heavy-duty/rig
7
0
Fork 1
Code Issues 10 Pull requests Projects Releases 3 Packages Wiki Activity Actions

test: pin the hermeticity, not just achieve it
Some checks failed
ci / check (pull_request) Failing after 7s
Details
ci / install (pull_request) Successful in 4s
Details
ci / db-integration (pull_request) Successful in 3s
Details
labels / labels (pull_request) Failing after 8s
Details

Browse source 
codex and kimi both drove the same experiment: delete the two wiring lines this
branch adds and the suite stays 786/786 on any host without a real Forgejo
runner. Hermetic today, unpinned tomorrow — and #136's task list names the
guard verbatim: "a check that fails if either group can see host state".

Three checks assert the suite's own helpers keep their seals: undo() passes
RIG_FORGEJO_RUNNER_DIR, cibox_run() passes CIBOX_BIN, and the hand-rolled undo
invocation behind "failed logout is loud" passes it too — that third one being
the site I missed first time round, which is exactly why it earns a check
rather than a comment.

They assert on the test side deliberately: the production knobs are already
covered, and the regression worth catching is a deletion in the suite.

Verified by re-running codex's experiment: with both wiring lines gone, the two
seal checks fail where previously nothing did.

Refs #136

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
cluade-reviewer-andresmgsl 2026-07-31 20:15:35 +00:00
parent fd5c04efc9
commit d46697034d
1 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
test/cli.sh
View file

@ -3289,6 +3289,29 @@ cibox_src_matches_install() {
}
check "ci-box: CLI_SRC is the path its install.sh installs" 0 "" cibox_src_matches_install
# codex/kimi on !137: the two wiring lines this change exists to add could be
# deleted tomorrow and the suite stayed 786/786 on any host without a real
# Forgejo runner — hermetic today, unpinned. #136's task list names the guard
# verbatim: "a check that fails if either group can see host state".
#
# These assert on the SUITE's own helpers, not the production knobs — the knobs
# are already covered above. What must go red is a deletion on the test side,
# because that is the regression that silently reintroduces host dependence.
undo_is_sealed() {
sed -n '/^undo() {/,/^}/p' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR='
}
cibox_run_is_sealed() {
sed -n '/^cibox_run() {/,/^}/p' "$0" | grep -q 'CIBOX_BIN='
}
check "hermetic: undo() seals the Forgejo-runner host scan" 0 "" undo_is_sealed
check "hermetic: cibox_run() seals the real /usr/local/bin lookup" 0 "" cibox_run_is_sealed
# The failed-logout check builds its own env rather than calling undo(), so it
# needs the same seal — and it is the one that was missed first time round.
inline_undo_is_sealed() {
grep -A 4 'failed logout is loud' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR='
}
check "hermetic: the hand-rolled undo invocation is sealed too" 0 "" inline_undo_is_sealed
# Registration holds a credential, so it must NOT be in the definition: a
# tenant install is creds-free by contract — box auto-runs it at mint, holding
# nothing. Registration is the operator's separate, out-loud act.