35 lines
1.4 KiB
Bash
35 lines
1.4 KiB
Bash
#!/bin/bash
|
|
# TDD file lock — runs as root before agent user takes over.
|
|
# Creates a root-owned immutable reference copy of tests/ and locks the
|
|
# working copy so the agent cannot write to any test file.
|
|
set -euo pipefail
|
|
|
|
if [ ! -d "/workspace/tests" ]; then
|
|
echo "[tdd-file-lock] No /workspace/tests found — nothing to protect."
|
|
exit 0
|
|
fi
|
|
|
|
echo "[tdd-file-lock] Locking test files (running as $(id))..."
|
|
|
|
# Root-owned reference copy — agent cannot chmod/write/delete these
|
|
mkdir -p /workspace/reference/tests
|
|
cp -r /workspace/tests/. /workspace/reference/tests/
|
|
chown -R root:root /workspace/reference/tests
|
|
find /workspace/reference/tests -type f -exec chmod 444 {} \;
|
|
find /workspace/reference/tests -type d -exec chmod 555 {} \;
|
|
|
|
# SHA256 checksums for post-task external verification
|
|
find /workspace/tests -name "*.py" | sort | xargs sha256sum > /workspace/.test-shas
|
|
chown root:root /workspace/.test-shas
|
|
chmod 444 /workspace/.test-shas
|
|
|
|
# Lock the working tests/ directory — files and dirs owned by root, no write for anyone
|
|
chown -R root:root /workspace/tests
|
|
find /workspace/tests -type f -exec chmod 444 {} \;
|
|
find /workspace/tests -type d -exec chmod 555 {} \;
|
|
|
|
TEST_COUNT=$(find /workspace/tests -name "*.py" | wc -l)
|
|
echo "[tdd-file-lock] Protected ${TEST_COUNT} test files."
|
|
echo "[tdd-file-lock] Immutable reference: /workspace/reference/tests/"
|
|
echo "[tdd-file-lock] SHA256 reference: /workspace/.test-shas"
|