TestPermissionsInvalidScopeHandling tests how invalid scopes are handled
(t *testing.T)
| 392 | |
| 393 | // TestPermissionsInvalidScopeHandling tests how invalid scopes are handled |
| 394 | func TestPermissionsInvalidScopeHandling(t *testing.T) { |
| 395 | invalidScopes := []string{ |
| 396 | "CONTENTS", // uppercase |
| 397 | "Contents", // mixed case |
| 398 | "issue", // should be plural: issues |
| 399 | "pullrequests", // should be hyphenated: pull-requests |
| 400 | "random-scope", // not a valid GitHub permission scope |
| 401 | } |
| 402 | |
| 403 | for _, scope := range invalidScopes { |
| 404 | t.Run("invalid scope: "+scope, func(t *testing.T) { |
| 405 | permissions := "permissions:\n " + scope + ": read" |
| 406 | parser := NewPermissionsParser(permissions) |
| 407 | |
| 408 | // Invalid scopes might still be parsed by YAML parser |
| 409 | // but they won't be recognized as valid GitHub Actions permissions |
| 410 | // This test documents that behavior |
| 411 | if level, exists := parser.parsedPerms[scope]; exists { |
| 412 | t.Logf("Invalid scope %q was parsed with level %q (YAML allows it, but GitHub Actions may reject it)", scope, level) |
| 413 | } |
| 414 | }) |
| 415 | } |
| 416 | } |
| 417 | |
| 418 | // TestPermissionCombinations tests various permission combinations |
| 419 | func TestPermissionCombinations(t *testing.T) { |
nothing calls this directly
no test coverage detected