Skip to content

[purelock] Lock down parsePermissionsConfig, validateImportInputType, resolveRuntimeCooldown with pure-function test suites - #51374

Merged
pelikhan merged 1 commit into
mainfrom
purelock-parsePermissionsConfig-validateImportInputType-resolveRuntimeCooldown-23adc527de274c81
Aug 8, 2026
Merged

[purelock] Lock down parsePermissionsConfig, validateImportInputType, resolveRuntimeCooldown with pure-function test suites#51374
pelikhan merged 1 commit into
mainfrom
purelock-parsePermissionsConfig-validateImportInputType-resolveRuntimeCooldown-23adc527de274c81

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Adds maximum-coverage testify test suites for three pure functions selected from the ranked candidate list.

parsePermissionsConfig (pkg/workflow/frontmatter_parsing.go:244)

func parsePermissionsConfig(permissions map[string]any) (*PermissionsConfig, error)

Why pure: takes a map[string]any and returns a new *PermissionsConfig and error; no I/O, no globals, no mutation of the input map. Precompute notes: "no observable side effects detected". Confirmed by reading the full function body — it only reads from the input map and writes into a freshly allocated struct.

Coverage: function 49.1% → 100.0%; package pkg/workflow ~86.7% → 86.8%.

Tests: 8 top-level tests, 5 table-driven subtests for shorthand recognition, plus dedicated tests for non-shorthand fallback, non-string shorthand values, all GitHub Actions scopes, all GitHub App scopes, unknown/ignored scopes, empty map, and the "multiple entries never shorthand" rule. ~13 test functions / 5 subtests, 60+ assertions covering every switch case.

Fuzzing: not used — input is a bounded enum-keyed map, table-driven cases give full branch coverage. No residual uncovered lines.

validateImportInputType (pkg/parser/import_schema_validation.go:120)

func validateImportInputType(name string, value any, declaredType string, paramDef map[string]any, importPath string) error

Why pure: returns only an error derived from its inputs (recursing into itself and validateObjectInput, which is also pure); no side effects. Precompute notes: "no observable side effects detected".

Coverage: function 15.6% → 100.0%; package pkg/parser ~70.9% (unchanged at package level rounding, function fully covered).

Tests: 7 test functions covering string, number (all Go numeric types), boolean, choice (including options-not-a-list, non-string options entries, and no-options-declared branches), array (including nested recursive item validation and error propagation with indexed names), object delegation, and unknown declared types. ~40 assertions total. Renamed local helper to TestValidateImportInputType_NumberAllTypes to avoid colliding with an existing TestValidateImportInputType_Number in import_field_extractor_test.go.

Fuzzing: not used — input space is a small fixed set of declaredType values with well-defined type-switch branches; table/branch coverage is exhaustive. No residual uncovered lines.

resolveRuntimeCooldown (pkg/workflow/nodejs.go:351)

func resolveRuntimeCooldown(workflowData *WorkflowData, runtimeID string) bool

Why pure: reads only from the passed-in *WorkflowData and returns a bool; no mutation, no I/O. Precompute notes: "no observable side effects detected".

Coverage: function 34.5% → 100.0%; package pkg/workflow ~86.7% → 86.8% (shared with parsePermissionsConfig above).

Tests: nil-workflowData default, table-driven typed-runtime-config coverage for all 12 supported runtime IDs (cooldown-false / cooldown-true / cooldown-nil-falls-through = 36 subtests), unknown runtime ID fallthrough, nil ParsedFrontmatter/RuntimesTyped fallback, and 6 legacy Runtimes map[string]any branch cases (missing key, wrong type, missing cooldown key, non-bool cooldown, explicit true/false). ~50 assertions total.

Fuzzing: not used — bounded runtime-ID enum and boolean/nil combinations are fully enumerated by table-driven subtests. No residual uncovered lines.


Validation performed for all three: gofmt -l clean, go vet ./pkg/workflow/ ./pkg/parser/ clean, go test ./pkg/workflow/ ./pkg/parser/ -race -count=1 passing, coverage confirmed via go tool cover -func.

