From dc2d1ce17e4ce6b519556ba34c9160119af411c1 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 7 Sep 2026 01:01:53 -0500 Subject: [PATCH] fix(conformance): the R-NET-04 scan descended into nested agent worktrees MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TRACKED_YAML rglob'd from the repo root excluding only .git and _artifacts, so it also walked .claude/worktrees/agent-*/ — the isolated worktrees created for agent runs. The check counted 5 CiliumEgressGatewayPolicy objects where exactly 1 is authored, failing R-NET-04 for a reason unrelated to egress steering. Now skips dot-DIRECTORIES (covering .git, .claude, .cache) while still matching dot-FILES such as .sops.yaml. .claude/ is gitignored, so nothing beneath it is authored surface. Co-Authored-By: Claude Opus 5 --- .../l0-static/egress-paths-selected-by-rules/check.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh b/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh index 87986c1..a1d5d66 100755 --- a/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh +++ b/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh @@ -140,8 +140,16 @@ def docs(path: Path): return [] +# Skip dot-DIRECTORIES (.git, .claude, .cache) while still matching dot-FILES such as +# .sops.yaml. A bare rglob from ROOT also descends into NESTED WORKTREES — +# .claude/worktrees/agent-*/ created for isolated agent runs — which made this check see +# 5 CiliumEgressGatewayPolicy objects instead of the 1 authored, failing R-NET-04 for a +# reason that has nothing to do with egress. .claude/ is gitignored (.gitignore:43), so +# nothing under it is part of the authored surface by definition. TRACKED_YAML = sorted(p for p in ROOT.rglob("*.yaml") - if ".git" not in p.parts and "_artifacts" not in p.parts) + if "_artifacts" not in p.parts + and not any(part.startswith(".") + for part in p.relative_to(ROOT).parent.parts)) SCHEMA = ROOT / "schemas" / "servicedefinition.schema.json" RENDER = ROOT / "catalog" / "render.py" VPN_ROLE = ROOT / "infra" / "ansible" / "roles" / "vpn_egress_gateway"