On this page

#Changelog

#Unreleased

No user-facing changes.

#0.2.0

Correct the socket guard's documented coverage: a libpq driver is invisible to it

Context

The docs told a suite using psycopg to allowlist the ephemeral cluster's socket directory. That instruction never did anything. psycopg connects inside libpq, a C extension, so Python's socket module never raises an audit event and the guard never sees the connection -- there is nothing to allow and nothing to refuse. A consumer who followed the old text believed a stance was protecting it when no stance could.

The corrected text draws the line explicitly: the allowlist covers asyncpg and other clients written in Python, which the guard does see and which do need the entry; for a libpq driver the only real protection is pointing the DSN at an ephemeral cluster. The same caveat now appears in the pgcluster module docstring, the socket guard's scope paragraph, and the README, none of which stated it before. A repo rule was added so no future doc can mention the guard and a database driver without making the distinction.

#Fixes

[stricttest] Corrected the socket guard's documented coverage. The docs told a suite using psycopg to allowlist the ephemeral cluster's socket directory. That never did anything: psycopg connects inside libpq, a C extension, where the audit hook is never called, so there is no event to allow or refuse and no stance protects such a consumer. The allowlist covers asyncpg and other clients written in Python; for a libpq driver the protection is pointing the DSN at an ephemeral cluster.

#0.1.1

Fix the CI router paths filter so a batch release's tagged commit runs every project's test suite

Context

The 0.1.0 batch release published only npm and the Go module proxy. PyPI never got a build at all, because the publish gate hard-failed for py-stricttest and go-stricttest.

Cause: a batch release pushes each releasable's candidate in a separate push and lands every tag on the final "snapshot" commit. That commit (dd7e3a9) touches only .rlsbl-monorepo/snapshot.json, which no project's paths filter matched, so the CI router ran only ts-stricttest's suite on it and reported "stricttest-ci / test: skipped" and "go-stricttest-ci / test: skipped". The publish gate refuses to treat a skipped check as passing -- correctly -- so the Python and Go publish jobs failed while the TypeScript one succeeded, purely because ts-stricttest's own release commit happened to ride in the same push window.

The fix adds .rlsbl-monorepo/snapshot.json and .rlsbl-monorepo/releasables//** to every project's watch patterns, so the commit a batch release actually tags now triggers all three suites.

This release is the proof: it runs the whole pipeline end to end and resyncs all three releasables to 0.1.1. npm 0.1.0 is burned and superseded; PyPI gets its first publish here.

#Infrastructure

Fix the CI router paths filter so a batch release's tagged commit runs every project's test suite

#0.1.0

First release of the stricttest pytest plugin.

Context

Installing the plugin IS adoption: a pytest11 entry point binds an always-on isolation floor before any conftest module is imported -- throwaway HOME/XDG directories and git identity, transport lockdown, credential stripping, an audit-hook socket guard, a git push guard, per-test cwd isolation, a TMPDIR-inside-the-repo refusal, and a bare-run threshold -- plus an ephemeral PostgreSQL cluster launcher for suites that need a real database. Five safety keys are required in the pytest ini; a missing one aborts the session, because a suite that has not declared where it stands should not be allowed to run.

#Features

[stricttest] **New: the stricttest pytest plugin.** Installing it is adoption -- a pytest11 entry point binds an always-on isolation floor before any conftest is imported: throwaway HOME/XDG dirs and git identity, transport lockdown, credential stripping, an audit-hook socket guard with host:port and unix-path allowlists, a git push guard, per-test cwd isolation, a TMPDIR-inside-the-repo refusal, and a bare-run threshold. Five safety keys in [tool.pytest.ini_options] are required; a missing one aborts the session.
[stricttest] **New: stricttest.pgcluster.** An ephemeral PostgreSQL cluster for test suites: ephemeral_cluster(dsn_env=...) boots a real postmaster on tmpfs with fsync=off in well under a second, exports its libpq URL under the environment variable your application reads, and hands out throwaway per-test databases via cluster.database(). The kernel's 107-byte unix-socket limit is checked before anything starts, and binary discovery covers the plain /usr/bin layout as well as versioned ones.

#Fixes

[stricttest] Fix: the socket guard no longer leaks DNS queries or UDP datagrams. socket.gethostbyname, socket.gethostbyname_ex, socket.gethostbyaddr, socket.getfqdn and socket.sendmsg raise their own audit events and were not watched, so under stricttest_sockets = deny a real resolver query and a real UDP packet still left the machine. All five are now refused, and the loopback and allowlist carve-outs apply to them like every other event.
[stricttest] Fix: the missing-safety-keys abort now prints a snippet you can actually paste. It always emitted TOML, so a project configured through pytest.ini, tox.ini or setup.cfg got a [tool.pytest.ini_options] block with quoted values -- pasting it verbatim produced a second error. The snippet now matches the syntax of the ini file pytest actually resolved.