R-1303: watch — abandoned templates are GAP, a seed's unread pins stay pending (no storm after a seed); 38 checks

scripts/test_security_watch.py

@@ -182,6 +182,12 @@ def t_classes():
           fb["class"] == "BEHIND" and fb["behind"] == "1.5.7-stable", (fb["class"], fb.get("behind"), fb["advisories"]))
     check("W3 redis 7-alpine -> FLOATING", red["class"] == "FLOATING", red["class"])
     check("W3 postgres gap -> GAP (BEHIND still computed: no newer 16-…)", pg["class"] == "GAP", pg["class"])
+    ab = item("msdeluise/plant-it", "0.10.0", "github:MDeLuise/plant-it", group="app")
+    ab["abandoned"] = True
+    seen_before = len(FakeNet({}).seen)
+    run_items([ab], {})
+    check("W3 an abandoned template -> GAP, nothing looked up (no route needed)", ab["class"] == "GAP" and
+          not ab["not_checked"] and seen_before == 0, (ab["class"], ab.get("not_checked")))
     check("W4 a source that fails -> NOT CHECKED, with the reason", down["class"] == "NOT CHECKED" and
           "timed out" in down["not_checked"][0]["why"], down.get("not_checked"))
     lines = w.table(items)
@@ -259,6 +265,17 @@ def t_memory():
     sm, sst, would = w.plan([adv_item("traefik", "GHSA-1"), down("b")], {}, d(1), seed=True)
     check("W7 a seed mails nothing, records the advisory, and says what it would have mailed",
           sm == [] and "traefik|GHSA-1" in sst["advisories"] and kinds(would) == ["advisory"], (kinds(sm), kinds(would)))
+    unread = clean("immich")
+    unread["adv_unread"] = True
+    _, sst, _ = w.plan([adv_item("traefik", "GHSA-1"), unread], {}, d(1), seed=True)
+    check("W7 a pin the seed could not read is PENDING", sst["seed_pending"] == ["immich"], sst.get("seed_pending"))
+    first = adv_item("immich", "GHSA-im1", group="app")
+    newapp = adv_item("newapp", "GHSA-na1", group="app")
+    pm, sst, _ = w.plan([adv_item("traefik", "GHSA-1"), first, newapp], sst, d(2))
+    check("W7 its first real read is recorded SILENTLY; a pin added later still mails",
+          "immich|GHSA-im1" in sst["advisories"] and sst["seed_pending"] == [] and
+          [m for m in pm if m["kind"] == "advisory" and "GHSA-im1" in m["text"]] == [] and
+          any(m["kind"] == "advisory" and "GHSA-na1" in m["text"] for m in pm), (kinds(pm), sst.get("seed_pending")))
 
 
 def t_inventory():