Function TestComputePolicyHash_BlockedUsersExpr

pkg/workflow/cache_integrity_test.go:139–173

TestComputePolicyHash_BlockedUsersExpr verifies that BlockedUsersExpr is included in the policy hash so that expression-based policies are correctly isolated.

(t *testing.T)

// TestComputePolicyHash_BlockedUsersExpr verifies that BlockedUsersExpr is included
// in the policy hash so that expression-based policies are correctly isolated.
func TestComputePolicyHash_BlockedUsersExpr(t *testing.T) {
	base := &GitHubToolConfig{
		MinIntegrity: GitHubIntegrityUnapproved,
		AllowedRepos: []any{"github/gh-aw"},
		BlockedUsers: []string{},
	}
	baseHash := computePolicyHash(base)

	// Switching to an expression-based blocked-users should produce a different hash
	cfgWithExpr := &GitHubToolConfig{
		MinIntegrity:     GitHubIntegrityUnapproved,
		AllowedRepos:     []any{"github/gh-aw"},
		BlockedUsersExpr: "${{ vars.BLOCKED_USERS }}",
	}
	assert.NotEqual(t, baseHash, computePolicyHash(cfgWithExpr),
		"Expression-based blocked-users must produce a different hash than an empty list")

	// Different expressions must produce different hashes
	cfgWithExpr2 := &GitHubToolConfig{
		MinIntegrity:     GitHubIntegrityUnapproved,
		AllowedRepos:     []any{"github/gh-aw"},
		BlockedUsersExpr: "${{ vars.OTHER_BLOCKED_USERS }}",
	}
	assert.NotEqual(t, computePolicyHash(cfgWithExpr), computePolicyHash(cfgWithExpr2),
		"Different expressions must produce different hashes")

	// Same expression must produce the same hash (deterministic)
	cfgWithExprCopy := &GitHubToolConfig{
		MinIntegrity:     GitHubIntegrityUnapproved,
		AllowedRepos:     []any{"github/gh-aw"},
		BlockedUsersExpr: "${{ vars.BLOCKED_USERS }}",
	}
	assert.Equal(t, computePolicyHash(cfgWithExpr), computePolicyHash(cfgWithExprCopy),
		"Same expression must produce the same hash")
}

// TestComputePolicyHash_CaseInsensitive verifies that user/repo names are lowercased before hashing.
func TestComputePolicyHash_CaseInsensitive(t *testing.T) {