cc-ci/tests/unit/test_lint.py

"""Unit tests for the L5 lint executor (harness.lint) — phase lvl5.

Covers the table parser + classifier against real abra-0.13 output shapes (probed on the CI
host 2026-06-11, JOURNAL-lvl5), and run_lint's never-raise / never-silent-pass guarantees via
a fake-PATH `script` shim (no real abra needed). Run cold:
  cc-ci-run -m pytest tests/unit/test_lint.py -q
"""

from __future__ import annotations

import os
import stat
import subprocess
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
from harness import lint as L  # noqa: E402

# Realistic abra lint table rows, as captured on cc-ci: abra renders HEAVY box-drawing
# verticals (┃ U+2503) — the parser must match those, not just the light │.
TABLE_OK = (
    "┏━━━━━━┳━━━━━━┓\r\n"
    "┃ R001 ┃ compose config has expected version         ┃ warn     ┃ ✅        ┃ -       ┃ ensure ┃\r\n"
    "┃ R015 ┃ long secret names                           ┃ warn     ┃ ❌        ┃ -       ┃ reduce ┃\r\n"
    "┃ R008 ┃ .env.sample provided                        ┃ error    ┃ ✅        ┃ -       ┃ create ┃\r\n"
    "┃ R014 ┃ only annotated tags used for recipe version ┃ error    ┃ ✅        ┃ -       ┃ retag  ┃\r\n"
    "┗━━━━━━┻━━━━━━┛\r\n"
    "WARN secret session_secret is longer than 12 characters\r\n"
)

# The light-vertical variant must parse identically (defensive: abra theme/version drift).
TABLE_OK_LIGHT = TABLE_OK.replace("┃", "│")

TABLE_R014_FAIL = (
    TABLE_OK.replace(
        "┃ R014 ┃ only annotated tags used for recipe version ┃ error    ┃ ✅",
        "┃ R014 ┃ only annotated tags used for recipe version ┃ error    ┃ ❌",
    )
    + "WARN critical errors present in hedgedoc config\r\n"
)

TABLE_SKIPPED_ERROR = TABLE_OK.replace(
    "┃ R014 ┃ only annotated tags used for recipe version ┃ error    ┃ ✅        ┃ -       ┃",
    "┃ R014 ┃ only annotated tags used for recipe version ┃ error    ┃ ❌        ┃ skipped ┃",
)


# ---- parse_table ----


def test_parse_table_rows_and_marks():
    rows = L.parse_table(TABLE_OK)
    by = {r["rule"]: r for r in rows}
    assert set(by) == {"R001", "R015", "R008", "R014"}
    assert by["R001"]["severity"] == "warn" and by["R001"]["satisfied"]
    assert by["R015"]["severity"] == "warn" and not by["R015"]["satisfied"]
    assert by["R014"]["severity"] == "error" and by["R014"]["satisfied"]
    assert not any(r["skipped"] for r in rows)


def test_parse_table_strips_ansi():
    rows = L.parse_table("\x1b[1m" + TABLE_OK + "\x1b[0m")
    assert len(rows) == 4


def test_parse_table_light_verticals_too():
    assert L.parse_table(TABLE_OK_LIGHT) == L.parse_table(TABLE_OK)


def test_parse_table_garbage_is_empty():
    assert L.parse_table("FATA something exploded\r\n") == []
    assert L.parse_table("") == []


# ---- classify ----


def test_classify_pass_with_warn_misses_only():
    # warn-severity ❌ (R015) does NOT fail the rung — only error-severity rules do.
    assert L.classify(0, TABLE_OK) == ("pass", "", [])


def test_classify_error_rule_fails():
    status, detail, failed = L.classify(0, TABLE_R014_FAIL)
    assert status == "fail"
    assert failed == ["R014"]
    assert "R014" in detail


def test_classify_skipped_error_rule_does_not_fail_but_sentinel_guards():
    # a skipped error rule isn't counted as failed by the parser, but abra's own sentinel line
    # (if present) still forces fail — the classifier never out-greens abra.
    status, _, failed = L.classify(0, TABLE_SKIPPED_ERROR)
    assert failed == []
    assert status == "pass"
    status2, detail2, _ = L.classify(
        0, TABLE_SKIPPED_ERROR + "WARN critical errors present in x config\r\n"
    )
    assert status2 == "fail"
    assert "critical errors" in detail2