Generated by 🔐 PureLock · auto · 111.4 AIC · ⌖ 17.7 AIC · ⊞ 10.7K ·

  • expires on Aug 13, 2026, 4:50 AM UTC-08:00

…ateImportInputType, resolveRuntimeCooldown
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown
ContributorAuthor

Great work! 🎉 This PR adds comprehensive test coverage for three critical pure functions in pkg/workflow/ and pkg/parser/. The test suites are well-structured with clear coverage goals:

  • parsePermissionsConfig: 49.1% → 100% function coverage with exhaustive enum and edge case testing
  • validateImportInputType: 15.6% → 100% function coverage with recursive validation and type-system testing
  • resolveRuntimeCooldown: 34.5% → 100% function coverage with runtime configuration testing

Each test file demonstrates thoughtful test design — from table-driven subtests to explicit error-path validation. The PR body clearly documents why each function qualifies as pure, what the tests cover, and validation performed (gofmt, go vet, go test -race). This looks ready for review and merge. ✅

Generated by ✅ Contribution Check · auto · 70.5 AIC · ⌖ 3.07 AIC · ⊞ 8.7K ·

@pelikhan
pelikhan marked this pull request as ready for review August 8, 2026 14:54
CopilotAI balanced review requested due to automatic review settings August 8, 2026 14:54
@pelikhan
pelikhan merged commit 5ae4711 into mainAug 8, 2026
9 checks passed
@pelikhan
pelikhan deleted the purelock-parsePermissionsConfig-validateImportInputType-resolveRuntimeCooldown-23adc527de274c81 branch August 8, 2026 14:55
@github-actions

github-actionsBot commented Aug 8, 2026

Copy link
Copy Markdown
ContributorAuthor

Test Quality Sentinel completed test quality analysis.

🧪 Test quality analysis by Test Quality Sentinel

@github-actions

github-actionsBot commented Aug 8, 2026

Copy link
Copy Markdown
ContributorAuthor

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

@github-actions

github-actionsBot commented Aug 8, 2026

Copy link
Copy Markdown
ContributorAuthor

Design Decision Gate 🏗️ failed during design decision gate check.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

@github-actions

github-actionsBot commented Aug 8, 2026

Copy link
Copy Markdown
ContributorAuthor

PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds exhaustive unit tests for three pure parsing and runtime-resolution helpers.

Changes:

  • Covers permission shorthand and scope parsing.
  • Tests import input type validation branches.
  • Tests typed and legacy runtime cooldown resolution.
Show a summary per file
FileDescription
pkg/workflow/nodejs_cooldown_test.goTests cooldown defaults and runtime configurations.
pkg/workflow/frontmatter_parsing_permissions_test.goTests permission parsing paths and scopes.
pkg/parser/import_schema_validation_input_type_test.goTests supported input types and validation errors.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 3/3 changed files
  • Comments generated: 2
  • Review effort level: Balanced

wantShort: "read-all",
},
{
name: "shorthand as key with any value",
err = validateImportInputType("level", "low", "choice", map[string]any{}, "owner/repo/import.md")
assert.NoError(t, err)

// Options declared but not a []any: falls through the type switch (options ignored) -> no match -> error.
@github-actionsgithub-actionsBot mentioned this pull request Aug 8, 2026

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 36.1 AIC · ⌖ 10.3 AIC · ⊞ 7.1K
Comment /matt to run again


// Matching option.
paramDef := map[string]any{"options": []any{"low", "medium", "high"}}
err = validateImportInputType("level", "medium", "choice", paramDef, "owner/repo/import.md")

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/tdd] Misleading comment: the trailing -> error is wrong — the assertion is assert.NoError. When options is not a []any, the implementation skips the match loop and returns nil. The comment should say -> no error, not -> error.

💡 Suggested fix
// Options declared but not a []any: options ignored (type switch falls through) -> no error.

The current wording implies an error is expected, which contradicts the assertion and could mislead future readers.

@copilot please address this.

@github-actions

Copy link
Copy Markdown
ContributorAuthor

Test Quality Sentinel 🧪 — Score: ❌ REQUEST_CHANGES

Overall Score: Cannot approve — hard violation present.

Summary

3 new test files, 20 test functions, 118 total assertions, excellent edge-case coverage with comprehensive table-driven parametric testing.

