43 lines
1.3 KiB
Python
43 lines
1.3 KiB
Python
import json
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).parents[1]
|
|
|
|
|
|
def test_config_preserves_builtin_permissions_and_restricts_research() -> None:
|
|
config = json.loads((ROOT / "opencode" / "opencode.json").read_text())
|
|
|
|
assert "permission" not in config
|
|
assert all(name not in config["agent"] for name in ("build", "plan", "general"))
|
|
assert "permission" not in config["agent"]["explore"]
|
|
assert config["agent"]["research"]["permission"] == {
|
|
"*": "deny",
|
|
"websearch": "allow",
|
|
"context7_*": "allow",
|
|
"gh_grep_*": "allow",
|
|
}
|
|
|
|
|
|
def test_compose_has_no_sandbox_security_exceptions() -> None:
|
|
compose = (ROOT / "compose.yaml").read_text()
|
|
|
|
for forbidden in (
|
|
"cap_add:",
|
|
"security_opt:",
|
|
"privileged:",
|
|
"seccomp=unconfined",
|
|
"apparmor=unconfined",
|
|
"bubblewrap",
|
|
):
|
|
assert forbidden not in compose
|
|
|
|
|
|
def test_container_pins_opencode_major_version_contract() -> None:
|
|
lines = [line.strip() for line in (ROOT / "Dockerfile").read_text().splitlines()]
|
|
build_arguments = {line.removeprefix("ARG ") for line in lines if line.startswith("ARG ")}
|
|
|
|
assert "AGENTCI_OPENCODE_VERSION=^1" in build_arguments
|
|
assert any(
|
|
line.rstrip("\\").strip() == '"opencode-ai@${AGENTCI_OPENCODE_VERSION}"' for line in lines
|
|
)
|