mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
tob-joe
e8cc5baf93
* ci: add python-tests job to run plugin Python test suites Discovers test_*.py / *_test.py files under plugins/ and executes each one as a script. Matches the style of the existing bats job. Works today for: - plugins/constant-time-analysis/ct_analyzer/tests/test_analyzer.py - plugins/let-fate-decide/.../scripts/test_draw_cards.py Both test files already exist in the repo but no CI job invoked them. As a result, PR #125 (which broke let-fate-decide by removing `import os` while leaving `os.path` calls in draw()) merged with green CI even though the existing `test_draw_*` / `test_cli_*` tests would have caught it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci(python-tests): install aarch64 cross toolchain for constant-time-analysis TestCrossArchitecture.test_cross_compile_arm64 invokes clang with --target=aarch64-unknown-linux-gnu, which needs the aarch64 libc headers. Without them clang fails with: fatal error: 'bits/libc-header-start.h' file not found Install gcc-aarch64-linux-gnu + libc6-dev-arm64-cross so clang can find the cross headers. Also install clang explicitly since the runner may not have it preinstalled. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: clarify python-tests workflow comments Resolves code review findings on PR #147 (comment accuracy only — no behavior change): - Rewrite the toolchain dependencies comment. The previous wording ("aarch64 cross gcc pulls in libc6-dev-arm64-cross") implied a transitive dependency, but `--no-install-recommends` suppresses Recommends, so libc6-dev-arm64-cross is installed only because it is listed explicitly. New comment names what each package supplies. - Document why `set -uo pipefail` deliberately omits -e (the loop collects per-file failures and exits with a combined code). Reviewers (codex + gemini + pr-review-toolkit agents) flagged 13 findings total; 11 were dismissed (false positives, design choices matching the bats job, or speculative). Quality pipeline (actionlint, zizmor, shellcheck, pre-commit, plugin validators, both Python test suites) all pass locally. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>