From e0c5c58710aba31b7bb7dc838dd7c993480e6e5d Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 17 Aug 2026 16:58:38 -0500 Subject: [PATCH] fix(conformance): chainsaw checks use contains(), not unsupported =~ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every chainsaw `check` used the regex operator `=~` (`($stdout =~ 'X'): true`), which chainsaw's expression engine rejects ('SyntaxError: Unknown char: ~') — so EVERY such test failed on the assertion even when the behavior passed. Proven with data-survival (R-STATE-01): the Longhorn canary genuinely SURVIVED pod destruction (DATA_SURVIVED_OK) but the test FAILED on the `=~` syntax. Converted all 10 tests to JMESPath `contains($stdout, 'X')` (data-survival's alternation → contains||contains). data-survival now PASSES; the other 9 (later-phase components) are syntactically fixed for when their phases deploy. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../tests/l2-behavioral/egress-class/chainsaw-test.yaml | 4 ++-- .../l2-behavioral/sso-forward-auth/chainsaw-test.yaml | 2 +- .../tests/l3-fault-injection/alerting/chainsaw-test.yaml | 2 +- .../l3-fault-injection/data-survival/chainsaw-test.yaml | 2 +- .../default-deny-failclosed/chainsaw-test.yaml | 6 +++--- .../l3-fault-injection/dr-restore/chainsaw-test.yaml | 2 +- .../l3-fault-injection/gitops-drift/chainsaw-test.yaml | 2 +- .../hands-off-update/chainsaw-test.yaml | 2 +- .../l3-fault-injection/vpn-killswitch/chainsaw-test.yaml | 4 ++-- .../tests/meta/harness-selfcheck/chainsaw-test.yaml | 8 ++++---- 10 files changed, 17 insertions(+), 17 deletions(-) diff --git a/conformance/tests/l2-behavioral/egress-class/chainsaw-test.yaml b/conformance/tests/l2-behavioral/egress-class/chainsaw-test.yaml index b133da0..35eebb7 100644 --- a/conformance/tests/l2-behavioral/egress-class/chainsaw-test.yaml +++ b/conformance/tests/l2-behavioral/egress-class/chainsaw-test.yaml @@ -38,7 +38,7 @@ spec: curl -fsS https://api.ipify.org) echo "internet_ip=$ip" # TODO: assert ip is in home/WAN set, not the PIA range. - check: { ($stdout =~ 'internet_ip='): true } + check: { (contains($stdout, 'internet_ip=')): true } - name: then-vpn-shows-vpn-ip try: - script: @@ -48,7 +48,7 @@ spec: curl -fsS https://api.ipify.org) echo "vpn_ip=$ip" # TODO: assert ip is a PIA egress address (distinct from WAN IP). - check: { ($stdout =~ 'vpn_ip='): true } + check: { (contains($stdout, 'vpn_ip=')): true } - name: when-flip-egress-class-in-git try: - script: diff --git a/conformance/tests/l2-behavioral/sso-forward-auth/chainsaw-test.yaml b/conformance/tests/l2-behavioral/sso-forward-auth/chainsaw-test.yaml index 1bfa03a..780656a 100644 --- a/conformance/tests/l2-behavioral/sso-forward-auth/chainsaw-test.yaml +++ b/conformance/tests/l2-behavioral/sso-forward-auth/chainsaw-test.yaml @@ -37,7 +37,7 @@ spec: curl -s -o /dev/null -w '%{http_code}' https://.home.keithjackson.dev) echo "unauth_code=$code" case "$code" in 302|303|401|403) echo CHALLENGED_OK ;; *) exit 1 ;; esac - check: { ($stdout =~ 'CHALLENGED_OK'): true } + check: { (contains($stdout, 'CHALLENGED_OK')): true } - name: then-authenticated-is-granted try: - script: diff --git a/conformance/tests/l3-fault-injection/alerting/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/alerting/chainsaw-test.yaml index 19a376d..955f273 100644 --- a/conformance/tests/l3-fault-injection/alerting/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/alerting/chainsaw-test.yaml @@ -48,7 +48,7 @@ spec: set -euo pipefail echo "TODO: query smtp-sink for an email whose subject matches the alert" echo "EMAIL_DELIVERED_OK" - check: { ($stdout =~ 'EMAIL_DELIVERED_OK'): true } + check: { (contains($stdout, 'EMAIL_DELIVERED_OK')): true } finally: - script: content: 'echo "TODO: clear the injected fault + drain the sink (self-cleaning)"' diff --git a/conformance/tests/l3-fault-injection/data-survival/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/data-survival/chainsaw-test.yaml index 4696bdd..7d90f1f 100644 --- a/conformance/tests/l3-fault-injection/data-survival/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/data-survival/chainsaw-test.yaml @@ -103,7 +103,7 @@ spec: [ "$GOT" = "$CANARY" ] && echo DATA_SURVIVED_OK check: # green on either a clean skip (no longhorn) or a proven survival. - ($stdout =~ '(DATA_SURVIVED_OK|DATA_SURVIVAL_SKIPPED_OK)'): true + (contains($stdout, 'DATA_SURVIVED_OK') || contains($stdout, 'DATA_SURVIVAL_SKIPPED_OK')): true finally: - script: content: | diff --git a/conformance/tests/l3-fault-injection/default-deny-failclosed/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/default-deny-failclosed/chainsaw-test.yaml index cd07ec1..da72a2d 100644 --- a/conformance/tests/l3-fault-injection/default-deny-failclosed/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/default-deny-failclosed/chainsaw-test.yaml @@ -40,7 +40,7 @@ spec: content: | set -euo pipefail kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 dest 80 && echo ALLOWED_OK - check: { ($stdout =~ 'ALLOWED_OK'): true } + check: { (contains($stdout, 'ALLOWED_OK')): true } - name: when-revoke-allow-then-fail-closed try: # FAULT INJECTION: delete the allow policy; baseline default-deny remains. @@ -56,13 +56,13 @@ spec: echo "LEAK: still reachable after allow revoked" >&2; exit 1 fi echo FAIL_CLOSED_OK - check: { ($stdout =~ 'FAIL_CLOSED_OK'): true } + check: { (contains($stdout, 'FAIL_CLOSED_OK')): true } - script: # DNS must still work (default-deny permits DNS egress). content: | set -euo pipefail kubectl -n "$NAMESPACE" exec source -- nslookup kubernetes.default && echo DNS_OK - check: { ($stdout =~ 'DNS_OK'): true } + check: { (contains($stdout, 'DNS_OK')): true } finally: - script: content: 'echo "cleanup via chainsaw namespace teardown"' diff --git a/conformance/tests/l3-fault-injection/dr-restore/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/dr-restore/chainsaw-test.yaml index bb98015..4c7cd72 100644 --- a/conformance/tests/l3-fault-injection/dr-restore/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/dr-restore/chainsaw-test.yaml @@ -46,7 +46,7 @@ spec: set -euo pipefail echo "TODO: assert app Ready in restored ns AND canary data present" echo "DR_RESTORE_OK" - check: { ($stdout =~ 'DR_RESTORE_OK'): true } + check: { (contains($stdout, 'DR_RESTORE_OK')): true } finally: - script: content: 'echo "TODO: delete the restore target namespace (self-cleaning)"' diff --git a/conformance/tests/l3-fault-injection/gitops-drift/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/gitops-drift/chainsaw-test.yaml index 0446fca..05c1943 100644 --- a/conformance/tests/l3-fault-injection/gitops-drift/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/gitops-drift/chainsaw-test.yaml @@ -45,7 +45,7 @@ spec: set -euo pipefail echo "TODO: within Flux interval, assert live value == git-declared value" echo "DRIFT_REVERTED_OK" - check: { ($stdout =~ 'DRIFT_REVERTED_OK'): true } + check: { (contains($stdout, 'DRIFT_REVERTED_OK')): true } finally: - script: content: 'echo "TODO: ensure resource left in git-declared state"' diff --git a/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml index 9ed1816..618bb53 100644 --- a/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml @@ -56,7 +56,7 @@ spec: echo "TODO: assert rolled back to last-good revision" echo "TODO: assert Alertmanager delivered an email alert (see alerting test)" echo "ROLLBACK_OK" - check: { ($stdout =~ 'ROLLBACK_OK'): true } + check: { (contains($stdout, 'ROLLBACK_OK')): true } finally: - script: content: 'echo "TODO: reset automation to a good tag (self-cleaning)"' diff --git a/conformance/tests/l3-fault-injection/vpn-killswitch/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/vpn-killswitch/chainsaw-test.yaml index a67e458..eb243f4 100644 --- a/conformance/tests/l3-fault-injection/vpn-killswitch/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/vpn-killswitch/chainsaw-test.yaml @@ -51,14 +51,14 @@ spec: echo "LEAK: vpn workload reached internet with tunnel down" >&2; exit 1 fi echo NO_LEAK_OK - check: { ($stdout =~ 'NO_LEAK_OK'): true } + check: { (contains($stdout, 'NO_LEAK_OK')): true } - script: # AND: internet-class workload is unaffected. content: | set -euo pipefail kubectl -n "$NAMESPACE" exec egress-internet -- \ curl -fsS --max-time 5 https://api.ipify.org && echo INTERNET_UNAFFECTED_OK - check: { ($stdout =~ 'INTERNET_UNAFFECTED_OK'): true } + check: { (contains($stdout, 'INTERNET_UNAFFECTED_OK')): true } - name: when-tunnel-recovers-connectivity-returns try: - script: diff --git a/conformance/tests/meta/harness-selfcheck/chainsaw-test.yaml b/conformance/tests/meta/harness-selfcheck/chainsaw-test.yaml index c58bbbb..adf2b27 100644 --- a/conformance/tests/meta/harness-selfcheck/chainsaw-test.yaml +++ b/conformance/tests/meta/harness-selfcheck/chainsaw-test.yaml @@ -50,7 +50,7 @@ spec: test -f _artifacts/coverage/coverage.md test -f _artifacts/coverage/coverage.json echo COVERAGE_EMITTED_OK - check: { ($stdout =~ 'COVERAGE_EMITTED_OK'): true } + check: { (contains($stdout, 'COVERAGE_EMITTED_OK')): true } - name: r-test-02-reproducible try: - script: @@ -63,7 +63,7 @@ spec: ./run.sh --coverage-only >/dev/null b=$(sha256sum _artifacts/coverage/coverage.json | awk '{print $1}') [ "$a" = "$b" ] && echo REPRODUCIBLE_OK - check: { ($stdout =~ 'REPRODUCIBLE_OK'): true } + check: { (contains($stdout, 'REPRODUCIBLE_OK')): true } - name: r-test-01-04-every-test-is-tagged try: - script: @@ -79,7 +79,7 @@ spec: assert rep["summary"]["annotation_label_mismatches"]==0, "label/annotation drift" print("ALL_TAGGED_OK") PY - check: { ($stdout =~ 'ALL_TAGGED_OK'): true } + check: { (contains($stdout, 'ALL_TAGGED_OK')): true } - name: r-test-05-no-safety-critical-gaps try: - script: @@ -96,4 +96,4 @@ spec: assert not gaps, f"safety-critical gaps without L3 test: {gaps}" print("NO_SAFETY_GAPS_OK") PY - check: { ($stdout =~ 'NO_SAFETY_GAPS_OK'): true } + check: { (contains($stdout, 'NO_SAFETY_GAPS_OK')): true }