From 8a753e3210078d735e4129275f9a8aa7cb206df3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:08:49 +0900 Subject: [PATCH 1/3] test(opencode): require matching offline LLVM coverage tools --- .../test_opencode_rust_coverage_toolchain.py | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 tests/test_opencode_rust_coverage_toolchain.py diff --git a/tests/test_opencode_rust_coverage_toolchain.py b/tests/test_opencode_rust_coverage_toolchain.py new file mode 100644 index 000000000..16e1294e4 --- /dev/null +++ b/tests/test_opencode_rust_coverage_toolchain.py @@ -0,0 +1,39 @@ +from pathlib import Path + + +WORKFLOW_PATH = Path('.github/workflows/opencode-review-dispatch.yml') + + +def _coverage_dockerfile(workflow: str) -> str: + """Return the trusted coverage Dockerfile embedded in the OpenCode workflow. + + The coverage image is generated inside one YAML shell block. Isolating only + that heredoc keeps these assertions focused on the networked, trusted image + build and prevents unrelated workflow text from satisfying the contract. + """ + + start_marker = 'cat >"$coverage_build_dir/Dockerfile" <<\'DOCKERFILE\'' + start = workflow.index(start_marker) + len(start_marker) + end = workflow.index('\n DOCKERFILE', start) + return workflow[start:end] + + +def test_trusted_rust_coverage_image_supplies_matching_llvm_binaries() -> None: + """Require cargo-llvm-cov to use the LLVM tools matching Debian rustc. + + Debian's Rust package does not install rustup's ``llvm-tools-preview`` + component. The trusted image must therefore install Debian LLVM 19 and bind + cargo-llvm-cov to those exact binaries, otherwise every Rust repository + fails before any current-head coverage can be measured. + """ + + workflow = WORKFLOW_PATH.read_text(encoding='utf-8') + dockerfile = _coverage_dockerfile(workflow) + + assert 'llvm-19 \\\n' in dockerfile + assert 'ENV LLVM_COV=/usr/bin/llvm-cov-19' in dockerfile + assert 'ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19' in dockerfile + assert 'test -x "$LLVM_COV"' in dockerfile + assert 'test -x "$LLVM_PROFDATA"' in dockerfile + assert 'LLVM version: 19' in dockerfile + assert 'https://sh.rustup.rs' not in dockerfile From 9cdc56164bac2c1e87539b2f38d9b283a5525f73 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:09:22 +0900 Subject: [PATCH 2/3] test(opencode): make LLVM package assertion unambiguous --- tests/test_opencode_rust_coverage_toolchain.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_opencode_rust_coverage_toolchain.py b/tests/test_opencode_rust_coverage_toolchain.py index 16e1294e4..0ade8fb6a 100644 --- a/tests/test_opencode_rust_coverage_toolchain.py +++ b/tests/test_opencode_rust_coverage_toolchain.py @@ -30,7 +30,7 @@ def test_trusted_rust_coverage_image_supplies_matching_llvm_binaries() -> None: workflow = WORKFLOW_PATH.read_text(encoding='utf-8') dockerfile = _coverage_dockerfile(workflow) - assert 'llvm-19 \\\n' in dockerfile + assert ' llvm-19' in dockerfile assert 'ENV LLVM_COV=/usr/bin/llvm-cov-19' in dockerfile assert 'ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19' in dockerfile assert 'test -x "$LLVM_COV"' in dockerfile From cd71a29761fced38b6efd9f85eef4f7562923360 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:13:25 +0900 Subject: [PATCH 3/3] chore(opencode): remove incomplete LLVM coverage branch --- .../test_opencode_rust_coverage_toolchain.py | 39 ------------------- 1 file changed, 39 deletions(-) delete mode 100644 tests/test_opencode_rust_coverage_toolchain.py diff --git a/tests/test_opencode_rust_coverage_toolchain.py b/tests/test_opencode_rust_coverage_toolchain.py deleted file mode 100644 index 0ade8fb6a..000000000 --- a/tests/test_opencode_rust_coverage_toolchain.py +++ /dev/null @@ -1,39 +0,0 @@ -from pathlib import Path - - -WORKFLOW_PATH = Path('.github/workflows/opencode-review-dispatch.yml') - - -def _coverage_dockerfile(workflow: str) -> str: - """Return the trusted coverage Dockerfile embedded in the OpenCode workflow. - - The coverage image is generated inside one YAML shell block. Isolating only - that heredoc keeps these assertions focused on the networked, trusted image - build and prevents unrelated workflow text from satisfying the contract. - """ - - start_marker = 'cat >"$coverage_build_dir/Dockerfile" <<\'DOCKERFILE\'' - start = workflow.index(start_marker) + len(start_marker) - end = workflow.index('\n DOCKERFILE', start) - return workflow[start:end] - - -def test_trusted_rust_coverage_image_supplies_matching_llvm_binaries() -> None: - """Require cargo-llvm-cov to use the LLVM tools matching Debian rustc. - - Debian's Rust package does not install rustup's ``llvm-tools-preview`` - component. The trusted image must therefore install Debian LLVM 19 and bind - cargo-llvm-cov to those exact binaries, otherwise every Rust repository - fails before any current-head coverage can be measured. - """ - - workflow = WORKFLOW_PATH.read_text(encoding='utf-8') - dockerfile = _coverage_dockerfile(workflow) - - assert ' llvm-19' in dockerfile - assert 'ENV LLVM_COV=/usr/bin/llvm-cov-19' in dockerfile - assert 'ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19' in dockerfile - assert 'test -x "$LLVM_COV"' in dockerfile - assert 'test -x "$LLVM_PROFDATA"' in dockerfile - assert 'LLVM version: 19' in dockerfile - assert 'https://sh.rustup.rs' not in dockerfile