From b075a9c8d4b0aa0a741b7a69969df5ac721df820 Mon Sep 17 00:00:00 2001 From: Time Attakc <89218912+time-attack@users.noreply.github.com> Date: Fri, 17 Jul 2026 12:10:47 -0700 Subject: [PATCH] =?UTF-8?q?test+ci:=20unbreak=20master=20=E2=80=94=20symli?= =?UTF-8?q?nk-walker=20probe=20files=20+=20OSV=20caller=20permissions=20(#?= =?UTF-8?q?2926)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * test: symlink-walker tests use a non-metafile probe (README now skipped by design, #2315) The import walker deliberately skips README/metafiles since #2315 (closing #345); the symlink-hardening tests used README.md as their probe file and went red on the intersection. Probe with notes.md instead; test intent (cycle hardening + strategy filter) unchanged. Co-Authored-By: Claude Fable 5 * ci: grant security-events write to the OSV caller job — reusable workflow requires it at startup Co-Authored-By: Claude Fable 5 --------- Co-authored-by: Sinabina Co-authored-by: Claude Fable 5 --- .github/workflows/osv-scanner.yml | 4 ++++ test/sync-walker-symlink.test.ts | 10 +++++----- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 91674a982..8c8b4f9b1 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -24,6 +24,10 @@ jobs: permissions: actions: read contents: read + # Required by the reusable workflow's own top-level permissions block — + # GitHub validates the caller grants a superset AT STARTUP, even with + # upload-sarif: false (nothing is actually uploaded; see #2117 upstream). + security-events: write uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 with: upload-sarif: false diff --git a/test/sync-walker-symlink.test.ts b/test/sync-walker-symlink.test.ts index 47fe5e83d..1f3ed3432 100644 --- a/test/sync-walker-symlink.test.ts +++ b/test/sync-walker-symlink.test.ts @@ -34,7 +34,7 @@ afterEach(() => { describe('collectSyncableFiles symlink + cycle hardening', () => { test('1. self-referencing symlink does not loop', async () => { await withEnv({ GBRAIN_EMBEDDING_MULTIMODAL: undefined }, () => { - writeFileSync(join(tmp, 'README.md'), '# top\n'); + writeFileSync(join(tmp, 'notes.md'), '# top\n'); // Symlink "loop" inside tempdir pointing back to itself. symlinkSync(tmp, join(tmp, 'loop')); @@ -43,7 +43,7 @@ describe('collectSyncableFiles symlink + cycle hardening', () => { const ms = Date.now() - t0; expect(ms).toBeLessThan(1000); // would hang if walker followed the loop - expect(files).toContain(join(tmp, 'README.md')); + expect(files).toContain(join(tmp, 'notes.md')); expect(files.every(f => !f.includes('/loop/'))).toBe(true); }); }); @@ -88,7 +88,7 @@ describe('collectSyncableFiles symlink + cycle hardening', () => { test('4. strategy filter admits the right files', async () => { await withEnv({ GBRAIN_EMBEDDING_MULTIMODAL: undefined }, () => { - writeFileSync(join(tmp, 'README.md'), '# r\n'); + writeFileSync(join(tmp, 'notes.md'), '# r\n'); writeFileSync(join(tmp, 'foo.ts'), '// f\n'); writeFileSync(join(tmp, 'bar.py'), '# b\n'); @@ -97,8 +97,8 @@ describe('collectSyncableFiles symlink + cycle hardening', () => { const auto = collectSyncableFiles(tmp, { strategy: 'auto' }); expect(code.map(f => f.split('/').pop()).sort()).toEqual(['bar.py', 'foo.ts']); - expect(markdown.map(f => f.split('/').pop())).toEqual(['README.md']); - expect(auto.map(f => f.split('/').pop()).sort()).toEqual(['README.md', 'bar.py', 'foo.ts']); + expect(markdown.map(f => f.split('/').pop())).toEqual(['notes.md']); + expect(auto.map(f => f.split('/').pop()).sort()).toEqual(['bar.py', 'foo.ts', 'notes.md']); }); });