test_git_commit.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_git/test_git_commit.py
 
"""
Purpose
-------
Integration tests for ``oct git commit`` (Phase 4D — G-D3, G-D4, G-D6, G-D7).
 
Responsibilities
----------------
- Verify exit codes 0-4 for commit scenarios.
- Verify the non-bypassable secrets invariant (G-D4).
- Verify --force, --no-verify, --json flags.
- Verify protected-branch guards (G-D7).
- Verify large-file advisory warnings (G-D6).
- Verify audit trail.
 
Diagnostics
-----------
Domain: GIT-TESTS
Levels:
    L2 — test lifecycle
    L3 — assertion details
    L4 — deep tracing
 
Contracts
---------
- All tests use subprocess invocation (same pattern as test_git_check.py).
- All tests use tmp_path fixtures so they are automatically cleaned up.
"""
 
import json
import shutil
import subprocess
import sys
from pathlib import Path
 
import pytest
 
from tests.tests_git.conftest import _git, commit_file
 
 
# =====================================================================
# Helpers
# =====================================================================
 
 
def _git_available() -> bool:
    return shutil.which("git") is not None
 
 
def _run_commit(root: Path, *extra_args: str) -> subprocess.CompletedProcess:
    """Run ``oct git commit`` in a subprocess."""
    return subprocess.run(
        [sys.executable, "-m", "oct.cli", "git", "commit", *extra_args],
        cwd=root,
        capture_output=True,
        text=True,
    )
 
 
def _run_commit_json(root: Path, *extra_args: str) -> dict:
    """Run ``oct git commit --json`` and parse JSON output."""
    result = _run_commit(root, "--json", *extra_args)
    return json.loads(result.stdout)
 
 
def _latest_audit_record(root: Path) -> dict | None:
    """Read the last JSONL line from the newest audit file."""
    audit_files = sorted(
        (root / "logs").glob("oct_git_audit*.jsonl"),
        key=lambda p: p.stat().st_mtime,
    )
    if not audit_files:
        return None
    lines = audit_files[-1].read_text(encoding="utf-8").strip().splitlines()
    if not lines:
        return None
    return json.loads(lines[-1])
 
 
# =====================================================================
# Exit codes
# =====================================================================
 
 
class TestExitCodes:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_exit_0_clean_commit(self, temp_git_project, make_compliant_py):
        """Staged compliant file + valid message → exit 0, commit made."""
        _git(temp_git_project, "checkout", "-b", "feature/clean")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: add good module",
        )
        assert result.returncode == 0
        # Verify commit was actually made.
        log = _git(temp_git_project, "log", "--oneline", "-1")
        assert "add good module" in log.stdout
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_exit_1_lint_failure(self, temp_git_project, make_noncompliant_py):
        """Staged file with lint violations → exit 1."""
        _git(temp_git_project, "checkout", "-b", "feature/lint")
        path = make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: add bad module",
        )
        assert result.returncode == 1
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_exit_2_secrets(self, temp_git_project, make_noncompliant_py):
        """Staged file with hardcoded secret → exit 2."""
        _git(temp_git_project, "checkout", "-b", "feature/secrets")
        path = make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: add secret module",
        )
        assert result.returncode == 2
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_exit_3_invalid_message(self, temp_git_project, make_compliant_py):
        """Invalid commit message → exit 3."""
        _git(temp_git_project, "checkout", "-b", "feature/msg")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "bad message no conventional format",
        )
        assert result.returncode == 3
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_exit_4_nothing_staged(self, temp_git_project):
        """Nothing staged → exit 4."""
        _git(temp_git_project, "checkout", "-b", "feature/empty")
        result = _run_commit(
            temp_git_project, "-m", "feat: nothing here",
        )
        assert result.returncode == 4
 
