[test] Add tests for proxy.seedEnclaveAssignedRepositorySecrecy - #11994
Conversation
Adds table-driven tests covering all branches of Server.seedEnclaveAssignedRepositorySecrecy: confidential repo sensitivity (adds private secrecy tag), public sensitivity (no tag added, no agent labels created), and repos absent from policy (no tag added, no agent labels created). Also adds a test verifying secrecy tags accumulate correctly across multiple calls for the same agent across different repos. Coverage for this function improves from 75.0% to 100.0%. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds focused unit coverage for enclave repository secrecy seeding.
Changes:
- Tests confidential, public, and absent policy entries.
- Tests secrecy-tag accumulation across repeated calls.
Show a summary per file
| File | Description |
|---|---|
internal/proxy/enclave_test.go |
Adds direct secrecy-seeding tests. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
@copilot fix failing lint ci check https://github.com/github/gh-aw-mcpg/actions/runs/33137934452/job/98742067254?pr=11994 |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Fixed the gofmt lint failure by correcting indentation in |
This comment has been minimized.
This comment has been minimized.
🔒 mcpg Read-Only Stress — gvisorSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Overall: INCONCLUSIVE
No writes leaked. No security regression detected. References: §33138114864
|
🔒 mcpg Read-Only Stress — default AWFSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Overall: INCONCLUSIVE
No writes succeeded. All reads passed. References: §33138114844
|
🔒 mcpg Read-Only Stress — docker-sbxSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Overall: INCONCLUSIVE — No writes leaked. No FAIL conditions observed. Gaps (all
MCP tool catalog (23 tools, all read-only): References: §33138114818
|
Test Coverage Improvement:
seedEnclaveAssignedRepositorySecrecyFunction Analyzed
internal/proxyServer.seedEnclaveAssignedRepositorySecrecyWhy This Function?
The overall test suite currently passes (integration tests fail only due to the
awmgbinary not being pre-built in this environment, not code issues). Scanninggo tool cover -funcoutput for non-test, non-trivial functions with partial coverage,seedEnclaveAssignedRepositorySecrecystood up as a good target with 75% coverage:AgentRegistry.GetOrCreate(...).AddSecrecyTag(...)), which is security-relevant (it controls secrecy propagation for cross-repo enclave access) and worth pinning down with direct unit tests rather than relying only on indirect coverage from handler-level tests.Tests Added
private:<repo>secrecy tag to the agent's labelsGetOrCreate— no agent labels are created at allTests use table-driven subtests (
TestSeedEnclaveAssignedRepositorySecrecy) plus a dedicated accumulation test, following existing conventions ininternal/proxy/enclave_test.goand usingdifc.NewAgentRegistry()/enclavegithub.ParsePolicy()directly to keep the tests focused and independent of HTTP handler plumbing.Coverage Report
Test Execution
gofmt -l,go vet ./internal/proxy/..., andgo build ./...all pass cleanly on the changed file.Generated by Test Coverage Improver
Next run will target the next most complex under-tested function