From 554c31a1b37a65fe8694f8df7b7dea7b53ee29dc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:43:53 +0900 Subject: [PATCH 1/6] test(codeql): align receipt fixtures with exact evidence Signed-off-by: Seongho Bae --- tests/test_codeql_pr_workflow_contract.py | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py index 35274ce60a..27d28b5d95 100644 --- a/tests/test_codeql_pr_workflow_contract.py +++ b/tests/test_codeql_pr_workflow_contract.py @@ -417,6 +417,21 @@ def test_codeql_pr_one_shot_read_ignores_status_forged_by_non_opencode_creator(t _codeql_status("success", creator="attacker"), _codeql_status("failure"), ], + producer_jobs={ + "jobs": [ + {"name": "validate-dispatch", "status": "completed", "conclusion": "success"}, + { + "name": "CodeQL dispatch scan (python)", + "status": "completed", + "conclusion": "failure", + "run_attempt": 1, + "steps": [ + {"name": "Enforce CodeQL Medium+ SARIF gate", "conclusion": "failure"}, + {"name": "Preserve CodeQL SARIF evidence", "conclusion": "success"}, + ], + }, + ] + }, ) assert dispatch_result.returncode == 0, dispatch_result.stderr assert verdict_result.returncode == 1, verdict_result.stderr @@ -677,12 +692,14 @@ def test_codeql_pr_rejects_two_complete_duplicate_title_runs( ) def test_codeql_pr_app_receipt_requires_exact_dispatch_evidence( - tmp_path: Path, + tmp_path: Path, field: str, value: object, ) -> None: """An App-created status cannot bypass exact producer artifact proof.""" + invalid_status = _codeql_status("success") + invalid_status[field] = value dispatch_result, verdict_result = _run_verdict_read( tmp_path, - statuses=[_codeql_status("success")], + statuses=[invalid_status], producer_artifacts={"total_count": 0, "artifacts": []}, expect_dispatch_failure=True, ) From 27c660c9a9907ca1921f62682295db76a1e7092c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:50:50 +0900 Subject: [PATCH 2/6] test(codeql): fix fallback fixture signature Signed-off-by: Seongho Bae --- tests/test_codeql_pr_workflow_contract.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py index 27d28b5d95..60b670e11a 100644 --- a/tests/test_codeql_pr_workflow_contract.py +++ b/tests/test_codeql_pr_workflow_contract.py @@ -739,7 +739,7 @@ def test_codeql_coordinator_app_receipts_require_exact_dispatch_evidence( assert post_log.exists() def test_codeql_pr_rejects_self_repository_fallback_without_exact_dispatch_provenance( - tmp_path: Path, field: str, value: object, + tmp_path: Path, ) -> None: """A github-actions status alone cannot impersonate the protected dispatcher.""" producer_run: dict[str, object] = { @@ -757,7 +757,6 @@ def test_codeql_pr_rejects_self_repository_fallback_without_exact_dispatch_prove + "/" + "a" * 40 + "/42" ), } - producer_run[field] = value dispatch_result, verdict_result = _run_verdict_read( tmp_path, statuses=[_codeql_status("success", creator="github-actions[bot]")], From adfa1d43c78f35193458183c88e91ec9a21abd78 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:55:41 +0900 Subject: [PATCH 3/6] test(codeql): preserve explicit empty evidence fixtures Signed-off-by: Seongho Bae --- tests/test_codeql_pr_workflow_contract.py | 60 ++++++++++------------- 1 file changed, 27 insertions(+), 33 deletions(-) diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py index 60b670e11a..ff52aecf7d 100644 --- a/tests/test_codeql_pr_workflow_contract.py +++ b/tests/test_codeql_pr_workflow_contract.py @@ -214,41 +214,35 @@ def _run_verdict_read( f"{'a' * 40}/42/{'c' * 40}" ), } - producer_jobs = producer_jobs or { - "jobs": [ - { - "name": "validate-dispatch", - "status": "completed", - "conclusion": "success", - }, - { - "name": "CodeQL dispatch scan (python)", - "status": "completed", - "conclusion": "success", - "run_attempt": 1, - "steps": [ - { - "name": "Enforce CodeQL Medium+ SARIF gate", - "conclusion": "success", - }, - { - "name": "Preserve CodeQL SARIF evidence", - "conclusion": "success", - }, - ], - }, - ] - } - producer_artifacts = producer_artifacts or { - "total_count": 1, - "artifacts": [{ - "name": "codeql-dispatch-python-123-1", - "expired": False, - }], - } + if