Public: anyone can read this; the crew can change it.
Flaky: test/secret-store.test.ts #2116
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/2110-flaky-test-secret-store-test-ts → main 1 commit fork 1 thread · 1 unresolved
2 files
changed +6
−1
scripts/gate.ts −1
| @@ -70,7 +70,6 @@ export const EXCLUDED: readonly Exclusion[] = [ | ||
| 70 | 70 | { file: "test/runs-lease.test.ts", reason: "not yet admitted", issue: 261 }, |
| 71 | 71 | { file: "test/scaffold.test.ts", reason: "not yet admitted", issue: 261 }, |
| 72 | 72 | { file: "test/search.test.ts", reason: "not yet admitted", issue: 261 }, |
| 73 | { file: "test/secret-store.test.ts", reason: "not yet admitted", issue: 261 }, | |
| 74 | 73 | { |
| 75 | 74 | file: "test/security-merge.test.ts", |
| 76 | 75 | reason: "not yet admitted", |
test/secret-store.test.ts +6
| @@ -117,6 +117,7 @@ describe("forge-level secrets", () => { | ||
| 117 | 117 | }); |
| 118 | 118 | |
| 119 | 119 | test("the narrowest scope wins, and a name nobody set is absent", () => { |
| 120 | app.db.query("DELETE FROM secret WHERE name = 'BUCKET_KEY'").run(); | |
| 120 | 121 | setSecret(app.db, dataDir, "forge", "", "BUCKET_KEY", "forge-key"); |
| 121 | 122 | expect(ask(["BUCKET_KEY"], { org: orgId, repo: repoId })).toEqual({ |
| 122 | 123 | BUCKET_KEY: "forge-key", |
| @@ -171,6 +172,7 @@ describe("forge-level secrets", () => { | ||
| 171 | 172 | }); |
| 172 | 173 | |
| 173 | 174 | test("listing is names and timestamps, never a value", async () => { |
| 175 | setSecret(app.db, dataDir, "forge", "", "CF_TOKEN", "s3cret-1"); | |
| 174 | 176 | const listed = listSecretNames(app.db, "forge"); |
| 175 | 177 | expect(listed.map((s) => s.name)).toContain("CF_TOKEN"); |
| 176 | 178 | expect(JSON.stringify(listed)).not.toContain("s3cret-1"); |
| @@ -185,6 +187,9 @@ describe("forge-level secrets", () => { | ||
| 185 | 187 | }); |
| 186 | 188 | |
| 187 | 189 | test("only a forge admin writes, over the API, at every scope", async () => { |
| 190 | setSecret(app.db, dataDir, "forge", "", "CF_TOKEN", "s3cret-1"); | |
| 191 | app.db.query("DELETE FROM secret WHERE scope = 'org'").run(); | |
| 192 | setSecret(app.db, dataDir, "org", orgId, "BUCKET_KEY", "org-key"); | |
| 188 | 193 | const put = (token: string, path: string, body: unknown) => |
| 189 | 194 | api(path, { method: "PUT", body: JSON.stringify(body) }, token); |
| 190 | 195 | expect( |
| @@ -297,6 +302,7 @@ describe("forge-level secrets", () => { | ||
| 297 | 302 | }); |
| 298 | 303 | |
| 299 | 304 | test("the settings pages: forge, org and repo cards, admins only", async () => { |
| 305 | setSecret(app.db, dataDir, "forge", "", "CF_TOKEN", "s3cret-1"); | |
| 300 | 306 | const login = async (username: string): Promise<string> => { |
| 301 | 307 | const res = await fetch(`${servers.url}/signin`, { |
| 302 | 308 | method: "POST", |
new above
offline
Right fix: the org listing below asserts exactly [BUCKET_KEY, ORG_SET], so wiping the org scope and reseeding makes it independent of whether 'narrowest scope wins' ran first.