Function TestComputePolicyHash_FieldChanges

pkg/workflow/cache_integrity_test.go:49–101

TestComputePolicyHash_FieldChanges verifies that changing any single policy field produces a different hash.

(t *testing.T)

// TestComputePolicyHash_FieldChanges verifies that changing any single policy field produces a different hash.
func TestComputePolicyHash_FieldChanges(t *testing.T) {
	base := &GitHubToolConfig{
		MinIntegrity: GitHubIntegrityUnapproved,
		AllowedRepos: []any{"github/gh-aw"},
		BlockedUsers: []string{},
	}
	baseHash := computePolicyHash(base)

	tests := []struct {
		name string
		cfg  *GitHubToolConfig
	}{
		{
			name: "change min-integrity",
			cfg: &GitHubToolConfig{
				MinIntegrity: GitHubIntegrityApproved,
				AllowedRepos: []any{"github/gh-aw"},
				BlockedUsers: []string{},
			},
		},
		{
			name: "change repos",
			cfg: &GitHubToolConfig{
				MinIntegrity: GitHubIntegrityUnapproved,
				AllowedRepos: []any{"github/other-repo"},
				BlockedUsers: []string{},
			},
		},
		{
			name: "add blocked user",
			cfg: &GitHubToolConfig{
				MinIntegrity: GitHubIntegrityUnapproved,
				AllowedRepos: []any{"github/gh-aw"},
				BlockedUsers: []string{"attacker1"},
			},
		},
		{
			name: "change repos to 'all'",
			cfg: &GitHubToolConfig{
				MinIntegrity: GitHubIntegrityUnapproved,
				AllowedRepos: "all",
				BlockedUsers: []string{},
			},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			hash := computePolicyHash(tt.cfg)
			assert.NotEqual(t, baseHash, hash, "Changing '%s' must produce a different hash", tt.name)
		})
	}
}

// TestComputePolicyHash_ListOrderIndependent verifies that list order does not affect the hash.
func TestComputePolicyHash_ListOrderIndependent(t *testing.T) {