(steps[0].with?.["persist-credentials"]).toBe(false);
80+const checkout = steps.find((step) => step.uses?.startsWith("actions/checkout@"));
81+82+expect(checkout?.uses).toBe("actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd");
83+expect(checkout?.if).toBe("steps.rollout.outputs.ready == 'true'");
84+expect(checkout?.with?.ref).toBe("${{ github.workflow_sha }}");
85+expect(checkout?.with?.ref).not.toBe("${{ github.event.pull_request.base.sha }}");
86+expect(checkout?.with?.["persist-credentials"]).toBe(false);
8087expect(steps.at(-1)?.run).toBe("node scripts/github/security-sensitive-guard.mjs");
88+expect(steps.at(-1)?.if).toBe("steps.rollout.outputs.ready == 'true'");
89+}
90+});
91+92+it("temporarily skips PR bases that predate the guard rollout commit", () => {
93+const parsed = readWorkflow();
94+95+expect(parsed.env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA).toBe(
96+"5d9c010628ea4de3492a12e32f9be5b8c5dfa9ed",
97+);
98+99+const jobs = parsed.jobs ?? {};
100+for (const jobName of ["security-sensitive-guard-detect", "security-sensitive-guard"]) {
101+const steps = jobs[jobName]?.steps ?? [];
102+const rollout = steps.find(
103+(step) => step.name === "Check security-sensitive guard rollout eligibility",
104+);
105+106+expect(rollout?.id).toBe("rollout");
107+expect(rollout?.env?.GH_TOKEN).toBe("${{ github.token }}");
108+expect(rollout?.env?.PR_BASE_SHA).toBe("${{ github.event.pull_request.base.sha }}");
109+expect(rollout?.run).toContain(
110+"compare/${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}...${PR_BASE_SHA}",
111+);
112+expect(rollout?.run).toContain("ahead|identical)");
113+expect(rollout?.run).toContain("behind|diverged)");
114+expect(rollout?.run).toContain("ready=false");
115+expect(rollout?.run).toContain("predates rollout commit");
81116}
82117});
83118@@ -90,10 +125,12 @@ describe("security-sensitive guard workflow", () => {
9012591126expect(finalJob?.needs).toEqual(["security-sensitive-guard-detect"]);
92127expect(finalJob?.if).toContain("always()");
93-expect(detectSteps[1].env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE).toBe("detect");
94-expect(finalSteps[1].env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE).toBe("enforce");
95-expect(finalSteps[1].env?.OPENCLAW_SECURITY_TEAM_SLUG).toBe("openclaw-secops");
96-expect(finalSteps[1].env?.OPENCLAW_SECURITY_APPROVERS).toBe("vincentkoc,steipete,joshavant");
128+expect(detectSteps.at(-1)?.env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE).toBe("detect");
129+expect(finalSteps.at(-1)?.env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE).toBe("enforce");
130+expect(finalSteps.at(-1)?.env?.OPENCLAW_SECURITY_TEAM_SLUG).toBe("openclaw-secops");
131+expect(finalSteps.at(-1)?.env?.OPENCLAW_SECURITY_APPROVERS).toBe(
132+"vincentkoc,steipete,joshavant",
133+);
97134});
9813599136it("uses a dedicated checked-in script and detects the intended file surfaces", () => {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。