File size: 5,759 Bytes
3f3265f | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 | import re
import unittest
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
class ReleaseHygieneTests(unittest.TestCase):
allowed_large_files = {
Path("approach/ovod/APE/ape_d_model_final.pth"),
}
def test_release_policies_exclude_generated_python_state(self):
gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8")
release_excludes = (ROOT / "docs" / "RELEASE_EXCLUDES.txt").read_text(encoding="utf-8")
self.assertIn("__pycache__/", gitignore)
self.assertIn("*.py[cod]", gitignore)
self.assertIn(".pytest_cache/", gitignore)
self.assertIn("**/__pycache__/", release_excludes)
self.assertIn("**/*.pyc", release_excludes)
self.assertIn("**/.pytest_cache/", release_excludes)
def test_release_does_not_reference_private_relays_or_source_machines(self):
forbidden = (
"chat" + "anywhere",
"aigpt" + "x.top",
"/home/" + "sqli/",
"/research/d4/gds/" + "sqli21",
"10.249." + "190.53",
"/Users" + "/",
"/users/" + "prannay",
)
violations = []
for path in ROOT.rglob("*"):
if not path.is_file() or ".git" in path.parts:
continue
try:
text = path.read_text(encoding="utf-8")
except (UnicodeDecodeError, OSError):
continue
for needle in forbidden:
if needle in text:
violations.append(f"{path.relative_to(ROOT)}: {needle}")
self.assertEqual(violations, [])
def test_release_excludes_generated_results_and_local_git_state(self):
forbidden_parts = {
".git",
"__pycache__",
".pytest_cache",
"outputs",
"output",
"runs",
"wandb",
"results",
"eval_results",
"validation",
}
violations = []
for path in ROOT.rglob("*"):
rel = path.relative_to(ROOT)
if any(part in forbidden_parts for part in rel.parts):
violations.append(str(rel))
self.assertEqual(violations, [])
self.assertFalse(
(ROOT / "data").exists(),
"Top-level data/ must remain an external mount, not release content",
)
explicitly_forbidden = (
Path("docs/EVALUATION_VALIDATION.md"),
Path("evaluation/validation"),
Path("approach/ovod/APE/test_output.png"),
Path("baselines/claude-4.5-sonnet-e2e/claude-4.5-sonnet-tiny.json"),
)
self.assertEqual([str(path) for path in explicitly_forbidden if (ROOT / path).exists()], [])
forbidden_suffixes = (".log", ".pyc", ".pyo", ".nfs")
unexpected = []
for path in ROOT.rglob("*"):
if not path.is_file():
continue
if path.name.startswith(".nfs") or path.name.endswith(forbidden_suffixes):
unexpected.append(str(path.relative_to(ROOT)))
self.assertEqual(unexpected, [])
def test_release_has_no_credential_material(self):
forbidden_files = []
for path in ROOT.rglob("*"):
if not path.is_file():
continue
rel = path.relative_to(ROOT)
if path.name == ".env" or (
path.name.startswith(".env.") and path.name != ".env.example"
):
forbidden_files.append(str(rel))
if path.suffix.lower() in {".pem", ".key"}:
forbidden_files.append(str(rel))
self.assertEqual(forbidden_files, [])
secret_patterns = (
re.compile(r"sk-or-v1-[A-Za-z0-9_-]{20,}"),
re.compile(r"olp_[A-Za-z0-9_-]{12,}"),
re.compile(r"AIza[0-9A-Za-z_-]{20,}"),
re.compile(r"gh[pousr]_[0-9A-Za-z]{20,}"),
re.compile(r"hf_[0-9A-Za-z]{20,}"),
re.compile(r"AKIA[0-9A-Z]{16}"),
re.compile(r"BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY"),
)
violations = []
for path in ROOT.rglob("*"):
if not path.is_file() or path.suffix.lower() == ".pth":
continue
try:
text = path.read_text(encoding="utf-8")
except (UnicodeDecodeError, OSError):
continue
if any(pattern.search(text) for pattern in secret_patterns):
violations.append(str(path.relative_to(ROOT)))
self.assertEqual(violations, [])
def test_large_binary_files_are_limited_to_bundled_main_checkpoint(self):
threshold = 20 * 1024 * 1024
violations = []
for path in ROOT.rglob("*"):
if not path.is_file():
continue
rel = path.relative_to(ROOT)
if path.stat().st_size > threshold and rel not in self.allowed_large_files:
violations.append(str(rel))
self.assertEqual(violations, [])
def test_model_manifest_matches_bundled_checkpoint_policy(self):
manifest = (ROOT / "docs" / "MODEL_MANIFEST.md").read_text(encoding="utf-8")
checkpoint = ROOT / "approach" / "ovod" / "APE" / "ape_d_model_final.pth"
self.assertIn("3548f41a3238148180e08fd4b16c71f4abc3ac3caf9c8434444462d1bdb7f965", manifest)
self.assertTrue(checkpoint.is_file())
self.assertEqual(checkpoint.stat().st_size, 5_956_547_279)
attributes = (ROOT / ".gitattributes").read_text(encoding="utf-8")
self.assertIn(
"approach/ovod/APE/ape_d_model_final.pth filter=lfs diff=lfs merge=lfs -text",
attributes,
)
if __name__ == "__main__":
unittest.main()
|