fix(treemap): close post-merge fail-open gaps (#127)

* fix(treemap): close fail-open metadata gaps

* chore: bump plugin version to 2.5.18

* fix(treemap): validate declared cell geometry

* fix(package): validate YAML escape sequences

* fix(package): bound Unicode YAML escapes
This commit is contained in:
Cathryn Lavery
2026-08-19 20:25:28 -07:00
committed by GitHub
parent e011b04af8
commit 0487290d5a
7 changed files with 417 additions and 50 deletions
+123
View File
@@ -305,6 +305,129 @@ def test_verifier() -> None:
"frontmatter has no metadata.version",
)
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\nmetadata:\n version: [broken\n'
' version: "1.2"\n---\n',
encoding="utf-8",
)
expect_failure(
"malformed version plus valid duplicate",
VERIFY.verify_package(root, "HEAD"),
"frontmatter has no metadata.version",
)
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\nmetadata:\n version: "1.2"\n'
' version: "1.2"\n---\n',
encoding="utf-8",
)
expect_failure(
"duplicate valid metadata versions",
VERIFY.verify_package(root, "HEAD"),
"frontmatter has no metadata.version",
)
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\ndescription: [unterminated\n'
'metadata:\n version: "1.2"\n---\n',
encoding="utf-8",
)
expect_failure(
"malformed surrounding frontmatter",
VERIFY.verify_package(root, "HEAD"),
"frontmatter has no metadata.version",
)
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\nmetadata:\n version:"1.2"\n---\n',
encoding="utf-8",
)
expect_failure(
"version value without YAML separation",
VERIFY.verify_package(root, "HEAD"),
"frontmatter has no metadata.version",
)
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\ndescription: broken: value\n'
'metadata:\n version: "1.2"\n---\n',
encoding="utf-8",
)
expect_failure(
"unquoted colon in frontmatter scalar",
VERIFY.verify_package(root, "HEAD"),
"frontmatter has no metadata.version",
)
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\ndescription: "bad\\q"\n'
'metadata:\n version: "1.2"\n---\n',
encoding="utf-8",
)
expect_failure(
"invalid double-quoted YAML escape",
VERIFY.verify_package(root, "HEAD"),
"frontmatter has no metadata.version",
)
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\ndescription: "line one\\nline two and '
'\\"quoted\\" with unicode \\u2192"\nmetadata:\n version: "1.2"\n---\n',
encoding="utf-8",
)
errors = VERIFY.verify_package(root, "HEAD")
if errors:
raise AssertionError(f"valid escaped YAML scalar failed: {errors}")
print("OK: valid double-quoted YAML escapes accepted")
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\ndescription: "highest scalar \\U0010FFFF"\n'
'metadata:\n version: "1.2"\n---\n',
encoding="utf-8",
)
errors = VERIFY.verify_package(root, "HEAD")
if errors:
raise AssertionError(f"maximum Unicode YAML escape failed: {errors}")
print("OK: maximum Unicode YAML escape U+10FFFF accepted")
with package_repo() as root:
set_versions(root, "1.2.4", "1.2.4")
skill = root / "skills" / PLUGIN_NAME / "SKILL.md"
skill.write_text(
f'---\nname: {PLUGIN_NAME}\ndescription: "out of range \\U00110000"\n'
'metadata:\n version: "1.2"\n---\n',
encoding="utf-8",
)
expect_failure(
"out-of-range Unicode YAML escape",
VERIFY.verify_package(root, "HEAD"),
"frontmatter has no metadata.version",
)
def test_bumper() -> None:
cases = (("patch", "1.2.4"), ("minor", "1.3.0"), ("major", "2.0.0"))