 
# =====================================================================
# Secrets non-bypassable (G-D4 invariant)
# =====================================================================
 
 
class TestSecretsNonBypassable:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_force_does_not_bypass_secrets(self, temp_git_project, make_noncompliant_py):
        _git(temp_git_project, "checkout", "-b", "feature/sec1")
        path = make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: bad", "--force",
        )
        assert result.returncode == 2
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_no_verify_does_not_bypass_secrets(self, temp_git_project, make_noncompliant_py):
        _git(temp_git_project, "checkout", "-b", "feature/sec2")
        path = make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: bad", "--no-verify",
        )
        assert result.returncode == 2
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_force_and_no_verify_does_not_bypass_secrets(
        self, temp_git_project, make_noncompliant_py,
    ):
        _git(temp_git_project, "checkout", "-b", "feature/sec3")
        path = make_noncompliant_py("src/secret.py", "hardcoded_secret")
        _git(temp_git_project, "add", "src/secret.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: bad", "--force", "--no-verify",
        )
        assert result.returncode == 2
 
 
# =====================================================================
# --force
# =====================================================================
 
 
class TestForce:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_force_bypasses_lint(self, temp_git_project, make_noncompliant_py):
        """--force with lint violations → commit succeeds."""
        _git(temp_git_project, "checkout", "-b", "feature/force1")
        path = make_noncompliant_py("src/bad.py", "missing_header")
        _git(temp_git_project, "add", "src/bad.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: forced", "--force",
        )
        assert result.returncode == 0
        log = _git(temp_git_project, "log", "--oneline", "-1")
        assert "forced" in log.stdout
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_force_bypasses_message_validation(self, temp_git_project, make_compliant_py):
        """--force with invalid message → commit succeeds."""
        _git(temp_git_project, "checkout", "-b", "feature/force2")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "bad message", "--force",
        )
        assert result.returncode == 0
 
 
# =====================================================================
# --no-verify
# =====================================================================
 
 
class TestNoVerify:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_no_verify_prints_warning(self, temp_git_project, make_compliant_py):
        _git(temp_git_project, "checkout", "-b", "feature/noverify")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: test no verify", "--no-verify",
        )
        assert result.returncode == 0
        assert "Skipping git hooks" in result.stderr
 
 
# =====================================================================
# Protected branch (G-D7)
# =====================================================================
 
 
class TestProtectedBranch:
 
    @staticmethod
    def _disable_auto_branch(root: Path) -> None:
        """Overwrite octrc to disable auto-branching for block tests."""
        import json as _json
        octrc_path = root / ".octrc.json"
        octrc = _json.loads(octrc_path.read_text(encoding="utf-8"))
        octrc.setdefault("git", {})["auto_branch_on_protected"] = False
        octrc_path.write_text(_json.dumps(octrc, indent=2), encoding="utf-8")
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_main_strict_blocks(self, temp_git_project, make_compliant_py):
        """On main with strict profile and auto-branch disabled → blocked."""
        self._disable_auto_branch(temp_git_project)
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: on main",
            "--profile", "strict",
        )
        # Protected branch in strict mode blocks.
        assert result.returncode == 1
        assert "protected branch" in result.stderr.lower()
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_feature_branch_no_block(self, temp_git_project, make_compliant_py):
        """On a feature branch → no protected-branch block."""
        _git(temp_git_project, "checkout", "-b", "feature/test")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: on feature",
        )
        assert result.returncode == 0
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_main_compact_warns_but_proceeds(self, temp_git_project, make_compliant_py):
        """On main with compact profile and auto-branch disabled → blocked.
 
        Note: resolve_effective_profile forces strict on protected branches,
        so the profile override is ignored. The test verifies that the
        commit is blocked because the effective profile is always strict
        on main.
        """
        self._disable_auto_branch(temp_git_project)
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: on main",
            "--profile", "compact",
        )
        # Protected branch forces strict, so this is blocked.
        assert result.returncode == 1
 
