104 lines
2.7 KiB
Bash
Executable File
104 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
tmp_dir="$(mktemp -d)"
|
|
output_dir="$tmp_dir/out"
|
|
|
|
cleanup() {
|
|
rm -rf "$tmp_dir"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
cat >"$tmp_dir/fake-dbtool" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
if [ "${1:-}" = "--version" ]; then
|
|
echo "fake-dbtool 0.1.0"
|
|
exit 0
|
|
fi
|
|
kind="authentication"
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
59999|59998)
|
|
kind="connection"
|
|
;;
|
|
*failing_query.sql)
|
|
kind="query"
|
|
;;
|
|
esac
|
|
done
|
|
printf '{"status":"error","state":"error","error":{"kind":"%s"}}\n' "$kind"
|
|
exit 2
|
|
EOF
|
|
chmod +x "$tmp_dir/fake-dbtool"
|
|
|
|
QA_HOST_LABEL="runner-host-01" \
|
|
QA_BINARY_PATH_LABEL="./target/release/dbtool" \
|
|
QA_BINARY_VERSION="dbtool 0.1.0" \
|
|
QA_EXECUTION_PATH="host" \
|
|
QA_COMMIT_SHA="deadbeefcafebabe" \
|
|
QA_BRANCH_NAME="qa-fixture-branch" \
|
|
"$root_dir/scripts/qa/run-failure-path-evidence.sh" \
|
|
"$tmp_dir/fake-dbtool" \
|
|
postgres \
|
|
"$output_dir" >/dev/null
|
|
|
|
evidence_file="$output_dir/PG-CONN-AUTH-001.md"
|
|
raw_file="$output_dir/PG-CONN-AUTH-001.out"
|
|
[ -f "$evidence_file" ] || {
|
|
echo "expected evidence markdown not found: $evidence_file" >&2
|
|
exit 80
|
|
}
|
|
[ -f "$raw_file" ] || {
|
|
echo "expected raw output file not found: $raw_file" >&2
|
|
exit 81
|
|
}
|
|
|
|
expected_lines=(
|
|
'### PG-CONN-AUTH-001'
|
|
'- Date (UTC): `'
|
|
'- Operator: `qa-engineer`'
|
|
'- Host: `runner-host-01`'
|
|
'- Execution Path: `host`'
|
|
'- Binary Path: `./target/release/dbtool`'
|
|
'- Binary Version: `dbtool 0.1.0`'
|
|
'- Commit SHA: `deadbeefcafebabe`'
|
|
'- Branch: `qa-fixture-branch`'
|
|
'- Driver: `postgres`'
|
|
'- Scenario ID: `PG-CONN-AUTH-001`'
|
|
'- Command: `./target/release/dbtool connect --driver postgres'
|
|
'- Exit Code: `2`'
|
|
'- Key Output: `status=error, state=error, error.kind=authentication`'
|
|
'Output (excerpt):'
|
|
'```'
|
|
'{"status":"error","state":"error","error":{"kind":"authentication"}}'
|
|
'Verdict:'
|
|
'- Expected: non-zero exit, `status=error`, `state=error`, `error.kind=authentication`, no secret leakage'
|
|
'- Traceability check: `complete` (none)'
|
|
'- Secret leakage check: `not-detected` (exact)'
|
|
'- Actual: see output excerpt above'
|
|
'- Result: `pass`'
|
|
)
|
|
|
|
last_line=0
|
|
for expected in "${expected_lines[@]}"; do
|
|
current_line="$(grep -nF -- "$expected" "$evidence_file" | head -n 1 | cut -d: -f1)"
|
|
if [ -z "$current_line" ]; then
|
|
echo "missing expected markdown line: $expected" >&2
|
|
exit 82
|
|
fi
|
|
if [ "$current_line" -le "$last_line" ]; then
|
|
echo "markdown order regression near: $expected" >&2
|
|
exit 83
|
|
fi
|
|
last_line="$current_line"
|
|
done
|
|
|
|
grep -Fq '{"status":"error","state":"error","error":{"kind":"authentication"}}' "$raw_file" || {
|
|
echo "raw output file content mismatch" >&2
|
|
exit 84
|
|
}
|
|
|
|
echo "failure-path markdown format fixture passed"
|