amantahiliani/box-box
1
0
Fork 0
mirror of https://github.com/AmanTahiliani/box-box.git synced 2026-08-07 11:54:59 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(#91): read committed fidelity sign-off

Browse Source
This commit is contained in:
Aman Tahiliani
2026-07-29 23:25:22 -04:00
parent 44a32bfd73
commit 3228e4adbd
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/release-fidelity/verify.mjs
View File

@@ -20,7 +20,7 @@ const required = ['index.html', 'summary.md']
try { try {
for (const file of required) await readFile(join(evidence, file)) for (const file of required) await readFile(join(evidence, file))
git('cat-file', '-e', `HEAD:${signoff}`) git('cat-file', '-e', `HEAD:${signoff}`)
const text = await readFile(signoff, 'utf8') const text = git('show', `HEAD:${signoff}`)
const candidate = text.match(/^- Candidate commit: ([0-9a-f]{40})$/mi)?.[1] const candidate = text.match(/^- Candidate commit: ([0-9a-f]{40})$/mi)?.[1]
if (!candidate) throw new Error(`${signoff} must contain a full candidate commit SHA`) if (!candidate) throw new Error(`${signoff} must contain a full candidate commit SHA`)
git('cat-file', '-e', `${candidate}^{commit}`) git('cat-file', '-e', `${candidate}^{commit}`)

14
scripts/release-fidelity/verify.test.mjs
View File

@@ -18,7 +18,7 @@ function verify(root, evidence) {
}) })
} }
async function approvedCandidate({ changeCodeWithSignoff = false } = {}) { async function approvedCandidate({ changeCodeWithSignoff = false, decision = 'approved' } = {}) {
const root = await mkdtemp(join(tmpdir(), 'boxbox-fidelity-verify-')) const root = await mkdtemp(join(tmpdir(), 'boxbox-fidelity-verify-'))
git(root, 'init') git(root, 'init')
git(root, 'config', 'user.email', 'test@example.com') git(root, 'config', 'user.email', 'test@example.com')
@@ -29,7 +29,7 @@ async function approvedCandidate({ changeCodeWithSignoff = false } = {}) {
const candidate = git(root, 'rev-parse', 'HEAD') const candidate = git(root, 'rev-parse', 'HEAD')
await mkdir(join(root, 'docs/release/owner-reviews'), { recursive: true }) await mkdir(join(root, 'docs/release/owner-reviews'), { recursive: true })
await writeFile(join(root, 'docs/release/owner-reviews/v-test.md'), `- Version: v-test\n- Candidate commit: ${candidate}\n- Reviewed by: Owner\n- Reviewed on: 2026-07-30\n- Decision: approved\n`) await writeFile(join(root, 'docs/release/owner-reviews/v-test.md'), `- Version: v-test\n- Candidate commit: ${candidate}\n- Reviewed by: Owner\n- Reviewed on: 2026-07-30\n- Decision: ${decision}\n`)
if (changeCodeWithSignoff) await writeFile(join(root, 'candidate.txt'), 'changed with approval') if (changeCodeWithSignoff) await writeFile(join(root, 'candidate.txt'), 'changed with approval')
git(root, 'add', 'docs/release/owner-reviews/v-test.md') git(root, 'add', 'docs/release/owner-reviews/v-test.md')
if (changeCodeWithSignoff) git(root, 'add', 'candidate.txt') if (changeCodeWithSignoff) git(root, 'add', 'candidate.txt')
@@ -68,3 +68,13 @@ test('rejects a sign-off commit that also changes code', async () => {
const { evidence, root } = await approvedCandidate({ changeCodeWithSignoff: true }) const { evidence, root } = await approvedCandidate({ changeCodeWithSignoff: true })
assertBlocked(root, evidence) assertBlocked(root, evidence)
}) })
test('rejects a dirty working-tree edit that spoofs approval', async () => {
const { candidate, evidence, root } = await approvedCandidate({ decision: 'rejected' })
await writeFile(join(root, 'docs/release/owner-reviews/v-test.md'), `- Version: v-test\n- Candidate commit: ${candidate}\n- Reviewed by: Owner\n- Reviewed on: 2026-07-30\n- Decision: approved\n`)
assert.throws(() => verify(root, evidence), (error) => {
assert.match(String(error.stderr), /Decision: approved/)
return true
})
})