[Crane: crane-migration-python-to-go-full-apm-cli-rewrite] Iteration 18: Port policy/ + security/ -- 304 parity tests, score 1.0

Run: https://github.com/githubnext/apm/actions/runs/26493354341

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

internal/policy/matcher.go

@@ -0,0 +1,34 @@
+// Package policy -- glob-style pattern matcher for policy allow/deny lists.
+// Mirrors Python apm_cli.policy.matcher.
+package policy
+
+import "path/filepath"
+
+// MatchesAny returns true if the candidate matches any of the given glob patterns.
+// Patterns use filepath.Match semantics (shell glob, no path separator in *).
+func MatchesAny(candidate string, patterns []string) bool {
+	for _, p := range patterns {
+		if ok, _ := filepath.Match(p, candidate); ok {
+			return true
+		}
+	}
+	return false
+}
+
+// MatchesAllowList returns true if candidate is permitted by the allowlist.
+// nil allowlist = "no opinion" (allow all). Empty allowlist = "allow nothing".
+func MatchesAllowList(candidate string, allow []string) bool {
+	if allow == nil {
+		return true
+	}
+	return MatchesAny(candidate, allow)
+}
+
+// MatchesDenyList returns true if candidate is blocked by the denylist.
+// nil denylist = "no opinion" (deny nothing). Empty = deny nothing.
+func MatchesDenyList(candidate string, deny []string) bool {
+	if deny == nil || len(deny) == 0 {
+		return false
+	}
+	return MatchesAny(candidate, deny)
+}

internal/policy/models.go

@@ -0,0 +1,93 @@
+// Package policy provides data models for CI/policy audit checks.
+// It mirrors the Python apm_cli.policy.models module.
+package policy
+
+// CheckResult is the result of a single CI check.
+type CheckResult struct {
+	Name    string   // e.g., "lockfile-exists"
+	Passed  bool
+	Message string   // human-readable description
+	Details []string // individual violations
+}
+
+// CIAuditResult is the aggregate result of all CI checks.
+type CIAuditResult struct {
+	Checks []CheckResult
+}
+
+// Passed returns true if all checks passed.
+func (r *CIAuditResult) Passed() bool {
+	for _, c := range r.Checks {
+		if !c.Passed {
+			return false
+		}
+	}
+	return true
+}
+
+// FailedChecks returns only the checks that did not pass.
+func (r *CIAuditResult) FailedChecks() []CheckResult {
+	var out []CheckResult
+	for _, c := range r.Checks {
+		if !c.Passed {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+// ToJSON serializes to a JSON-compatible map.
+func (r *CIAuditResult) ToJSON() map[string]interface{} {
+	checks := make([]map[string]interface{}, len(r.Checks))
+	passed, failed := 0, 0
+	for i, c := range r.Checks {
+		checks[i] = map[string]interface{}{
+			"name":    c.Name,
+			"passed":  c.Passed,
+			"message": c.Message,
+			"details": c.Details,
+		}
+		if c.Passed {
+			passed++
+		} else {
+			failed++
+		}
+	}
+	return map[string]interface{}{
+		"passed": r.Passed(),
+		"checks": checks,
+		"summary": map[string]interface{}{
+			"total":  len(r.Checks),
+			"passed": passed,
+			"failed": failed,
+		},
+	}
+}
+
+// CheckArtifactMap maps check names to their most relevant artifact.
+var CheckArtifactMap = map[string]string{
+	"lockfile-exists":           "apm.lock.yaml",
+	"ref-consistency":           "apm.lock.yaml",
+	"deployed-files-present":    "apm.lock.yaml",
+	"no-orphaned-packages":      "apm.lock.yaml",
+	"config-consistency":        "apm.lock.yaml",
+	"content-integrity":         "apm.lock.yaml",
+	"dependency-allowlist":      "apm.yml",
+	"dependency-denylist":       "apm.yml",
+	"required-packages":         "apm.yml",
+	"required-packages-deployed": "apm.lock.yaml",
+	"required-package-version":  "apm.lock.yaml",
+	"transitive-depth":          "apm.lock.yaml",
+	"mcp-allowlist":             "apm.yml",
+	"mcp-denylist":              "apm.yml",
+	"mcp-transport":             "apm.yml",
+	"mcp-self-defined":          "apm.yml",
+	"compilation-target":        "apm.yml",
+	"compilation-strategy":      "apm.yml",
+	"source-attribution":        "apm.yml",
+	"required-manifest-fields":  "apm.yml",
+	"scripts-policy":            "apm.yml",
+	"unmanaged-files":           "apm.yml",
+	"manifest-parse":            "apm.yml",
+	"manifest-missing":          "apm.yml",
+}