producer_jobs is None: + producer_jobs = { + "jobs": [ + { + "name": "validate-dispatch", + "status": "completed", + "conclusion": "success", + }, + { + "name": "CodeQL dispatch scan (python)", + "status": "completed", + "conclusion": "success", + "run_attempt": 1, + "steps": [ + {"name": "Enforce CodeQL Medium+ SARIF gate", "conclusion": "success"}, + {"name": "Preserve CodeQL SARIF evidence", "conclusion": "success"}, + ], + }, + ] + } + if producer_artifacts is None: + producer_artifacts = { + "total_count": 1, + "artifacts":[{"name": "codeql-dispatch-python-123-1", "expired": False}], + } incomplete_predecessor = dict(producer_run) incomplete_predecessor["id"] = 122 - producer_runs = producer_runs or [producer_run] + if producer_runs is None: + producer_runs = [producer_run] fake_bin = tmp_path / "bin" fake_bin.mkdir() From f90651f3995841332320659cf194f26c5a263b23 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:58:01 +0900 Subject: [PATCH 4/6] test(codeql): assert fail-closed receipt handling Signed-off-by: Seongho Bae --- tests/test_codeql_pr_workflow_contract.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py index ff52aecf7d..2632d70a78 100644 --- a/tests/test_codeql_pr_workflow_contract.py +++ b/tests/test_codeql_pr_workflow_contract.py @@ -778,10 +778,13 @@ def test_codeql_pr_ignores_trusted_status_without_current_base_receipt( }, _codeql_status("failure"), ], + producer_jobs={"jobs": []}, + producer_artifacts={"artifacts": []}, + expect_dispatch_failure=True, ) - assert dispatch_result.returncode == 0, dispatch_result.stderr + assert dispatch_result.returncode == 1, dispatch_result.stderr assert verdict_result.returncode == 1, verdict_result.stderr - assert "did not pass (state=failure)" in verdict_result.stdout + assert "without an authenticated terminal verdict" in dispatch_result.stdout @pytest.mark.parametrize( @@ -806,10 +809,13 @@ def test_codeql_pr_ignores_incomplete_or_mismatched_receipt( dispatch_result, verdict_result = _run_verdict_read( tmp_path, statuses=[invalid_status, _codeql_status("failure")], + producer_jobs={"jobs": []}, + producer_artifacts={"artifacts": []}, + expect_dispatch_failure=True, ) - assert dispatch_result.returncode == 0, dispatch_result.stderr + assert dispatch_result.returncode == 1, dispatch_result.stderr assert verdict_result.returncode == 1, verdict_result.stderr - assert "did not pass (state=failure)" in verdict_result.stdout + assert "without an authenticated terminal verdict" in dispatch_result.stdout @pytest.mark.parametrize("state,exit_code", [("success", 0), ("failure", 1)]) From 80775ade92e7d32cf88ef76222ea9be03239127e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:08:45 +0900 Subject: [PATCH 5/6] test(codeql): bind paginated verdict fixture state Signed-off-by: Seongho Bae --- tests/test_codeql_pr_workflow_contract.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py index 2632d70a78..ec7343fc0f 100644 --- a/tests/test_codeql_pr_workflow_contract.py +++ b/tests/test_codeql_pr_workflow_contract.py @@ -830,6 +830,21 @@ def test_codeql_pr_reads_trusted_verdict_on_second_page( for _ in range(100) ], second_page=[_codeql_status(state)], + producer_jobs={ + "jobs": [ + {"name": "validate-dispatch", "status": "completed", "conclusion": "success"}, + { + "name": "CodeQL dispatch scan (python)", + "status": "completed", + "conclusion": state, + "run_attempt": 1, + "steps": [ + {"name": "Enforce CodeQL Medium+ SARIF gate", "conclusion": state}, + {"name": "Preserve CodeQL SARIF evidence", "conclusion": "success"}, + ], + }, + ] + }, ) assert dispatch_result.returncode == 0, dispatch_result.stderr assert verdict_result.returncode == exit_code, verdict_result.stderr From 1d64118c7e2f8a7e7b926b3d6bfc265b3c7c8d2c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:15:27 +0900 Subject: [PATCH 6/6] test(codeql): model coordinator producer evidence Signed-off-by: Seongho Bae --- tests/test_codeql_pr_workflow_contract.py | 47 +++++++++++++++++++++-- 1 file changed, 43 insertions(+), 4 deletions(-) diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py index ec7343fc0f..4577ed3620 