security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

2026-10-19 21:11:31 +02:00
parent c4b3b0a039
commit a03c25aa1f
5 changed files with 56 additions and 0 deletions
@@ -50,6 +50,11 @@ COVERS = {
                         "key left out of the map (v0.252.0, R-557); a call that lost an argument, and a key glued "
                         "to more text with + (R-576)",
    "gofmt":             "R-454: a planted unformatted .go file in internal/ is convicted; the clean tree passes",
+    "security-scan":     ("R-986: the shared gate's own decoys (felhom.eu scripts/test_security_scan_gate.py, 8 cases "
+                          "in SCRATCH git repos: a planted token listed by rule and file, its value never printed; a "
+                          "second secret on another line of an accepted file still listed; a called govulncheck "
+                          "finding listed, an imported-only one not; no tool is NOT CHECKED out loud), run from here; "
+                          "plus the gate on THIS repo: exit 0 and its summary line (warn-first)"),
    "offbox-rename":     "R-425: NAS branding in a NEW backups*.html, and in a bundle value an offbox Go file "
                         "names; control: the same token in the network-storage feature's copy is accepted",
    "docker-v":          "R-426: an unallowlisted `-v /etc:/x` in a NEW .go file two directories down "
@@ -506,6 +511,28 @@ def shared_cases():

 shared_cases()

+
+def security_cases():
+    """R-986: the shared scanner's decoys (they build their own scratch repos), then the gate on this repo."""
+    global ran
+    suite, gate_ = os.path.join(SHARED, "test_security_scan_gate.py"), os.path.join(SHARED, "security_scan_gate.py")
+    for f in (suite, gate_):
+        if not os.path.isfile(f):
+            fails.append("shared %s is MISSING beside this clone - a failure, never a skip" % f)
+            return
+    for name, argv, must in (("security-scan: the shared gate's 8 decoys", [sys.executable, suite], "all 8 cases passed"),
+                             ("security-scan: GENUINE: this repo, warn-first", [sys.executable, gate_, REPO],
+                              "security-scan:")):
+        ran += 1
+        rc, out = _run(argv, REPO)
+        if rc != 0 or must not in out:
+            fails.append("%s: rc=%d, %r missing\n%s" % (name, rc, must, out[-700:]))
+        else:
+            print("  ok  %s" % name)
+
+
+security_cases()
+
 print()
 if fails:
    for f in fails: