feat(core): add agentsmd-audit skill files
The previous commit only landed the research-folder rename — a multi-path git add silently failed and left CONTEXT.md, ADR-0012, and the actual skill files unstaged. This lands them: the agentsmd-audit skill itself (three deterministic validators for secrets, structure, and drift against a target repo's AGENTS.md), its bats test suite, provenance record, and the CONTEXT.md/ADR entries documenting why this lives in core rather than kyberforge. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
30
plugins/core/skills/agentsmd-audit/tests/README.md
Normal file
30
plugins/core/skills/agentsmd-audit/tests/README.md
Normal file
@@ -0,0 +1,30 @@
|
||||
# tests/
|
||||
|
||||
Test files for scripts bundled with this skill.
|
||||
|
||||
## Dependencies
|
||||
|
||||
Tests require [bats-support](https://github.com/bats-core/bats-support) and
|
||||
[bats-assert](https://github.com/bats-core/bats-assert). The test files load
|
||||
helpers from the repo root's `tests/test_helper/`.
|
||||
|
||||
From the repo root:
|
||||
|
||||
```bash
|
||||
git clone https://github.com/bats-core/bats-support tests/test_helper/bats-support
|
||||
git clone https://github.com/bats-core/bats-assert tests/test_helper/bats-assert
|
||||
```
|
||||
|
||||
Run all tests for this skill (from the repo root):
|
||||
|
||||
```bash
|
||||
bats plugins/core/skills/agentsmd-audit/tests/
|
||||
```
|
||||
|
||||
## Files
|
||||
|
||||
| File | Purpose |
|
||||
|------|---------|
|
||||
| `validate-secrets.bats` | Bats test suite for `scripts/validate-secrets.sh` |
|
||||
| `validate-structure.bats` | Bats test suite for `scripts/validate-structure.sh` |
|
||||
| `validate-drift.bats` | Bats test suite for `scripts/validate-drift.sh` |
|
||||
105
plugins/core/skills/agentsmd-audit/tests/validate-drift.bats
Normal file
105
plugins/core/skills/agentsmd-audit/tests/validate-drift.bats
Normal file
@@ -0,0 +1,105 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
setup() {
|
||||
REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
|
||||
load "$REPO_ROOT/tests/test_helper/bats-support/load"
|
||||
load "$REPO_ROOT/tests/test_helper/bats-assert/load"
|
||||
|
||||
SCRIPT="$(cd "$BATS_TEST_DIRNAME/../scripts" && pwd)/validate-drift.sh"
|
||||
TMPDIR="$(mktemp -d)"
|
||||
}
|
||||
|
||||
teardown() {
|
||||
rm -rf "$TMPDIR"
|
||||
}
|
||||
|
||||
@test "fails when AGENTS.md references a stale npm script" {
|
||||
cat > "$TMPDIR/package.json" <<'EOF'
|
||||
{
|
||||
"scripts": {
|
||||
"test": "jest"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Testing
|
||||
- Run `pnpm run e2e` before committing.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "e2e"
|
||||
}
|
||||
|
||||
@test "passes when the referenced npm script exists" {
|
||||
cat > "$TMPDIR/package.json" <<'EOF'
|
||||
{
|
||||
"scripts": {
|
||||
"test": "jest"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Testing
|
||||
- Run `npm run test` before committing.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_success
|
||||
}
|
||||
|
||||
@test "fails when AGENTS.md references a stale make target" {
|
||||
cat > "$TMPDIR/Makefile" <<'EOF'
|
||||
build:
|
||||
echo building
|
||||
EOF
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup
|
||||
Run `make deploy` to ship.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "deploy"
|
||||
}
|
||||
|
||||
@test "emits INFO instead of FAIL when there is no package.json to verify an npm script against" {
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Testing
|
||||
Run `pnpm run e2e` before committing.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_success
|
||||
assert_output --partial "INFO"
|
||||
assert_output --partial "e2e"
|
||||
}
|
||||
|
||||
@test "fails when a referenced file path does not exist" {
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup
|
||||
See `scripts/bootstrap.sh` for environment setup.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "scripts/bootstrap.sh"
|
||||
}
|
||||
|
||||
@test "passes when the referenced file path exists" {
|
||||
mkdir -p "$TMPDIR/scripts"
|
||||
: > "$TMPDIR/scripts/bootstrap.sh"
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup
|
||||
See `scripts/bootstrap.sh` for environment setup.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_success
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
setup() {
|
||||
REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
|
||||
load "$REPO_ROOT/tests/test_helper/bats-support/load"
|
||||
load "$REPO_ROOT/tests/test_helper/bats-assert/load"
|
||||
|
||||
SCRIPT="$(cd "$BATS_TEST_DIRNAME/../scripts" && pwd)/validate-secrets.sh"
|
||||
TMPDIR="$(mktemp -d)"
|
||||
}
|
||||
|
||||
teardown() {
|
||||
rm -rf "$TMPDIR"
|
||||
}
|
||||
|
||||
@test "passes on AGENTS.md with no secrets, only placeholders" {
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup
|
||||
- Set `export API_KEY=$API_KEY`
|
||||
- Token: <your-token-here>
|
||||
- DB: postgres://user:changeme@localhost/db
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_success
|
||||
assert_output ""
|
||||
}
|
||||
|
||||
@test "fails on a real-looking AWS access key" {
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup
|
||||
- AWS_ACCESS_KEY_ID=AKIAABCDEFGHIJKLMNOP # gitleaks:allow (synthetic fixture — this test verifies validate-secrets.sh catches exactly this pattern)
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "AWS access key ID"
|
||||
assert_output --partial "AGENTS.md:4"
|
||||
}
|
||||
|
||||
@test "fails on a credential-bearing connection string" {
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup
|
||||
- DB: postgres://svc_user:h8x2Klm9pQrT@db.internal:5432/prod
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "connection string"
|
||||
}
|
||||
|
||||
@test "detects secrets in a nested AGENTS.md, not just root" {
|
||||
mkdir -p "$TMPDIR/packages/api"
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
Clean root file.
|
||||
EOF
|
||||
cat > "$TMPDIR/packages/api/AGENTS.md" <<'EOF'
|
||||
# API package
|
||||
- token: ghp_1234567890abcdefghijklmnopqrstuvwxyz01 # gitleaks:allow (synthetic fixture)
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "packages/api/AGENTS.md"
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
setup() {
|
||||
REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
|
||||
load "$REPO_ROOT/tests/test_helper/bats-support/load"
|
||||
load "$REPO_ROOT/tests/test_helper/bats-assert/load"
|
||||
|
||||
SCRIPT="$(cd "$BATS_TEST_DIRNAME/../scripts" && pwd)/validate-structure.sh"
|
||||
TMPDIR="$(mktemp -d)"
|
||||
}
|
||||
|
||||
teardown() {
|
||||
rm -rf "$TMPDIR"
|
||||
}
|
||||
|
||||
@test "fails on an empty AGENTS.md" {
|
||||
: > "$TMPDIR/AGENTS.md"
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "empty"
|
||||
}
|
||||
|
||||
@test "fails on an unfilled placeholder AGENTS.md" {
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup
|
||||
FILL IN: describe setup commands here.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_failure
|
||||
assert_output --partial "placeholder"
|
||||
}
|
||||
|
||||
@test "passes with INFO on real content missing an optional section" {
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup commands
|
||||
- Install deps: `pnpm install`
|
||||
- Run tests: `pnpm test`
|
||||
|
||||
## Code style
|
||||
- TypeScript strict mode, single quotes, no semicolons.
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_success
|
||||
assert_output --partial "INFO"
|
||||
assert_output --partial "security"
|
||||
}
|
||||
|
||||
@test "suggests trimming a nested AGENTS.md that duplicates the root file" {
|
||||
mkdir -p "$TMPDIR/packages/api"
|
||||
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup commands
|
||||
- Install deps: `pnpm install`
|
||||
- Run tests: `pnpm test`
|
||||
- Lint: `pnpm lint`
|
||||
- Build: `pnpm build`
|
||||
EOF
|
||||
cat > "$TMPDIR/packages/api/AGENTS.md" <<'EOF'
|
||||
# AGENTS.md
|
||||
|
||||
## Setup commands
|
||||
- Install deps: `pnpm install`
|
||||
- Run tests: `pnpm test`
|
||||
- Lint: `pnpm lint`
|
||||
- Build: `pnpm build`
|
||||
EOF
|
||||
run bash "$SCRIPT" "$TMPDIR"
|
||||
assert_success
|
||||
assert_output --partial "SUGGESTION"
|
||||
assert_output --partial "packages/api/AGENTS.md"
|
||||
}
|
||||
Reference in New Issue
Block a user