marcie
d326e6572a
ci/woodpecker/pr/ci Pipeline is pending
- Value guards now reject option-like values: --anything always, and single-dash flag shapes (-h, -i). Previously -b --help consumed --help as the body and performed the write (codex example: issue-close -i --help proceeding to 'Closed GitHub issue #--help'). Multi-char dash-leading text (-start of a list) stays a legal value. - Every remaining direct provider exec (gh/tea/CMD arrays across issue-create/edit/assign/list/view, milestone-*, pr-create/edit, pr-close, issue-close/reopen) wrapped with rc capture and normalized to exit 1 with a stderr message — provider exit 2 no longer collides with the reserved usage-error status. - All 16 usage-contract suites gained option-like and short-flag arms (16/16 green). Existing suites re-verified; test-pr-edit and test-issue-create-interactive-auth fail identically with these changes stashed (environment-coupled, not regressions; documented).
137 lines
4.8 KiB
Bash
Executable File
137 lines
4.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Usage-error contract for issue-close.sh (R1/R4, 2026-08-28).
|
|
#
|
|
# R4: usage errors print to STDERR and exit 2, distinct from provider,
|
|
# credential, and verification failures (exit 1). R1: -b/--body is the
|
|
# canonical comment flag; -c/--comment remains a compatible alias.
|
|
# The comment is OPTIONAL here (an issue may close without one), so unlike
|
|
# issue-comment there is no missing-comment arm.
|
|
#
|
|
# Arms:
|
|
# 1. --help and -h exit 0 and print usage.
|
|
# 2. Unknown option exits 2 with the message on stderr.
|
|
# 3. Missing required -i exits 2 (stderr).
|
|
# 4. A value-less flag (-i -b -c and long forms) exits 2 (stderr).
|
|
# 5. -b and -c both pass parsing (sandboxed runner: the run then fails
|
|
# at credential resolution, nonzero and NOT 2) — no real token is
|
|
# ever read and no provider is contacted.
|
|
# 6. No arm performs any provider request (PATH shims record every
|
|
# invocation; the probe log must stay empty).
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/issue-close-usage}"
|
|
BIN_DIR="$WORK_DIR/bin"
|
|
PROBE_LOG="$WORK_DIR/provider-probes.log"
|
|
OUT_FILE="$WORK_DIR/out.log"
|
|
ERR_FILE="$WORK_DIR/err.log"
|
|
|
|
cleanup() {
|
|
rm -rf "$WORK_DIR"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
mkdir -p "$BIN_DIR"
|
|
: > "$PROBE_LOG"
|
|
|
|
for tool in gh tea curl; do
|
|
cat > "$BIN_DIR/$tool" <<STUB
|
|
#!/usr/bin/env bash
|
|
echo "$tool \$*" >> "$PROBE_LOG"
|
|
exit 0
|
|
STUB
|
|
chmod +x "$BIN_DIR/$tool"
|
|
done
|
|
|
|
run_wrapper() {
|
|
( cd "$WORK_DIR" && PATH="$BIN_DIR:$PATH" "$SCRIPT_DIR/issue-close.sh" "$@" )
|
|
}
|
|
|
|
# Hermetic variant: neutralizes every identity/credential source the wrapper
|
|
# consults so parse-acceptance arms fail at credential resolution in ANY cwd
|
|
# repo (see test-issue-comment-usage-contract.sh for the measured incident).
|
|
run_wrapper_sandboxed() {
|
|
mkdir -p "$WORK_DIR/home" "$WORK_DIR/xdg"
|
|
(
|
|
cd "$WORK_DIR"
|
|
PATH="$BIN_DIR:$PATH" HOME="$WORK_DIR/home" XDG_CONFIG_HOME="$WORK_DIR/xdg" \
|
|
MOSAIC_GIT_IDENTITY="" MOSAIC_BRAIN_HOME="" \
|
|
"$SCRIPT_DIR/issue-close.sh" "$@"
|
|
)
|
|
}
|
|
|
|
fail() {
|
|
echo "FAIL: $*" >&2
|
|
echo "--- stderr ---" >&2
|
|
cat "$ERR_FILE" >&2
|
|
exit 1
|
|
}
|
|
|
|
expect_rc() { # expect_rc <want> <desc> <args...>
|
|
local want="$1" desc="$2" rc=0
|
|
shift 2
|
|
run_wrapper "$@" >"$OUT_FILE" 2>"$ERR_FILE" || rc=$?
