mirror of
https://github.com/niakw/Prospero.Eden-Encore.git
synced 2026-10-24 15:01:28 +02:00
69 lines
3.0 KiB
Python
69 lines
3.0 KiB
Python
#!/usr/bin/env python3
|
|
"""Security R419: keep CodeQL exclusions narrow and first-party coverage intact.
|
|
|
|
This fixture checks policy source only; switch existing GitHub default setup
|
|
to the tracked advanced workflow before treating vendor exclusions as active.
|
|
"""
|
|
from fnmatch import fnmatchcase
|
|
from pathlib import Path
|
|
import re
|
|
|
|
root = Path(__file__).resolve().parents[1]
|
|
config = (root / ".github/codeql/codeql-config.yml").read_text()
|
|
doc = (root / "docs/CODEQL_SECURITY_TRIAGE_R419.md").read_text()
|
|
advanced = (root / ".github/workflows/codeql-advanced.yml").read_text()
|
|
assert not (root / ".github/workflows/codeql.yml").exists(), "Remove duplicate autogenerated CodeQL workflow"
|
|
assert config.startswith("name: Eden Encore CodeQL")
|
|
patterns = re.findall(r"^\s+- '([^']+)'", config, flags=re.M)
|
|
expected = {
|
|
"vendor/sources/**/libs/mpl/preprocessed/pp.py",
|
|
"vendor/sources/**/tools/litre/cplusplus.py",
|
|
"vendor/sources/**/bin/nir-test-runner.py",
|
|
"vendor/sources/**/hb_test_tools.py",
|
|
"vendor/sources/**/python/run_tests.py",
|
|
}
|
|
assert set(patterns) == expected, (patterns, expected)
|
|
# R428: c-cpp build-mode:none no longer traverses the immutable 40k-file
|
|
# vendored snapshots; Python and Actions still scan our active code.
|
|
scan_root = config.split("paths:\n", 1)[1].split("paths-ignore:", 1)[0]
|
|
included = set(re.findall(r"^\s+- ([^\s#]+)$", scan_root, flags=re.M))
|
|
assert included == {
|
|
".github", "headless", "src", "tools", "third_party", "fixtures",
|
|
"vendor/encore-active",
|
|
}, included
|
|
assert "vendor/sources" not in included and "vendor/objects" not in included
|
|
def ignored(path: str) -> bool:
|
|
return any(fnmatchcase(path, p) for p in patterns)
|
|
|
|
for path in (
|
|
"vendor/sources/eden-cpm/boost/libs/mpl/preprocessed/pp.py",
|
|
"vendor/sources/eden-cpm/boost/tools/litre/cplusplus.py",
|
|
"vendor/sources/opengl-mesa-26-2/bin/nir-test-runner.py",
|
|
"vendor/sources/ps5-mesa/bin/nir-test-runner.py",
|
|
"vendor/sources/harfbuzz/test/shaping/hb_test_tools.py",
|
|
"vendor/sources/harfbuzz/test/shaping/python/run_tests.py",
|
|
):
|
|
assert ignored(path), path
|
|
for path in (
|
|
"headless/main.cpp",
|
|
"headless/network_domain_rules.c",
|
|
"tools/ps-glyph-mod-discovery.py",
|
|
"tools/check-guest-network-isolation.py",
|
|
"tools/check-ps-glyph-curl-search.py",
|
|
"vendor/encore-active/eden-vulkan/vulkan_scheduler.cpp",
|
|
"vendor/encore-active/ps5-mesa/src/util/disk_cache_os.c",
|
|
"vendor/sources/eden/src/video_core/renderer_vulkan/vk_scheduler.cpp",
|
|
"vendor/sources/harfbuzz/src/hb-shape.cc",
|
|
"vendor/sources/ps5-mesa/src/amd/vulkan/radv_device.c",
|
|
):
|
|
assert not ignored(path), path
|
|
assert "Switch to advanced" in doc
|
|
assert "default" in doc
|
|
assert "config-file: ./.github/codeql/codeql-config.yml" in advanced
|
|
assert "security-events: write" in advanced
|
|
for language in ("actions", "python", "c-cpp"):
|
|
assert "- language: " + language in advanced
|
|
assert "paths-ignore:" in config
|
|
assert "#23" in doc and "#28" in doc
|
|
print("R419 CodeQL scope policy: narrow third-party test exclusions PASS")
|