()
| 143 | // 5. No duplicate when workdir already in read_write. |
| 144 | #[test] |
| 145 | fn test_include_workdir_no_duplicate() { |
| 146 | let yaml = r" |
| 147 | version: 1 |
| 148 | filesystem_policy: |
| 149 | include_workdir: true |
| 150 | read_write: |
| 151 | - /sandbox |
| 152 | - /tmp |
| 153 | "; |
| 154 | let model = policy::parse_policy_str(yaml).expect("parse"); |
| 155 | let readable = model.filesystem_policy.readable_paths(); |
| 156 | let sandbox_count = readable.iter().filter(|p| *p == "/sandbox").count(); |
| 157 | assert_eq!(sandbox_count, 1); |
| 158 | } |
| 159 | |
| 160 | // 6. End-to-end: testdata policy with a github credential in scope and a |
| 161 | // bypass-L7 binary (git) emits an `l7_bypass_credentialed` finding. |
nothing calls this directly
no test coverage detected