100644 --- a/tests/test_codeql_pr_workflow_contract.py +++ b/tests/test_codeql_pr_workflow_contract.py @@ -1216,6 +1216,34 @@ def _run_coordinator( return result, post_log, post_body +def _complete_dispatch_evidence( + states: dict[str, str], +) -> tuple[list[dict[str, object]], list[dict[str, object]]]: + """Build exact producer job and artifact pages for coordinator fixtures.""" + jobs = [{ + "name": "validate-dispatch", + "status": "completed", + "conclusion": "success", + }] + artifacts = [] + for language, state in states.items(): + jobs.append({ + "name": f"CodeQL dispatch scan ({language})", + "status": "completed", + "conclusion": state, + "run_attempt": 1, + "steps": [ + {"name": "Enforce CodeQL Medium+ SARIF gate", "conclusion": state}, + {"name": "Preserve CodeQL SARIF evidence", "conclusion": "success"}, + ], + }) + artifacts.append({ + "name": f"codeql-dispatch-{language}-123-1", + "expired": False, + }) + return [{"jobs": jobs}], [{"artifacts": artifacts}] + + def test_codeql_coordinator_posts_one_dispatch_for_every_pending_language( tmp_path: Path, ) -> None: @@ -1246,8 +1274,11 @@ def test_codeql_coordinator_keeps_all_failed_jobs_when_one_language_is_pending( tmp_path: Path, ) -> None: """Run-wide settlement keeps every failed job while scanning only pending languages.""" + producer_jobs, producer_artifacts = _complete_dispatch_evidence({"python": "success"}) result, post_log, post_body = _run_coordinator( tmp_path, + producer_jobs=producer_jobs, + producer_artifacts=producer_artifacts, statuses=[ { "context": f"codeql-dispatch/python/{'a' * 40}", @@ -1256,7 +1287,7 @@ def test_codeql_coordinator_keeps_all_failed_jobs_when_one_language_is_pending( f"s={'c' * 40}" ), "target_url": ( - "https://github.com/ContextualWisdomLab/.github/actions/runs/100" + "https://github.com/ContextualWisdomLab/.github/actions/runs/123" ), "state": "success", "creator": {"login": "opencode-agent[bot]"}, @@ -1450,8 +1481,11 @@ def test_codeql_coordinator_excludes_successful_compatibility_jobs_from_settleme tmp_path: Path, ) -> None: """Run-wide settlement carries only exact failed compatibility jobs.""" + producer_jobs, producer_artifacts = _complete_dispatch_evidence({"python": "success"}) result, _post_log, post_body = _run_coordinator( tmp_path, + producer_jobs=producer_jobs, + producer_artifacts=producer_artifacts, jobs={ "total_count": 2, "jobs": [ @@ -1476,7 +1510,7 @@ def test_codeql_coordinator_excludes_successful_compatibility_jobs_from_settleme f"cwl1;h={'b' * 40};w=codeql-scan-dispatch;r=99;" f"s={'c' * 40}" ), - "target_url": "https://github.com/ContextualWisdomLab/.github/actions/runs/100", + "target_url": "https://github.com/ContextualWisdomLab/.github/actions/runs/123", "state": "success", "creator": {"login": "opencode-agent[bot]"}, } @@ -1528,8 +1562,13 @@ def test_codeql_coordinator_skips_dispatch_when_every_language_has_a_verdict( tmp_path: Path, ) -> None: """A rerun that already has terminal statuses must not enqueue another scan.""" + producer_jobs, producer_artifacts = _complete_dispatch_evidence( + {"python": "success", "actions": "failure"} + ) result, post_log, post_body = _run_coordinator( tmp_path, + producer_jobs=producer_jobs, + producer_artifacts=producer_artifacts, statuses=[ { "context": f"codeql-dispatch/python/{'a' * 40}", @@ -1537,7 +1576,7 @@ def test_codeql_coordinator_skips_dispatch_when_every_language_has_a_verdict( f"cwl1;h={'b' * 40};w=codeql-scan-dispatch;r=99;" f"s={'c' * 40}" ), - "target_url": "https://github.com/ContextualWisdomLab/.github/actions/runs/100", + "target_url": "https://github.com/ContextualWisdomLab/.github/actions/runs/123", "state": "success", "creator": {"login": "opencode-agent[bot]"}, }, @@ -1547,7 +1586,7 @@ def test_codeql_coordinator_skips_dispatch_when_every_language_has_a_verdict( f"cwl1;h={'b' * 40};w=codeql-scan-dispatch;r=99;" f"s={'c' * 40}" ), - "target_url": "https://github.com/ContextualWisdomLab/.github/actions/runs/100", + "target_url": "https://github.com/ContextualWisdomLab/.github/actions/runs/123", "state": "failure", "creator": {"login": "opencode-agent[bot]"}, },