diffguard 0.2.0

CLI for diff-scoped governance linting in pull requests
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166

//! BDD tests for base-only unchanged code behavior.
//!
//! Verifies that diffguard ignores violations in unchanged base code.

use super::test_repo::TestRepo;

/// Scenario: unwrap() exists only in base (not modified) - should pass.
///
/// Given: A repository where the base commit has unwrap() in the code
/// When: A new commit makes unrelated changes (not touching the unwrap line)
/// Then: Exit code is 0 (pass) because the unwrap was not added/changed
#[test]
fn given_unwrap_only_in_base_when_check_then_pass() {
    // Given: A repository where the base commit has unwrap() in the code
    let repo = TestRepo::with_initial_content(&[(
        "src/lib.rs",
        "pub fn legacy() -> u32 { Some(1).unwrap() }\n",
    )]);

    // When: A new commit makes unrelated changes
    repo.write_file(
        "src/lib.rs",
        r#"pub fn legacy() -> u32 { Some(1).unwrap() }
pub fn new_safe_function() -> Option<u32> { Some(42) }
"#,
    );
    let head_sha = repo.commit("add new safe function");

    // Then: Exit code is 0 because the unwrap was not added/changed
    let result = repo.run_check(&head_sha);
    result.assert_exit_code(0);

    let receipt = result.parse_receipt();
    assert_eq!(receipt.findings_count(), 0);
    assert_eq!(receipt.verdict_status(), Some("pass"));
}

/// Scenario: unwrap() in base, other file modified - should pass.
///
/// Given: A file with unwrap() exists in base
/// When: A different file is added/modified
/// Then: No findings because the unwrap file was not touched
#[test]
fn given_unwrap_in_base_when_other_file_changed_then_pass() {
    // Given: A file with unwrap() exists in base
    let repo = TestRepo::with_initial_content(&[
        (
            "src/lib.rs",
            "pub fn legacy() -> u32 { Some(1).unwrap() }\n",
        ),
        ("src/other.rs", "pub fn other() {}\n"),
    ]);

    // When: A different file is added/modified
    repo.write_file(
        "src/other.rs",
        "pub fn other() { println!(\"modified\"); }\n",
    );
    let head_sha = repo.commit("modify other file");

    // Then: No findings on the unwrap (but may have warning for println)
    let result = repo.run_check(&head_sha);

    let receipt = result.parse_receipt();
    // Should not have unwrap finding (that file wasn't changed)
    assert!(!receipt.has_finding_with_rule("rust.no_unwrap"));
    // May have dbg/println warning, but that's separate
}

/// Scenario: No changes at all - empty diff should pass.
///
/// Given: A repository with some code
/// When: Checking with base == head (no changes)
/// Then: Exit code is 0 with no findings
#[test]
fn given_no_changes_when_check_then_pass() {
    // Given: A repository with some code
    let repo = TestRepo::new();

    // When: Checking with base == head (no changes)
    // Just check at the base SHA itself
    let result = repo.run_check(&repo.base_sha);

    // Then: Exit code is 0 with no findings
    result.assert_exit_code(0);

    let receipt = result.parse_receipt();
    assert_eq!(receipt.findings_count(), 0);
}

/// Scenario: Context lines from base are not flagged.
///
/// Given: A file with unwrap() in the middle
/// When: Lines are added near (but not touching) the unwrap line
/// Then: The unwrap is not flagged because it wasn't changed
#[test]
fn given_unwrap_in_context_when_nearby_change_then_not_flagged() {
    // Given: A file with unwrap() in the middle
    let repo = TestRepo::with_initial_content(&[(
        "src/lib.rs",
        r#"pub fn before() {}

pub fn risky() -> u32 {
    Some(1).unwrap()
}

pub fn after() {}
"#,
    )]);

    // When: Lines are added near but not touching the unwrap line
    repo.write_file(
        "src/lib.rs",
        r#"pub fn before() {}
pub fn new_before() {}

pub fn risky() -> u32 {
    Some(1).unwrap()
}

pub fn new_after() {}
pub fn after() {}
"#,
    );
    let head_sha = repo.commit("add functions around risky");

    // Then: The unwrap is not flagged because it wasn't changed
    let result = repo.run_check(&head_sha);
    result.assert_exit_code(0);

    let receipt = result.parse_receipt();
    assert!(!receipt.has_finding_with_rule("rust.no_unwrap"));
}

/// Scenario: Deleting lines doesn't trigger base content checks.
///
/// Given: A file with multiple functions including some with unwrap
/// When: Safe lines are deleted (not the unwrap lines)
/// Then: No findings are reported
#[test]
fn given_deletion_only_when_check_then_pass() {
    // Given: A file with multiple functions
    let repo = TestRepo::with_initial_content(&[(
        "src/lib.rs",
        r#"pub fn keep_me() {}
pub fn delete_me() {}
pub fn also_keep() {}
"#,
    )]);

    // When: A line is deleted
    repo.write_file(
        "src/lib.rs",
        r#"pub fn keep_me() {}
pub fn also_keep() {}
"#,
    );
    let head_sha = repo.commit("delete a function");

    // Then: No findings (deletions don't add violations)
    let result = repo.run_check(&head_sha);
    result.assert_exit_code(0);

    let receipt = result.parse_receipt();
    assert_eq!(receipt.findings_count(), 0);
}