 
# =====================================================================
# Large file advisory (G-D6)
# =====================================================================
 
 
class TestLargeFile:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_large_file_warning(self, temp_git_project):
        """Staged file > threshold → advisory warning printed."""
        _git(temp_git_project, "checkout", "-b", "feature/bigfile")
        big = temp_git_project / "src" / "bigfile.bin"
        # Write 11 MB file.
        big.write_bytes(b"\x00" * (11 * 1024 * 1024))
        _git(temp_git_project, "add", "src/bigfile.bin")
        result = _run_commit(
            temp_git_project, "-m", "feat: big file", "--force",
        )
        # Should have a warning about the large file.
        assert "Warning:" in result.stderr and ("MB" in result.stderr or "LFS" in result.stderr)
 
 
# =====================================================================
# Conventional message
# =====================================================================
 
 
class TestConventionalMessage:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_valid_message_accepted(self, temp_git_project, make_compliant_py):
        _git(temp_git_project, "checkout", "-b", "feature/msg")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "feat(auth): add validation",
        )
        assert result.returncode == 0
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_invalid_message_rejected(self, temp_git_project, make_compliant_py):
        _git(temp_git_project, "checkout", "-b", "feature/badmsg")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        _git(temp_git_project, "add", "tests/test_good.py")
        result = _run_commit(
            temp_git_project, "-m", "Updated the thing.",
        )
        assert result.returncode == 3
        assert "validation failed" in result.stderr.lower() or "Conventional Commits" in result.stderr
 
 
# =====================================================================
# Audit trail
# =====================================================================
 
 
class TestAuditTrail:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_success_audit(self, temp_git_project, make_compliant_py):
        _git(temp_git_project, "checkout", "-b", "feature/audit")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        result = _run_commit(
            temp_git_project, "-m", "feat: audited commit",
        )
        assert result.returncode == 0
        record = _latest_audit_record(temp_git_project)
        if record:
            assert record["command"] == "oct git commit"
            assert record["exit_code"] == 0
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_failure_audit(self, temp_git_project):
        result = _run_commit(
            temp_git_project, "-m", "feat: nothing staged",
        )
        assert result.returncode == 4
        record = _latest_audit_record(temp_git_project)
        if record:
            assert record["command"] == "oct git commit"
            assert record["exit_code"] == 4
 
 
# =====================================================================
# JSON output
# =====================================================================
 
 
class TestJsonOutput:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_json_on_success(self, temp_git_project, make_compliant_py):
        _git(temp_git_project, "checkout", "-b", "feature/json")
        path = make_compliant_py("src/good.py")
        _git(temp_git_project, "add", "src/good.py")
        data = _run_commit_json(
            temp_git_project, "-m", "feat: json test",
        )
        assert data["exit_code"] == 0
        assert data["message"] == "feat: json test"
        assert "branch" in data
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_json_on_failure(self, temp_git_project):
        data = _run_commit_json(
            temp_git_project, "-m", "feat: nothing staged",
        )
        assert data["exit_code"] == 4
        assert len(data["errors"]) > 0
 
 
# =====================================================================
# L4: repeated -m for multi-paragraph commit messages
# =====================================================================
 
 
class TestRepeatedMessage:
 
    @pytest.mark.skipif(not _git_available(), reason="git not on PATH")
    def test_repeated_m_joins_with_blank_line(
        self, temp_git_project, make_compliant_py,
    ):
        _git(temp_git_project, "checkout", "-b", "feature/multi-m")
        make_compliant_py("src/multi.py")
        _git(temp_git_project, "add", "src/multi.py")
        result = _run_commit(
            temp_git_project,
            "-m", "feat: multi-paragraph subject",
            "-m", "Body paragraph one explains the why.",
            "-m", "Body paragraph two adds detail.",
        )
        assert result.returncode == 0, result.stderr
 
        # Inspect the actual commit message via git log.
        proc = subprocess.run(
            ["git", "log", "-1", "--pretty=format:%B"],
            cwd=temp_git_project, check=True,
            capture_output=True, text=True,
        )
        body = proc.stdout
        assert "feat: multi-paragraph subject" in body
        assert "Body paragraph one explains the why." in body
        assert "Body paragraph two adds detail." in body
        # Ensure paragraphs are separated by blank lines (not just newlines).
        assert "subject\n\nBody paragraph one" in body
        assert "one explains the why.\n\nBody paragraph two" in body