Function TestCacheMemoryStepsIntegrityAwareKey

pkg/workflow/cache_integrity_test.go:422–456

TestCacheMemoryStepsIntegrityAwareKey verifies that the generated cache key includes the integrity level and policy hash.

(t *testing.T)

// TestCacheMemoryStepsIntegrityAwareKey verifies that the generated cache key
// includes the integrity level and policy hash.
func TestCacheMemoryStepsIntegrityAwareKey(t *testing.T) {
	toolsMap := map[string]any{
		"cache-memory": true,
		"github": map[string]any{
			"allowed":       []any{"get_repository"},
			"min-integrity": "unapproved",
			"allowed-repos": []any{"github/gh-aw"},
		},
	}

	toolsConfig, err := ParseToolsConfig(toolsMap)
	require.NoError(t, err, "Should parse tools config")

	compiler := NewCompiler()
	cacheMemoryConfig, err := compiler.extractCacheMemoryConfig(toolsConfig)
	require.NoError(t, err, "Should extract cache-memory config")

	parsedTools := NewTools(toolsMap)

	data := &WorkflowData{
		CacheMemoryConfig: cacheMemoryConfig,
		ParsedTools:       parsedTools,
	}

	var builder strings.Builder
	generateCacheMemorySteps(&builder, data)
	output := builder.String()

	// Key should start with "memory-unapproved-" followed by an 8-char hash
	assert.Contains(t, output, "key: memory-unapproved-",
		"Cache key should include 'unapproved' integrity level")
	// Should NOT contain the old format (without integrity prefix)
	assert.NotContains(t, output, "key: memory-${{ env.GH_AW_WORKFLOW_ID_SANITIZED }}",
		"Cache key should not use the old format without integrity prefix")
}

// TestCacheMemoryStepsNoPolicy verifies that the generated cache key uses the
// nopolicy sentinel when no guard policy is configured.