internal/policy/policy_test.go

@@ -0,0 +1,236 @@
+package policy_test
+
+import (
+	"testing"
+
+	"github.com/githubnext/apm/internal/policy"
+)
+
+// TestParityCheckResult validates CheckResult structure mirrors Python models.CheckResult.
+func TestParityCheckResult(t *testing.T) {
+	cr := policy.CheckResult{
+		Name:    "lockfile-exists",
+		Passed:  true,
+		Message: "Lockfile found",
+		Details: []string{},
+	}
+	if cr.Name != "lockfile-exists" {
+		t.Errorf("expected name lockfile-exists, got %s", cr.Name)
+	}
+	if !cr.Passed {
+		t.Errorf("expected passed=true")
+	}
+}
+
+// TestParityCIAuditResultPassed verifies all-pass aggregate.
+func TestParityCIAuditResultPassed(t *testing.T) {
+	r := &policy.CIAuditResult{
+		Checks: []policy.CheckResult{
+			{Name: "lockfile-exists", Passed: true, Message: "ok"},
+			{Name: "ref-consistency", Passed: true, Message: "ok"},
+		},
+	}
+	if !r.Passed() {
+		t.Errorf("expected all checks to pass")
+	}
+	if len(r.FailedChecks()) != 0 {
+		t.Errorf("expected 0 failed checks")
+	}
+}
+
+// TestParityCIAuditResultFailed verifies failed checks aggregation.
+func TestParityCIAuditResultFailed(t *testing.T) {
+	r := &policy.CIAuditResult{
+		Checks: []policy.CheckResult{
+			{Name: "lockfile-exists", Passed: true, Message: "ok"},
+			{Name: "ref-consistency", Passed: false, Message: "mismatch", Details: []string{"sha mismatch on pkg-a"}},
+		},
+	}
+	if r.Passed() {
+		t.Errorf("expected not all passed")
+	}
+	failed := r.FailedChecks()
+	if len(failed) != 1 {
+		t.Errorf("expected 1 failed check, got %d", len(failed))
+	}
+	if failed[0].Name != "ref-consistency" {
+		t.Errorf("expected ref-consistency to fail")
+	}
+}
+
+// TestParityCIAuditResultToJSON verifies JSON serialization mirrors Python.
+func TestParityCIAuditResultToJSON(t *testing.T) {
+	r := &policy.CIAuditResult{
+		Checks: []policy.CheckResult{
+			{Name: "lockfile-exists", Passed: true, Message: "ok", Details: []string{}},
+			{Name: "ref-consistency", Passed: false, Message: "mismatch", Details: []string{"detail1"}},
+		},
+	}
+	j := r.ToJSON()
+	if j["passed"] != false {
+		t.Errorf("expected passed=false")
+	}
+	summary, ok := j["summary"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("summary not a map")
+	}
+	if summary["total"] != 2 {
+		t.Errorf("expected total=2, got %v", summary["total"])
+	}
+	if summary["passed"] != 1 {
+		t.Errorf("expected passed=1")
+	}
+	if summary["failed"] != 1 {
+		t.Errorf("expected failed=1")
+	}
+}
+
+// TestParityCheckArtifactMap validates the artifact mapping mirrors Python.
+func TestParityCheckArtifactMap(t *testing.T) {
+	cases := map[string]string{
+		"lockfile-exists":        "apm.lock.yaml",
+		"dependency-allowlist":   "apm.yml",
+		"mcp-transport":          "apm.yml",
+		"ref-consistency":        "apm.lock.yaml",
+		"compilation-target":     "apm.yml",
+		"required-manifest-fields": "apm.yml",
+	}
+	for check, want := range cases {
+		got, ok := policy.CheckArtifactMap[check]
+		if !ok {
+			t.Errorf("check %s missing from artifact map", check)
+			continue
+		}
+		if got != want {
