Repository navigation
fix(conformance,lint,release): public-ports class, lint continuation, worktree bundles, rehearse args, prerelease compare (D-0626 D-0615 D-1169 D-1107 D-1106) - #483
Merged
Conversation
…s (D-0626) public-ports.yaml names the plugin and the exact container port; port-bind passes only those ports, so the traefik exception no longer excuses every port of the plugin and no longer expires at the v1.5.0 cap.
…probe and parity nits (D-0615) The password-URL lint treats the line after a backslash-terminated URL line as a continuation whatever its word count, ignores a trailing comment and ends the URL at a flow-sequence item boundary. The infra and k8s --help --json probe strips only ParseBool-valid --json forms. parity-envelope.py reads only None as an empty list and checks error.message and the 'infra server <sub>' command.
…f hanging (D-1107)
… version_is_newer (D-1106)
…ests (D-1169, D-1107)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Five small debt rows, one commit each (plus one CI wiring commit). Every fix has a test that fails on origin/main and passes here.
D-0626 permanent class for deliberate public ports
scripts/conformance/public-ports.yaml: plugin, one container port, reason, no expiry.portbindgets-allow PORT; the match is on the exact target port (short and long syntax), so every other port of the plugin still has to bind 127.0.0.1.network_mode: hostis never excused.port-bind.shreads the file;check.sh --public-ports FILEoverrides it for tests;exceptions.shvalidates it (complete rows, single port 1-65535, no duplicates).port-bindexception is gone. traefik is listed for 80, 443 and 8444. 8444 is the upload entrypoint: loopback by default, public only when the operator setsTRAEFIK_UPLOAD_PUBLISH. The old blanket exception covered it silently; the per-port check surfaced it, so it needs a reviewer's eye.portbindGo unit tests (TestAllow),fixtures.shplants (listed port passes, other port / other plugin / host network / missing file fail, malformed and duplicate entries fail, the file does not expire after the cap date). Wiki page updated.D-0615 password-URL lint plus infra/k8s nits
curl http://x \followed by-H "${TOKEN}"is not flagged); a trailing#...is stripped; a flow-sequence item boundary (comma, closing bracket) ends the URL. New reject and accept fixtures.--help --jsonprobe strips only--jsonand ParseBool-valid--json=<v>;--json=maybenow stays and the normal path refuses it.parity-envelope.py: only None is read as an empty list; checkserror.messageis a string and the command isinfra server <sub>. Newtest_parity_envelope.py.wantsJSONis already last-wins (D-0447,free/k8s/cmd/envelope.go).--jsonthat is the value of another flag (--domain --json) is still stripped by the probe; fixing it needs flag-aware parsing, and the row's preferred resolution does not ask for it.D-1169 bundles sibling autodetect
plugin-counts.shnow also tries$COMMON/../../bundles.test-plugin-counts-bundles-dir.shbuilds a main checkout, a worktree and a sibling repo; the bundles case fails without the fix.D-1107 rehearse.sh hang
--tag/--outwith no value now exits 2 with a message.rehearse-args-test.shruns each case under a watchdog; three cases hang on main.verify-signatures.shhas the sameshift 2 || truebut exits 2 on that path, so it is unchanged.D-1106 version_is_newer precision
Numeric prerelease ids and core components are compared as digit strings (leading zeros dropped, longer wins, then byte order), not as awk doubles.
test_version_is_newer.py(picked up byunittest discover); five long-id cases fail on main. The row's impact text describes a different finding (release-data not comparing platform hashes to the publish job's manifest). That is not addressed here.Verification
cd scripts/conformance/portbind && GOFLAGS=-mod=readonly go test ./... && go vet ./...pass (70 tests).cd free/infra && go test -mod=vendor ./...andcd free/k8s && go test -mod=vendor ./...pass.bash scripts/conformance/check.sh --all --rules exceptions,port-bindpasses on 131 plugins;--plugins traefikpasses.bash scripts/conformance/check.sh --fixtures: every new case passes. The only failures are the existing alpha/beta/gammabuildrule (no Docker on this worker), same without my change.bash scripts/ci/tests/test-lint-compose-password-urls.sh,scripts/lint-compose-password-urls.sh(68 fragments),test-plugin-counts-bundles-dir.sh,scripts/release/rehearse-args-test.sh,python3 -m unittest discover -s scripts/ci/tests(83 tests),python3 free/infra/scripts/test_parity_envelope.py,check-file-size.py,check-tracked-binaries.pypass.