Skip to content

gate-of-the-gate: PR-time smoke of promotion-gate.yml's heart - #151

Merged
mdheller merged 1 commit into
mainfrom
harden/gate-of-the-gate
Aug 4, 2026
Merged

gate-of-the-gate: PR-time smoke of promotion-gate.yml's heart#151
mdheller merged 1 commit into
mainfrom
harden/gate-of-the-gate

Conversation

@mdheller

@mdheller mdheller commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

promotion-gate.yml false-negatived twice on v150.0.6 in one hour: (1) hardcoded 7zz not on Ubuntu 22.04, (2) plistutil-grep-sed chain returned empty on binary plist. Both quarantined a good artifact. Both would have been caught in PR-time seconds if the gate's own logic had unit tests.

Adds

  • scripts/tests/test_promotion_gate.py — 12 assertions covering plist extraction (binary + XML), missing-key returns '' not crash, update-check hygiene grep, meta-check that shipped autoconfig has all 3 hygiene keywords, 7z-family binary discoverable after apt install, gate workflow still has 5 load-bearing steps, regression assertions (uses plistlib not sed, uses detect-loop not hardcoded 7zz).
  • packaging-and-update-tests.yml — new job promotion-gate-heart fires on any change to promotion-gate.yml or the test file. Installs p7zip-full (mirrors what the real gate does).

Adversarial-review checklist

  • Sensitive network fetches — N/A
  • String parsers — the tests ARE string-parser tests
  • Packaged-artifact assertions — the tests ARE artifact assertions
  • FINAL_TARGET_FILES — N/A
  • Auth / IAM changes — N/A
  • Version metadata — one test asserts plist version=tag comparison
  • Silent-skip guards — no silent skips added
  • Firefox/Mozilla/LibreWolf strings — none

Test plan

python -m pytest scripts/tests/test_promotion_gate.py -q → 11 passed, 1 skipped (Linux-only 7z test). Runs green locally on macOS.

promotion-gate.yml false-negatived twice on v150.0.6 in one hour:

  1. First run 127'd on 'hardcoded 7zz not found' — 7zip package only
     exists on Ubuntu 24+; ubuntu-latest is 22.04 (p7zip-full, binary 7z)
  2. Retry silently returned empty version — plistutil failed silently,
     grep matched the binary blob, sed yielded nothing. '' != '150.0.6'
     → quarantined a GOOD artifact

Both would have been caught in PR time in seconds if the gate's own
logic had unit tests. Adds:

- scripts/tests/test_promotion_gate.py — 12 assertions:
  - plist extraction against binary + XML fixtures (the failure mode)
  - missing-key returns '' not crash
  - update-check hygiene grep table
  - meta-check that shipped bearstart-autoconfig.js still has all
    three hygiene keywords
  - 7z-family binary discoverable after apt install
  - gate workflow still has all 5 load-bearing steps
  - regressions asserted: uses plistlib, NOT grep|sed;
    uses detect loop, NOT hardcoded 7zz

- packaging-and-update-tests.yml — new job promotion-gate-heart runs
  the tests + installs p7zip-full (mirrors what the real gate does)
  on any change to promotion-gate.yml or the test file

Meta-principle encoded in test names: 'gates that catch bug classes
must themselves be exercised, and their regressions must fire in the
PR, not at release publish.'
@mdheller
mdheller merged commit 4d80b85 into main Aug 4, 2026
20 checks passed
@mdheller
mdheller deleted the harden/gate-of-the-gate branch August 4, 2026 08:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant