Repository navigation
test(shellmode): make command lookup independent of host PATH - #353
Merged
Merged
Conversation
Patel230
force-pushed
the
test/shellmode-path-independence
branch
from
October 22, 2026 09:42
4de9b3d to
4403e25
Compare
- Indirect exec.LookPath through a package variable and stub it in tests so routing results do not depend on installed binaries (e.g. make). - Clear the lookup cache around each stub so results cannot leak between tests. - Add a commit-policy CI job requiring verified signatures and rejecting AI co-author/attribution trailers. - Bump CI Go to 1.27.3 to clear GO-2026-6443 (crypto/x509).
Patel230
added a commit
that referenced
this pull request
Oct 22, 2026
- Indirect exec.LookPath through a package variable and stub it in tests so routing results do not depend on installed binaries (e.g. make). - Clear the lookup cache around each stub so results cannot leak between tests. - Add a commit-policy CI job requiring verified signatures and rejecting AI co-author/attribution trailers. - Bump CI Go to 1.27.3 to clear GO-2026-6443 (crypto/x509).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
TestClassifyInputfailed on a machine withoutmake:ClassifyInput("make -C build")returnedClassAgentbecauseisValidCommandusedexec.LookPathdirectly, so results depended on the host toolchain.securityjob was red on a Go standard-library CVE: GO-2026-6443 (crypto/x509, fixed in Go 1.27.3).What
lookPathvariable (defaults toexec.LookPath); production behavior is unchanged.stubCommandstest helper that replaces lookup for the duration of a test and clears the package-levelcmdCache, restoring both witht.Cleanup.commit policyCI job (scripts/check-commit-policy.sh) requires every commit in the PR/push to have a verified signature and rejects AI co-author or AI generation trailers (Claude, Copilot, GPT, Cursor, Gemini, Codex, Aider, etc.). The commit in this PR is GitHub-signed so it passes its own check.GO_VERSIONto1.27.3for the x509 fix.Verification
go test ./internal/features/shellmode/ -count=1✅ with nomakeon PATHgo vet ./internal/features/shellmode/✅gofumpt -l/goimports -lclean ✅