Critical Issue: All 3 test files are missing the mandatory (go/redacted):build tag on line 1 (e.g., (go/redacted):build !integration). This is a hard violation per gh-aw developer conventions.


Violations & Issues

❌ Hard Violation: Missing Build Tags

All 3 test files lack the mandatory (go/redacted):build tag on line 1:

pkg/parser/import_schema_validation_input_type_test.go line 1: package parser (missing (go/redacted):build)
pkg/workflow/frontmatter_parsing_permissions_test.go line 1: package workflow (missing (go/redacted):build)
pkg/workflow/nodejs_cooldown_test.go line 1: package workflow (missing (go/redacted):build)

Required fix: Add (go/redacted):build !integration to line 1 of each test file.


Test Quality Assessment

3 new test files with 20 test functions and 118 assertions provide excellent behavioral coverage:

  • Import Schema Validation (130 lines): 7 tests covering type validation, 12 numeric variants, choice options, arrays with recursive validation, objects, unknown types
  • Permissions Config (227 lines): 8 tests covering 44 GitHub scopes (15 Actions + 29 App), shorthand variants, edge cases
  • Runtime Cooldown (131 lines): 5 tests covering all 12 supported runtimes with 36+ subtests for state transitions

Strengths:
✅ Comprehensive scope enumeration and edge-case coverage
✅ Table-driven test patterns for parametric coverage
✅ Healthy test inflation ratios (0.33–0.63:1)
✅ Error assertion discipline with descriptive context
✅ No forbidden mocks (pure-function tests)

Action Required: Add build tags to proceed.

🧪 Test quality analysis by Test Quality Sentinel · haiku45 · 29.9 AIC · ⌖ 5.05 AIC · ⊞ 7.7K ·
Comment /review to run again

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Test Quality Sentinel: Hard violation detected.

Missing build tags on all 3 test files (required: (go/redacted):build !integration). Test quality is excellent (118 assertions, 20 tests, comprehensive edge-case coverage), but this is a procedural blocker per gh-aw developer conventions. Add build tags to line 1 of each test file to proceed.

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review: Pure-function test suites for parsePermissionsConfig, validateImportInputType, resolveRuntimeCooldown

The test coverage is comprehensive and well-structured. One blocking issue found:

parsePermissionsConfig shorthand inconsistency — the new tests lock in "read" and "write" as valid shorthand values, but permissions_parser.go explicitly removed them from the shorthand list because they generate invalid GitHub Actions YAML. The two implementations disagree, and the new tests solidify the inconsistency rather than exposing it as a bug. Please align parsePermissionsConfig's shorthandPerms with the narrower list in permissions_parser.go and update the tests accordingly.

Other observations (non-blocking)
  • The TestValidateImportInputType_Choice test case for options: "not-a-list" comments "no match -> error" but asserts NoError. The comment is misleading; the actual behavior (no error because the type switch on opts simply doesn't match []any) is correct but the inline reasoning is confusing.
  • TestResolveRuntimeCooldown_TypedRuntimeConfig is thorough and the table-driven approach is appropriate for covering all runtime IDs.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 50.8 AIC · ⌖ 6.96 AIC · ⊞ 5.5K

assert.Equal(t, "read", config.OrganizationCustomProperties)
assert.Equal(t, "write", config.OrganizationCustomRepositoryRoles)
assert.Equal(t, "read", config.OrganizationAnnouncementBanners)
assert.Equal(t, "read", config.OrganizationEvents)

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent shorthand definition between parsePermissionsConfig and PermissionsParser.

permissions_parser.go:104-105 explicitly states:

// Note: "read" and "write" are no longer valid shorthands as they create invalid GitHub Actions YAML
shorthandPerms := []string{"read-all", "write-all", "none"}

But parsePermissionsConfig (in frontmatter_parsing.go:251) still includes "read" and "write" in its shorthandPerms. This new test cements that broader behavior.

This is either a latent bug in parsePermissionsConfig (should match permissions_parser.go's narrower list), or the test is locking in incorrect behavior. Please align the two implementations and update the test accordingly.

@copilot please address this.

@github-actions

Copy link
Copy Markdown
ContributorAuthor

🎉 This pull request is included in a new release.

Release: v0.86.2

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@pelikhan