wehub-resource-sync
2860fb5d18
Security / Dependency review (push) Has been skipped
Scorecard / Scorecard analysis (push) Failing after 0s
Validate / eval (push) Failing after 0s
Security / Dependency audit (push) Failing after 1s
Security / Secret scan (push) Failing after 1s
Validate / tests (push) Failing after 0s
Validate / mcp-tests (push) Failing after 1s
GitHub Actions Security Analysis with zizmor 🌈 / zizmor (push) Failing after 1s
Security / SAST scan (push) Failing after 13m52s
71 lines
2.7 KiB
Python
71 lines
2.7 KiB
Python
"""Security-copy contract tests for local reads and credential destinations."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
CONFIGURATION = ROOT / "CONFIGURATION.md"
|
|
README = ROOT / "README.md"
|
|
SKILL_MD = ROOT / "skills" / "last30days" / "SKILL.md"
|
|
UI_PY = ROOT / "skills" / "last30days" / "scripts" / "lib" / "ui.py"
|
|
|
|
|
|
def test_cookie_setup_requires_explicit_allow_flag_in_docs():
|
|
config = CONFIGURATION.read_text(encoding="utf-8")
|
|
skill = SKILL_MD.read_text(encoding="utf-8")
|
|
assert "setup --allow-browser-cookies" in config
|
|
assert "setup --allow-browser-cookies" in skill
|
|
assert "Unset = no browser-cookie reads" in config
|
|
|
|
|
|
def test_project_config_trust_is_documented():
|
|
config = CONFIGURATION.read_text(encoding="utf-8")
|
|
skill = SKILL_MD.read_text(encoding="utf-8")
|
|
assert "LAST30DAYS_TRUST_PROJECT_CONFIG=1" in config
|
|
assert "LAST30DAYS_TRUST_PROJECT_CONFIG=1" in skill
|
|
assert "Folder-mode hosts such as Codex desktop do not trust hidden project config by default" in config
|
|
|
|
|
|
def test_codex_auth_not_advertised_as_openai_fallback():
|
|
config = CONFIGURATION.read_text(encoding="utf-8")
|
|
assert "Codex ChatGPT auth" in config
|
|
assert "intentionally not used" in config
|
|
assert "or Codex auth" not in config
|
|
|
|
|
|
def test_preflight_permission_contract_is_documented():
|
|
config = CONFIGURATION.read_text(encoding="utf-8")
|
|
skill = SKILL_MD.read_text(encoding="utf-8")
|
|
readme = README.read_text(encoding="utf-8")
|
|
|
|
for text in (config, skill, readme):
|
|
assert "--preflight" in text
|
|
assert "without reading browser cookies, writing setup/config/report files, or running research" in config
|
|
assert "does not read browser-cookie values" in skill
|
|
assert "without reading cookies, writing files, or running research" in readme
|
|
|
|
|
|
def test_security_copy_avoids_stale_cookie_and_endpoint_claims():
|
|
skill = SKILL_MD.read_text(encoding="utf-8")
|
|
assert "no browser session access" not in skill
|
|
assert "OpenAI key only goes to api.openai.com" not in skill
|
|
assert "pass `--agent` for non-interactive report output" not in skill
|
|
assert "Codex ChatGPT auth" in skill
|
|
assert "Endpoint destinations follow configured provider base URLs" in skill
|
|
assert "do not read browser-cookie values" in skill
|
|
|
|
|
|
def test_scrapecreators_copy_uses_canonical_free_call_count():
|
|
text = "\n".join(
|
|
[
|
|
CONFIGURATION.read_text(encoding="utf-8"),
|
|
README.read_text(encoding="utf-8"),
|
|
SKILL_MD.read_text(encoding="utf-8"),
|
|
UI_PY.read_text(encoding="utf-8"),
|
|
]
|
|
)
|
|
assert "10,000 free calls" in text
|
|
assert "100 free credits" not in text
|
|
assert "1,000 free" not in text
|