mirror of
https://github.com/prompt-security/clawsec.git
synced 2026-06-13 05:28:02 +03:00
David Abutbul
b37162a33d
* feat(i18n): add multilingual wiki scaffolding, language switcher, and translation QA pipeline * docs(readme): adopt picoclaw-style multilingual link bar * fix(i18n): repair localized index links and tighten partial-pair QA * ci(i18n): fail on broken markdown links in README/wiki * ci(i18n): add changed-files mode for markdown link checks * i18n(de): use local Argos MT to fill untranslated German sections * i18n(es,fr): fill untranslated sections via local Argos workflow * i18n(ja): fill untranslated sections with scoped local Argos pass * i18n(ko): fill untranslated sections with scoped local Argos pass * fix(i18n): address review feedback --------- Co-authored-by: David Abutbul <David.a@prompt.security>
83 lines
3.9 KiB
Markdown
83 lines
3.9 KiB
Markdown
<!-- AUTO-GENERATED TRANSLATION SCAFFOLD (de)
|
|
Source: ../testing.md
|
|
Review status: draft
|
|
-->
|
|
|
|
# Testing
|
|
|
|
## Testing Strategy
|
|
- The repository uses layered verification rather than a single root `npm test` command.
|
|
- Core confidence comes from lint/type/build gates plus skill-local Node test suites.
|
|
- Python and shell tooling are validated through dedicated lint/security checks.
|
|
- Workflow pipelines run the same command classes used in local pre-push automation.
|
|
|
|
## Verification Layers
|
|
| Layer | Commands | Scope |
|
|
| --- | --- | --- |
|
|
| Frontend/static checks | ESLint + `tsc --noEmit` + `npm run build` | TS/TSX correctness and build viability. |
|
|
| Skill unit tests | `node skills/<skill>/test/*.test.mjs` | Signature, matching, suppression, installer contracts. |
|
|
| Python quality | `ruff check utils/`, `bandit -r utils/ -ll` | Utility correctness and security patterns. |
|
|
| Shell/script quality | ShellCheck + manual script smoke runs | Script hygiene and command robustness. |
|
|
| CI security scans | Trivy, npm audit, CodeQL, Scorecard | Dependency, config, and supply-chain security posture. |
|
|
| Local pre-push security scan | optional `gitleaks detect` via `scripts/prepare-to-push.sh` | Secret leak detection before push. |
|
|
|
|
## Skill Test Matrix
|
|
| Skill | Test Files | Primary Focus |
|
|
| --- | --- | --- |
|
|
| `clawsec-suite` | `feed_verification`, `guarded_install`, `path_resolution`, fuzz tests | Signature checks, advisory gating, path safety, matching robustness. |
|
|
| `openclaw-audit-watchdog` | suppression config and render tests | Config parsing, suppression behavior, report formatting. |
|
|
| `clawsec-clawhub-checker` | `reputation_check.test.mjs` | Input validation and reputation gating behavior. |
|
|
|
|
## CI Workflow Coverage
|
|
| Workflow | Trigger | Key Assertions |
|
|
| --- | --- | --- |
|
|
| `ci.yml` | PR/push to `main` | Lint/type/build, Python checks, security scans, skill tests. |
|
|
| `codeql.yml` | PR/push/schedule | JS/TS static security analysis. |
|
|
| `scorecard.yml` | schedule/push | Supply-chain posture reporting and SARIF upload. |
|
|
| `skill-release.yml` | tags + PRs | Version parity and release artifact verification. |
|
|
|
|
## Local Testing Commands
|
|
```bash
|
|
# baseline frontend + config checks
|
|
npx eslint . --ext .ts,.tsx,.js,.jsx,.mjs --max-warnings 0
|
|
npx tsc --noEmit
|
|
npm run build
|
|
```
|
|
|
|
```bash
|
|
# representative skill tests
|
|
node skills/clawsec-suite/test/feed_verification.test.mjs
|
|
node skills/clawsec-suite/test/guarded_install.test.mjs
|
|
node skills/openclaw-audit-watchdog/test/suppression_config.test.mjs
|
|
```
|
|
|
|
## Failure Patterns to Watch
|
|
- Signature/test fixtures can fail from key/payload mismatch when expected files are regenerated inconsistently.
|
|
- Path-resolution tests intentionally fail on escaped home tokens; this behavior is expected and security-relevant.
|
|
- Local scripts relying on `openclaw` or `clawhub` binaries may fail in environments where those CLIs are absent.
|
|
- Deploy/release logic can pass locally while failing in CI if signing secrets or workflow permissions differ.
|
|
|
|
## Suggested Test Order
|
|
1. Run `./scripts/prepare-to-push.sh` for a full local gate.
|
|
2. Run directly impacted skill-local tests.
|
|
3. For feed/signing changes, run suite verification tests first (`feed_verification`, `guarded_install`).
|
|
4. For workflow or release changes, also run `scripts/validate-release-links.sh` and key consistency script.
|
|
|
|
## Update Notes
|
|
- 2026-02-26: Updated source references to the migrated `wiki/platform-verification.md` checklist.
|
|
|
|
## Source References
|
|
- AGENTS.md
|
|
- scripts/prepare-to-push.sh
|
|
- scripts/validate-release-links.sh
|
|
- .github/workflows/ci.yml
|
|
- .github/workflows/codeql.yml
|
|
- .github/workflows/scorecard.yml
|
|
- .github/workflows/skill-release.yml
|
|
- skills/clawsec-suite/test/feed_verification.test.mjs
|
|
- skills/clawsec-suite/test/guarded_install.test.mjs
|
|
- skills/clawsec-suite/test/path_resolution.test.mjs
|
|
- skills/openclaw-audit-watchdog/test/suppression_config.test.mjs
|
|
- skills/clawsec-clawhub-checker/test/reputation_check.test.mjs
|
|
- wiki/platform-verification.md
|