Function TestComputeIntegrityCacheKey_CustomKey

pkg/workflow/cache_integrity_test.go:343–362

TestComputeIntegrityCacheKey_CustomKey verifies that custom keys get the integrity prefix to prevent cross-integrity cache sharing.

(t *testing.T)

// TestComputeIntegrityCacheKey_CustomKey verifies that custom keys get the integrity prefix
// to prevent cross-integrity cache sharing.
func TestComputeIntegrityCacheKey_CustomKey(t *testing.T) {
	cfg := &GitHubToolConfig{
		MinIntegrity: GitHubIntegrityMerged,
		AllowedRepos: "all",
	}
	policyHash := computePolicyHash(cfg)

	entry := CacheMemoryEntry{
		ID:  "default",
		Key: "my-custom-key",
	}
	key := computeIntegrityCacheKey(entry, cfg)

	// Custom keys must be prefixed with integrity/policy to prevent cross-level sharing
	expectedPrefix := "memory-merged-" + policyHash + "-"
	assert.True(t, strings.HasPrefix(key, expectedPrefix),
		"Custom keys must be prefixed with integrity/policy, got: %s", key)
	assert.True(t, strings.HasSuffix(key, "-${{ github.run_id }}"),
		"Custom keys should end with run_id suffix, got: %s", key)
}

// TestComputeIntegrityCacheKey_CustomKeyWithRunID verifies that custom keys already containing
// the run_id suffix are not duplicated, but still get the integrity prefix.