DevSecOps
/
Assessor_2.0
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(reporting): skip read-only write check when running as root 

CI job containers run as root, which bypasses file permission bits.
The mode check still verifies the archived file has no write bits.
This commit is contained in:
Binh 2026-10-07 10:29:20 +02:00
parent 44905c84a6
commit 065ac3ac13
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
tests/server/report-archive.test.ts
View File

@ -43,7 +43,8 @@ describe('Report archive', () => {
expect(renderReportFiles(archived.projection)).toEqual(run.files);
const file = join(projectDirectory, manifest.runId, REPORT_ARCHIVE_FILES.management);
expect((await stat(file)).mode & 0o222).toBe(0);
await expect(writeFile(file, 'changed')).rejects.toThrow();
// Root (e.g. a CI job container) bypasses file permission bits; the mode check above still applies.
if (process.getuid?.() !== 0) await expect(writeFile(file, 'changed')).rejects.toThrow();
});
it('detects a changed archived file instead of trusting it', async () => {