docs: align contributor guidance with CI and add YAML safety regression tests - #6
Open
aliakarma wants to merge 2 commits into
Open
docs: align contributor guidance with CI and add YAML safety regression tests#6aliakarma wants to merge 2 commits into
aliakarma wants to merge 2 commits into
Conversation
Add regression tests that verify vnvspec safely rejects unsafe YAML deserialization while preserving normal specification loading. Changes: - Add regression tests for malicious `!!python/object/apply` payloads through `Spec.from_yaml()` and `Spec.from_file()`. - Verify valid YAML specifications continue to load correctly. - Verify empty YAML preserves the existing `SpecError` behavior. Repository audit confirmed that production code already uses `yaml.safe_load()`, so no production changes were required. This commit formalizes that security property with regression tests to prevent future regressions.
Update the coverage command in CONTRIBUTING.md to match the repository's current contributor workflow. Replace the outdated standalone pytest command with `just cov`, which enforces the project's 95% coverage requirement. This aligns the contributor documentation with the authoritative configuration in pyproject.toml and the existing justfile workflow. No behavioral changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR makes two small, self-contained improvements:
The changes are intentionally narrow and do not modify the public API or runtime behavior.
Changes
Documentation
CONTRIBUTING.mdto match the project's current coverage workflow.85%coverage guidance with the enforced95%threshold.just cov, matching the repository's documented development workflow.YAML parser regression tests
Motivation
The contributor guide should accurately reflect the repository's enforced CI configuration so new contributors can reproduce the same checks locally.
The YAML regression tests formalize the expected behavior of specification loading and provide protection against accidental changes to safe deserialization behavior in future refactoring.
Validation
The following project checks were executed successfully:
check_v0_1_compat.pyandcheck_v0_2_compat.py)mkdocs build --strict)The local coverage run could not be completed because the development environment failed test collection due to an unrelated
pytestmarker registration issue (vnvspecunder--strict-markers). This issue is independent of this PR, which only adds documentation updates and regression tests and does not modify the project's test infrastructure.Scope
This PR intentionally does not:
The goal is simply to improve contributor experience and strengthen regression coverage.