SemianiakaVY/openpencil
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

fix(ci): treat default-filename cfg(test) modules as test-only source

Browse source 
The collab security-boundary scanner excludes external test modules
from its production-source checks, but only recognized the explicit
`#[cfg(test)] #[path = "..."] mod x;` form. A plain
`#[cfg(test)] mod production_check_tests;` (default filename) fell
through and its deterministic test signing seeds tripped the
"signing seed leaked into production source" rule. Resolve the default
`name.rs` / `name/mod.rs` sibling too. All 57 boundary mutation tests
still pass.
This commit is contained in:
Kayshen-X 2026-08-09 23:19:29 +08:00
parent d5b0088cfb
commit e29c784a5a
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
tools/check-collab-security-boundaries.sh
View file

@ -99,6 +99,16 @@ cfg_test_external_module_files() {
cfg_test && /^[[:space:]]*(pub(\([^)]*\))?[[:space:]]+)?mod[[:space:]]+[A-Za-z_][A-Za-z0-9_]*[[:space:]]*;[[:space:]]*$/ {
if (module_path != "") {
print module_path
} else {
# No #[path]: a `#[cfg(test)] mod name;` resolves to its
# default sibling file, `name.rs` (or `name/mod.rs`).
# Emit both so either layout is recognized as a test-only
# module rather than scanned as production source.
name = $0
sub(/^[[:space:]]*(pub(\([^)]*\))?[[:space:]]+)?mod[[:space:]]+/, "", name)
sub(/[[:space:]]*;.*$/, "", name)
print name ".rs"
print name "/mod.rs"
}
reset_attributes()
next