DevSecOps
/
Assessor_2.0
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(reporting): skip read-only write check when running as root 

CI job containers run as root, which bypasses file permission bits.
The mode check still verifies the archived file has no write bits.
This commit is contained in:
Binh 2026-10-07 10:29:20 +02:00
parent ac7c7b6283
commit 8506d066b4
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
tests/server/report-archive.test.ts
View File

@ -43,7 +43,8 @@ describe('Report archive', () => {
expect(renderReportFiles(archived.projection)).toEqual(run.files); expect(renderReportFiles(archived.projection)).toEqual(run.files);
const file = join(projectDirectory, manifest.runId, REPORT_ARCHIVE_FILES.management); const file = join(projectDirectory, manifest.runId, REPORT_ARCHIVE_FILES.management);
expect((await stat(file)).mode & 0o222).toBe(0); expect((await stat(file)).mode & 0o222).toBe(0);
await expect(writeFile(file, 'changed')).rejects.toThrow(); // Root (e.g. a CI job container) bypasses file permission bits; the mode check above still applies.
if (process.getuid?.() !== 0) await expect(writeFile(file, 'changed')).rejects.toThrow();
}); });
it('detects a changed archived file instead of trusting it', async () => { it('detects a changed archived file instead of trusting it', async () => {