From 4ab3f95bc9501043892025c185976ad97753bbdf Mon Sep 17 00:00:00 2001 From: "Sean P. Kane" Date: Mon, 12 Jan 2026 15:15:11 -0800 Subject: [PATCH] refactor: fix test failure tracking and enhance secret scanning (#33) * fix: Improved release test order * fix: detect secrets adjustments * fix: improve secrets scanning --- .secrets.baseline | 2 +- just/quality.just | 20 ++++++++++++++++---- just/testing.just | 35 +++++++++++++++++++++++++++-------- scripts/release-helpers.sh | 7 +++++-- 4 files changed, 49 insertions(+), 15 deletions(-) diff --git a/.secrets.baseline b/.secrets.baseline index 40a169a..96338c0 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -127,5 +127,5 @@ } ], "results": {}, - "generated_at": "2026-01-12T20:07:54Z" + "generated_at": "2026-01-12T21:58:08Z" } diff --git a/just/quality.just b/just/quality.just index 31d907b..2575074 100644 --- a/just/quality.just +++ b/just/quality.just @@ -70,17 +70,29 @@ scan-gitleaks: scan-gitleaks-history: mise exec -- gitleaks detect --source {{project_root}} --config {{project_root}}/.gitleaks.toml --verbose --log-opts="--all" -# Run detect-secrets scanner (installed via uv) +# Check for new secrets against baseline (does NOT modify baseline file) +# Uses pre-commit to run detect-secrets with proper file enumeration +# Use scan-baseline-update to actually update the baseline scan-detect: - uv run detect-secrets scan --baseline {{project_root}}/.secrets.baseline + @echo "Checking for new secrets against baseline..." + @uv run pre-commit run detect-secrets --all-files && echo "✓ No new secrets detected" # Audit detect-secrets baseline (interactive) scan-audit: uv run detect-secrets audit {{project_root}}/.secrets.baseline -# Update detect-secrets baseline with new findings (preserves audit metadata) +# Update detect-secrets baseline with current scan (updates generated_at timestamp) +# Run this when you want to add new files or refresh the baseline +# This WILL update the timestamp - only run when you intend to commit changes scan-baseline-update: - uv run detect-secrets scan --baseline {{project_root}}/.secrets.baseline --update {{project_root}} + cd {{project_root}} && uv run detect-secrets scan \ + --exclude-files '\.secrets\.baseline$$' \ + --exclude-files '\.gitleaks\.toml$$' \ + --exclude-files 'uv\.lock$$' \ + --exclude-files 'poetry\.lock$$' \ + --exclude-files 'package-lock\.json$$' \ + --update .secrets.baseline + @echo "✓ Baseline updated (run 'just quality::scan-audit' to review any findings)" # Run trufflehog for verified secrets (via pre-commit - not installed standalone) scan-trufflehog: diff --git a/just/testing.just b/just/testing.just index d2c27a1..8b16748 100644 --- a/just/testing.just +++ b/just/testing.just @@ -193,12 +193,15 @@ release-test: # Track overall test results TESTS_PASSED=true - FAILED_TESTS="" + # Arrays to track failures (name and command) + declare -a FAILED_NAMES=() + declare -a FAILED_COMMANDS=() # Helper function to record test failure record_failure() { TESTS_PASSED=false - FAILED_TESTS="${FAILED_TESTS}"$'\n'" - $1" + FAILED_NAMES+=("$1") + FAILED_COMMANDS+=("$2") } # ------------------------------------------------------------------------- @@ -215,7 +218,7 @@ release-test: else echo "" echo "✗ Unit tests FAILED" - record_failure "Unit tests with coverage" + record_failure "Unit tests with coverage" "just testing::cov" fi echo "" @@ -233,7 +236,7 @@ release-test: else echo "" echo "✗ Headless integration tests FAILED" - record_failure "Headless integration tests" + record_failure "Headless integration tests" "just testing::integration-headless-release" fi echo "" @@ -251,7 +254,7 @@ release-test: else echo "" echo "✗ GUI integration tests FAILED" - record_failure "GUI integration tests" + record_failure "GUI integration tests" "just testing::integration-gui-release" fi echo "" @@ -269,7 +272,7 @@ release-test: else echo "" echo "✗ Docker integration test FAILED" - record_failure "Docker integration test" + record_failure "Docker integration test" "just docker::test" fi echo "" @@ -287,7 +290,7 @@ release-test: else echo "" echo "✗ Just command tests FAILED" - record_failure "Just command tests" + record_failure "Just command tests" "just testing::just-all" fi echo "" @@ -318,7 +321,23 @@ release-test: else echo "✗ SOME TESTS FAILED - Cannot proceed with release" echo "" - printf "Failed tests:%s\n" "$FAILED_TESTS" + echo "============================================================" + echo " FAILED TESTS" + echo "============================================================" + echo "" + for i in "${!FAILED_NAMES[@]}"; do + echo " ✗ ${FAILED_NAMES[$i]}" + done + echo "" + echo "============================================================" + echo " TO RECREATE FAILURES" + echo "============================================================" + echo "" + echo "Run these commands to reproduce the failing tests:" + echo "" + for i in "${!FAILED_COMMANDS[@]}"; do + echo " ${FAILED_COMMANDS[$i]}" + done echo "" echo "Please fix the failing tests before creating a release." exit 1 diff --git a/scripts/release-helpers.sh b/scripts/release-helpers.sh index b29bfa2..ee30cd3 100755 --- a/scripts/release-helpers.sh +++ b/scripts/release-helpers.sh @@ -78,13 +78,16 @@ require_clean_tree() { # Run all pre-release checks # Usage: pre_release_checks "1.0.0" || exit 1 +# Order: Fast local checks first, then network checks pre_release_checks() { local version="$1" + # Fast local checks first validate_semver "$version" || return 1 - require_main_branch || return 1 - require_up_to_date || return 1 require_clean_tree || return 1 + require_main_branch || return 1 + # Network check last (git fetch can be slow) + require_up_to_date || return 1 return 0 }