def test_classify_rc0_without_table_is_unver():
    # rc=0 but nothing parseable → cannot claim pass.
    assert L.classify(0, "weird output")[0] == "unver"


def test_classify_content_fata_is_fail():
    out = "FATA unable to validate recipe: .env.sample for x couldn't be read\r\n"
    status, detail, _ = L.classify(1, out)
    assert status == "fail"
    assert "unable to validate recipe" in detail


def test_classify_environment_fata_is_unver():
    out = "FATA unable to fetch tags in /x: repository not found: Not found.\r\n"
    status, detail, _ = L.classify(1, out)
    assert status == "unver"
    assert "fetch tags" in detail


def test_classify_did_not_run_is_unver():
    assert L.classify(None, "")[0] == "unver"


# ---- run_lint: never raises, never silently passes ----


def _mkrecipe(tmp_path):
    repo = tmp_path / "abra" / "recipes" / "fakerec"
    repo.mkdir(parents=True)
    (repo / "compose.yml").write_text("version: '3.8'\n")
    for cmd in (
        ["git", "init", "-q"],
        ["git", "add", "."],
        ["git", "-c", "user.email=t@t", "-c", "user.name=t", "commit", "-qm", "x"],
    ):
        subprocess.run(cmd, cwd=repo, check=True)
    return repo


def _shim(tmp_path, body):
    """Drop a fake `script` executable on PATH (run_lint invokes `script -qec "abra ..."`)."""
    bindir = tmp_path / "bin"
    bindir.mkdir(exist_ok=True)
    sh = bindir / "script"
    sh.write_text("#!/bin/sh\n" + body)
    sh.chmod(sh.stat().st_mode | stat.S_IEXEC)
    return str(bindir)


def test_run_lint_pass_via_shim(tmp_path, monkeypatch):
    _mkrecipe(tmp_path)
    monkeypatch.setenv("ABRA_DIR", str(tmp_path / "abra"))
    out = TABLE_OK.replace("\r\n", "\\n")
    monkeypatch.setenv(
        "PATH", _shim(tmp_path, f'printf "{out}"\nexit 0\n') + os.pathsep + os.environ["PATH"]
    )
    res = L.run_lint("fakerec", None, str(tmp_path / "artifacts"))
    assert res["status"] == "pass"
    txt = (tmp_path / "artifacts" / "lint.txt").read_text()
    assert "abra recipe lint -n fakerec" in txt and "R001" in txt


def test_run_lint_fail_via_shim(tmp_path, monkeypatch):
    _mkrecipe(tmp_path)
    monkeypatch.setenv("ABRA_DIR", str(tmp_path / "abra"))
    out = TABLE_R014_FAIL.replace("\r\n", "\\n")
    monkeypatch.setenv(
        "PATH", _shim(tmp_path, f'printf "{out}"\nexit 0\n') + os.pathsep + os.environ["PATH"]
    )
    res = L.run_lint("fakerec", None, str(tmp_path / "artifacts"))
    assert res["status"] == "fail"
    assert res["rules_failed"] == ["R014"]


def test_run_lint_missing_recipe_is_unver_not_raise(tmp_path, monkeypatch):
    monkeypatch.setenv("ABRA_DIR", str(tmp_path / "abra-none"))
    res = L.run_lint("no-such-recipe", None, str(tmp_path / "artifacts"))
    assert res["status"] == "unver"
    assert res["detail"]
    # lint.txt still written with the failure context (loud, never silent)
    assert (tmp_path / "artifacts" / "lint.txt").exists()


def test_run_lint_abra_blowup_is_unver(tmp_path, monkeypatch):
    _mkrecipe(tmp_path)
    monkeypatch.setenv("ABRA_DIR", str(tmp_path / "abra"))
    monkeypatch.setenv(
        "PATH",
        _shim(tmp_path, 'echo "FATA inappropriate ioctl for device"\nexit 1\n')
        + os.pathsep
        + os.environ["PATH"],
    )
    res = L.run_lint("fakerec", None, None)
    assert res["status"] == "unver"