wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into codex/p0-obs-002-20260715

Browse Source
This commit is contained in:
ogt
2026-07-15 03:59:18 +08:00
parent a18702025f af4cb2fd43
commit dba193273f
4 changed files with 99 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
scripts/security/tests/test_runtime_image_mirror_controller.py
View File

@@ -52,7 +52,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
self.assertEqual(policy.work_item_id, "AIA-P0-006-02A")
self.assertEqual(policy.risk_level, "high")
self.assertEqual(len(policy.images), 13)
self.assertEqual(len(policy.images), 14)
self.assertNotIn("github.com", raw)
self.assertNotIn("ghcr.io", raw)
self.assertIn('"external_pull_allowed": false', raw)
@@ -77,7 +77,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
)
)
container_kinds = [image.workload.container_kind for image in policy.images]
self.assertEqual(container_kinds.count("container"), 10)
self.assertEqual(container_kinds.count("container"), 11)
self.assertEqual(container_kinds.count("init_container"), 3)
def test_policy_loads_and_validates_init_container_kind(self) -> None:
@@ -358,6 +358,33 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
)
self.assertTrue(image.runtime_ref.endswith("@" + image.target_registry_digest))
def test_argocd_redis_main_reuses_verified_staging_artifact(self) -> None:
policy = controller.load_policy(POLICY_PATH)
staging = next(
image
for image in controller.load_staging_policy(STAGING_POLICY_PATH).images
if image.asset_id == "runtime-image:redis-8.2.3-canary"
)
image = next(
image
for image in policy.images
if image.asset_id == "runtime-image:argocd-redis"
)
self.assertEqual(image.source_index_digest, staging.source_index_digest)
self.assertEqual(image.platform_digest, staging.platform_digest)
self.assertEqual(image.push_ref, staging.push_ref)
self.assertEqual(image.workload.kind, "deployment")
self.assertEqual(image.workload.namespace, "argocd")
self.assertEqual(image.workload.name, "argocd-redis")
self.assertEqual(image.workload.container, "redis")
self.assertEqual(image.workload.container_kind, "container")
self.assertEqual(
image.target_registry_digest,
"sha256:1e1de310669186e8a85a676ed5352f6078b09658ee578508f7608fe7beff78f0",
)
self.assertTrue(image.runtime_ref.endswith("@" + image.target_registry_digest))
def test_policy_rejects_external_pull_and_mutable_runtime_ref(self) -> None:
payload = json.loads(POLICY_PATH.read_text(encoding="utf-8"))
with tempfile.TemporaryDirectory() as temp: