Compare commits

..

No commits in common. "main" and "fix/pycache-gitignore" have entirely different histories.

6 changed files with 6 additions and 50 deletions

View File

@ -1,5 +0,0 @@
name: CI
on: [push, pull_request]
jobs:
validate:
uses: molecule-ai/molecule-ci/.gitea/workflows/validate-plugin.yml@main

5
.github/workflows/ci.yml vendored Normal file
View File

@ -0,0 +1,5 @@
name: CI
on: [push, pull_request]
jobs:
validate:
uses: molecule-ai/molecule-ci/.github/workflows/validate-plugin.yml@main

17
.gitignore vendored
View File

@ -19,20 +19,3 @@
# Workspace auth tokens
.auth-token
.auth_token
# Python bytecode (append only — do not remove entries above)
__pycache__/
*.pyc
.pytest_cache/
# Python bytecode (append only — do not remove entries above)
__pycache__/
*.pyc
*.py[cod]
*$py.class
.Python
*.egg-info/
*.egg
.pytest_cache/
build/
dist/
.eggs/

View File

@ -1,5 +1,5 @@
name: molecule-careful-bash
version: 1.0.1
version: 1.0.0
description: Refuse destructive bash commands (git push --force to main, rm -rf at root, DROP TABLE prod). PreToolUse:Bash hook.
author: Molecule AI
tags: [molecule, guardrails]

View File

@ -1,27 +0,0 @@
# Test Coverage — molecule-careful-bash
## What We Test
This plugin has **executable hooks** (Python), so it warrants real unit tests.
| File | Tests | Coverage |
|------|-------|---------|
| `hooks/pre-bash-careful.py` | 35 pytest tests | Destructive command blocking, token exfiltration prevention |
## Test Categories
| Class | Count | What |
|-------|-------|------|
| `TestRefuseForcePush` | 5 | `git push --force` to main/master blocked; feature branches allowed |
| `TestRefuseGitResetHard` | 3 | `git reset --hard` on main blocked; feature branches allowed |
| `TestRefuseSQLDestructive` | 4 | `DROP TABLE/DATABASE prod` blocked; test/sandbox allowed |
| `TestRefuseRmRf` | 5 | `rm -rf /`, home, `.git` blocked; safe paths allowed |
| `TestTokenExfiltrationBlocking` | 13 | Token file reads, `env \| grep` secrets, credential path exfil blocked |
| `TestWarnList` | 2 | Warning-only patterns: `--force-with-lease`, `close` PR |
| Safe-prompt passthrough | 3 | Legitimate commands (normal push, grep for non-secret, non-token files) pass through |
## Running Tests
```bash
python -m pytest tests/ -v
```