k-skill/tools/k-skill-qa-bot/test/bats/env.bats
Jeffrey (Dongkyu) Kim e9b6f03812 Keep the QA judge constrained while preserving live skill checks
Restore the safer judge boundary requested in review while keeping the network-capable skill runner behavior that prevents false DNS failures. Add regression coverage for the default model and judge command flags so the boundary cannot drift silently.

Constraint: PR #261 review required judge safety fixes without reverting the skill runner sandbox bypass.

Rejected: Running the judge with --dangerously-bypass-approvals-and-sandbox | unnecessary for transcript-only JSON grading and expands prompt-injection impact.

Confidence: high

Scope-risk: narrow

Directive: Keep skill execution and judge execution as separate trust boundaries; only the skill runner should bypass the Codex sandbox.

Tested: bats tools/k-skill-qa-bot/test/bats/; shellcheck -e SC1091,SC2016,SC2012 tools/k-skill-qa-bot/bin/*.sh tools/k-skill-qa-bot/bin/lib/*.sh tools/k-skill-qa-bot/install.sh tools/k-skill-qa-bot/uninstall.sh; python3 -m py_compile tools/k-skill-qa-bot/bin/*.py tools/k-skill-qa-bot/bin/lib/*.py; git diff --check

Not-tested: Live launchd QA run and real Codex API judge call

Co-authored-by: OmX <omx@oh-my-codex.dev>
2026-05-18 14:41:11 +09:00

27 lines
1 KiB
Bash

#!/usr/bin/env bats
setup() {
QA_BOT_ROOT="$(cd "$BATS_TEST_DIRNAME/../.." && pwd)"
ENV_SH="$QA_BOT_ROOT/bin/lib/env.sh"
}
@test "env.sh sets all default values when nothing else is set" {
run env -i HOME="$HOME" PATH="$PATH" ENV_SH="$ENV_SH" bash -c '. "$ENV_SH" && echo "$CODEX_MODEL|$MAX_PARALLEL|$GH_REPO|$LAST_RUN_MIN_AGE|$CREATE_ISSUES|$JUDGE_MODEL"'
[ "$status" -eq 0 ]
[ "$output" = "gpt-5.5|4|NomaDamas/k-skill|259200|false|gpt-5.5" ]
}
@test "env.sh respects existing environment variables" {
run env -i HOME="$HOME" PATH="$PATH" ENV_SH="$ENV_SH" MAX_PARALLEL=8 CODEX_MODEL=custom bash -c '. "$ENV_SH" && echo "$CODEX_MODEL|$MAX_PARALLEL"'
[ "$status" -eq 0 ]
[ "$output" = "custom|8" ]
}
@test "env.sh respects user .env overrides" {
TMP=$(mktemp -d)
echo 'MAX_PARALLEL=16' > "$TMP/.env"
run env -i HOME="$HOME" PATH="$PATH" ENV_SH="$ENV_SH" K_QA_HOME="$TMP" bash -c '. "$ENV_SH" && echo "$MAX_PARALLEL"'
[ "$status" -eq 0 ]
[ "$output" = "16" ]
rm -rf "$TMP"
}