0b8a271270
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Successful in 2m36s
CD Pipeline / build-and-deploy (push) Successful in 7m2s
CD Pipeline / post-deploy-checks (push) Successful in 1m53s
111 lines
3.6 KiB
Python
111 lines
3.6 KiB
Python
from __future__ import annotations
|
|
|
|
import inspect
|
|
|
|
from src.services.awooop_ansible_check_mode_service import (
|
|
_apply_ansible_playbook_trust_gate,
|
|
_revalidate_claim_playbook_trust,
|
|
run_controlled_apply_for_claim,
|
|
)
|
|
|
|
|
|
def _candidate(catalog_id: str) -> dict[str, object]:
|
|
return {
|
|
"catalog_id": catalog_id,
|
|
"playbook_path": f"infra/ansible/playbooks/{catalog_id.split(':', 1)[1]}.yml",
|
|
"inventory_hosts": ["host_188"],
|
|
"risk_level": "medium",
|
|
}
|
|
|
|
|
|
def test_low_trust_failed_playbook_opens_claim_circuit() -> None:
|
|
guarded, gate = _apply_ansible_playbook_trust_gate(
|
|
{"executor_candidates": [_candidate("ansible:nginx-sync")]},
|
|
[
|
|
{
|
|
"playbook_id": "PB-ANSIBLE-NGINX-SYNC",
|
|
"status": "approved",
|
|
"trust_score": 0.001417,
|
|
"success_count": 0,
|
|
"failure_count": 24,
|
|
"review_required": False,
|
|
}
|
|
],
|
|
)
|
|
|
|
assert guarded["executor_candidates"] == []
|
|
assert gate["status"] == "circuit_open"
|
|
assert gate["blocked_candidate_count"] == 1
|
|
assert gate["decisions"][0]["reason"] == (
|
|
"playbook_trust_below_archive_threshold"
|
|
)
|
|
assert gate["next_controlled_action"] == (
|
|
"generate_or_verify_playbook_repair_candidate"
|
|
)
|
|
|
|
|
|
def test_low_trust_candidate_is_filtered_without_blocking_healthy_candidate() -> None:
|
|
healthy = _candidate("ansible:188-momo-backup-user")
|
|
guarded, gate = _apply_ansible_playbook_trust_gate(
|
|
{
|
|
"executor_candidates": [
|
|
_candidate("ansible:nginx-sync"),
|
|
healthy,
|
|
]
|
|
},
|
|
[
|
|
{
|
|
"playbook_id": "PB-ANSIBLE-NGINX-SYNC",
|
|
"status": "approved",
|
|
"trust_score": 0.01,
|
|
"success_count": 0,
|
|
"failure_count": 15,
|
|
"review_required": True,
|
|
},
|
|
{
|
|
"playbook_id": "PB-ANSIBLE-188-MOMO-BACKUP-USER",
|
|
"status": "approved",
|
|
"trust_score": 0.65,
|
|
"success_count": 7,
|
|
"failure_count": 1,
|
|
"review_required": False,
|
|
},
|
|
],
|
|
)
|
|
|
|
assert guarded["executor_candidates"] == [healthy]
|
|
assert gate["status"] == "degraded_candidates_filtered"
|
|
assert gate["eligible_candidate_count"] == 1
|
|
assert gate["blocked_candidate_count"] == 1
|
|
|
|
|
|
def test_owner_review_flag_does_not_become_low_medium_high_terminal_gate() -> None:
|
|
candidate = _candidate("ansible:188-momo-backup-user")
|
|
guarded, gate = _apply_ansible_playbook_trust_gate(
|
|
{"executor_candidates": [candidate]},
|
|
[
|
|
{
|
|
"playbook_id": "PB-ANSIBLE-188-MOMO-BACKUP-USER",
|
|
"status": "approved",
|
|
"trust_score": 0.4,
|
|
"success_count": 2,
|
|
"failure_count": 1,
|
|
"review_required": True,
|
|
}
|
|
],
|
|
)
|
|
|
|
assert guarded["executor_candidates"] == [candidate]
|
|
assert gate["status"] == "closed"
|
|
assert gate["owner_review_used_as_terminal"] is False
|
|
|
|
|
|
def test_controlled_apply_revalidates_trust_before_runtime_write() -> None:
|
|
apply_source = inspect.getsource(run_controlled_apply_for_claim)
|
|
revalidate_source = inspect.getsource(_revalidate_claim_playbook_trust)
|
|
|
|
assert "_revalidate_claim_playbook_trust" in apply_source
|
|
assert "ansible_controlled_apply_blocked_by_playbook_trust" in apply_source
|
|
assert "playbook_trust_circuit_open" in revalidate_source
|
|
assert "UPDATE automation_operation_log" in revalidate_source
|