Repository navigation
test: make network-dependent unit tests hermetic - #3695
Merged
Merged
Conversation
Contributor
PR validation — ✅ 3 passing
AI Session Checks — ⏭️ bypassed by labelAI Coding Session Check BypassedThis PR carries the Learn more about Chainloop Trace. Security Checks — ✅ 5 passing✅
|
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
Scans not applied (3)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Security context
✅ Nothing this change touches has a recorded security-fix history.
View in Chainloop ↗ · How this works ↗
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
matiasinsaurralde
force-pushed
the
fix/hermetic-network-tests
branch
from
October 22, 2026 02:46
bc1dd3c to
a1a933f
Compare
Two unit tests made live outbound HTTP calls and failed on any runner without egress (air-gapped CI, outages, rate limits). Make them not need the network at all, reusing loopback patterns already present in the repo. - rego: replace the two "allowed network requests" subtests (which dialed www.chainloop.dev and github.com) with TestRego_AllowedHostnames, which asserts allow-list membership, and TestRego_AllowedHostIsReachable, which reaches an allowed host on a loopback httptest server. Drop the now-unused restricted_mode_networking_allowed_host.rego testfile. The forbidden functions/network subtests are unchanged. - materials: replace the "non-existent path" OCI case (which reached Docker Hub for its UNAUTHORIZED response) with TestOCIImageCraft_UnresolvableRemoteReference against an in-memory loopback registry, asserting the deterministic NAME_UNKNOWN error. No production behavior changes. Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
matiasinsaurralde
force-pushed
the
fix/hermetic-network-tests
branch
from
October 22, 2026 02:47
a1a933f to
f38c39f
Compare
migmartri
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs PFM-7940
Summary
Two unit tests made live outbound HTTP calls, so they failed on any runner without internet egress (air-gapped CI, outages, rate limits). This makes them not need the network at all, reusing loopback patterns already present in the repo.
pkg/policies/engine/rego): replace the two "allowed network requests" subtests that dialedwww.chainloop.devandgithub.comwithTestRego_AllowedHostnames(asserts allow-list membership) andTestRego_AllowedHostIsReachable(reaches an allowed host on a loopbackhttptestserver). Theforbidden functions/forbidden network requestssubtests are unchanged. Drops the now-unusedrestricted_mode_networking_allowed_host.regotestfile.pkg/attestation/crafter/materials): replace thenon-existent pathOCI case that reached Docker Hub for itsUNAUTHORIZEDresponse withTestOCIImageCraft_UnresolvableRemoteReferenceagainst an in-memory loopback registry, asserting the deterministicNAME_UNKNOWNerror.No production behavior changes. The engine's host allow-list, netguard ranges, and
http.sendgating are untouched. The fix lives entirely in test code.