|
|
[[ "$rc" -eq "$want" ]] || fail "$desc: rc=$rc, want $want"
|
|
}
|
|
|
|
expect_stderr() { # expect_stderr <pattern> <desc>
|
|
grep -q "$1" "$ERR_FILE" || fail "$2: stderr missing '$1'"
|
|
}
|
|
|
|
# 1. Help exits 0 and prints usage.
|
|
expect_rc 0 "--help exits 0" --help
|
|
grep -q "Usage: issue-close.sh" "$OUT_FILE" || fail "--help did not print usage"
|
|
expect_rc 0 "-h exits 0" -h
|
|
|
|
# 2. Unknown option: rc 2, stderr.
|
|
expect_rc 2 "unknown option exits 2" --bogus
|
|
expect_stderr "unknown option" "unknown option names itself on stderr"
|
|
|
|
# 3. Missing required issue number: rc 2, stderr.
|
|
expect_rc 2 "missing -i exits 2"
|
|
expect_stderr "issue number is required" "missing -i message on stderr"
|
|
|
|
# 4. Value-less flags: rc 2 with "requires a value" on stderr.
|
|
for flag in -i -b -c --issue --body --comment; do
|
|
expect_rc 2 "value-less $flag exits 2" "$flag"
|
|
expect_stderr "requires a value" "value-less $flag message on stderr"
|
|
done
|
|
|
|
# 4a. An option-like value is a MISSING value, not a value (codex PR #1464:
|
|
# -b --help previously consumed --help as the body and performed the write).
|
|
expect_rc 2 "option-like value rejected" -i 5 -b --help
|
|
expect_rc 2 "short flag value rejected" -i 5 -b -h
|
|
expect_stderr "requires a value" "short flag value message on stderr"
|
|
expect_stderr "requires a value" "option-like value message on stderr"
|
|
|
|
# 4b. Parser-failure arms (1-4) must have performed ZERO provider contact.
|
|
if [[ -s "$PROBE_LOG" ]]; then
|
|
echo "FAIL: a parser-failure arm contacted a provider:" >&2
|
|
cat "$PROBE_LOG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# 5. Alias acceptance under the sandbox: both -b and -c carry a value past
|
|
# parsing; the run fails at credential resolution nonzero and NOT 2.
|
|
for flag in -b -c; do
|
|
rc=0
|
|
run_wrapper_sandboxed -i 5 "$flag" "closing note" >"$OUT_FILE" 2>"$ERR_FILE" || rc=$?
|
|
[[ "$rc" -ne 0 ]] || fail "$flag arm unexpectedly succeeded in the sandbox"
|
|
[[ "$rc" -ne 2 ]] || fail "$flag arm misclassified credential failure as a usage error"
|
|
done
|
|
|
|
# 6. Sandbox arms may issue DETECTION reads only (tea login list via the
|
|
# stub); no gh/curl write or read may occur.
|
|
if grep -Ev '^(gh|tea|curl) login list' "$PROBE_LOG" | grep -q .; then
|
|
echo "FAIL: a sandbox arm performed a non-detection provider request:" >&2
|
|
grep -Ev '^(gh|tea|curl) login list' "$PROBE_LOG" >&2
|
|
exit 1
|
|
fi
|
|
if grep -qE '^(gh|curl)' "$PROBE_LOG"; then
|
|
echo "FAIL: gh or curl was invoked during a sandbox arm:" >&2
|
|
grep -E '^(gh|curl)' "$PROBE_LOG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "issue-close.sh usage-contract regression passed (R1/R4)"
|