DevSecOps
/
Assessor_2.0
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(reporting): skip read-only write check when running as root
Deploy / Test, build & deploy (push) Successful in 3m28s Details 

CI job containers run as root, which bypasses file permission bits.
The mode check still verifies the archived file has no write bits.
This commit is contained in:
Binh 2026-10-07 10:29:20 +02:00
parent 47c23a8c6e
commit 925ce6c276
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
tests/server/report-archive.test.ts
View File

@ -43,7 +43,8 @@ describe('Report archive', () => {
expect(renderReportFiles(archived.projection)).toEqual(run.files); expect(renderReportFiles(archived.projection)).toEqual(run.files);
const file = join(projectDirectory, manifest.runId, REPORT_ARCHIVE_FILES.management); const file = join(projectDirectory, manifest.runId, REPORT_ARCHIVE_FILES.management);
expect((await stat(file)).mode & 0o222).toBe(0); expect((await stat(file)).mode & 0o222).toBe(0);
await expect(writeFile(file, 'changed')).rejects.toThrow(); // Root (e.g. a CI job container) bypasses file permission bits; the mode check above still applies.
if (process.getuid?.() !== 0) await expect(writeFile(file, 'changed')).rejects.toThrow();
}); });
it('detects a changed archived file instead of trusting it', async () => { it('detects a changed archived file instead of trusting it', async () => {