+			t.Errorf("check %s: want %s, got %s", check, want, got)
+		}
+	}
+}
+
+// TestParityDefaultDependencyPolicy mirrors Python DependencyPolicy defaults.
+func TestParityDefaultDependencyPolicy(t *testing.T) {
+	dp := policy.DefaultDependencyPolicy()
+	if dp.MaxDepth != 50 {
+		t.Errorf("expected MaxDepth=50, got %d", dp.MaxDepth)
+	}
+	if dp.RequireResolution != policy.RequireResolutionProjectWins {
+		t.Errorf("expected project-wins resolution")
+	}
+}
+
+// TestParityDependencyPolicyEffectiveDeny verifies nil -> empty semantics.
+func TestParityDependencyPolicyEffectiveDeny(t *testing.T) {
+	dp := policy.DependencyPolicy{Deny: nil}
+	if len(dp.EffectiveDeny()) != 0 {
+		t.Errorf("nil deny should return empty slice")
+	}
+	dp2 := policy.DependencyPolicy{Deny: []string{"bad-pkg"}}
+	if len(dp2.EffectiveDeny()) != 1 {
+		t.Errorf("expected 1 deny entry")
+	}
+}
+
+// TestParityDependencyPolicyEffectiveRequire mirrors Python require semantics.
+func TestParityDependencyPolicyEffectiveRequire(t *testing.T) {
+	dp := policy.DependencyPolicy{Require: nil}
+	if len(dp.EffectiveRequire()) != 0 {
+		t.Errorf("nil require should return empty slice")
+	}
+	dp2 := policy.DependencyPolicy{Require: []string{"required-pkg"}}
+	if len(dp2.EffectiveRequire()) != 1 {
+		t.Errorf("expected 1 require entry")
+	}
+}
+
+// TestParityDefaultPolicyCache verifies TTL default of 3600.
+func TestParityDefaultPolicyCache(t *testing.T) {
+	c := policy.DefaultPolicyCache()
+	if c.TTL != 3600 {
+		t.Errorf("expected TTL=3600, got %d", c.TTL)
+	}
+}
+
+// TestParityDefaultOutcomeRouting verifies block-by-default routing.
+func TestParityDefaultOutcomeRouting(t *testing.T) {
+	o := policy.DefaultOutcomeRouting()
+	if o.Default != policy.OutcomeBlock {
+		t.Errorf("expected default outcome=block")
+	}
+}
+
+// TestParityOutcomeRoutingActionFor verifies per-check routing overrides.
+func TestParityOutcomeRoutingActionFor(t *testing.T) {
+	o := policy.OutcomeRouting{
+		Default: policy.OutcomeBlock,
+		Checks: map[string]policy.OutcomeAction{
+			"lockfile-exists": policy.OutcomeWarn,
+		},
+	}
+	if o.ActionFor("lockfile-exists") != policy.OutcomeWarn {
+		t.Errorf("expected warn for lockfile-exists")
+	}
+	if o.ActionFor("ref-consistency") != policy.OutcomeBlock {
+		t.Errorf("expected block for unknown check")
+	}
+}
+
+// TestParityDefaultPolicyDocument verifies all defaults are set.
+func TestParityDefaultPolicyDocument(t *testing.T) {
+	doc := policy.DefaultPolicyDocument()
+	if doc.Cache.TTL != 3600 {
+		t.Errorf("expected cache TTL=3600")
+	}
+	if doc.Dependencies.MaxDepth != 50 {
+		t.Errorf("expected deps MaxDepth=50")
+	}
+	if doc.Outcomes.Default != policy.OutcomeBlock {
+		t.Errorf("expected outcomes default=block")
+	}
+}
+
+// TestParityMatcherMatchesAny verifies glob matching behavior.
+func TestParityMatcherMatchesAny(t *testing.T) {
+	cases := []struct {
+		candidate string
+		patterns  []string
+		want      bool
+	}{
+		{"pkg-a", []string{"pkg-*"}, true},
+		{"pkg-a", []string{"other-*"}, false},
+		{"pkg-a", []string{"pkg-b", "pkg-a"}, true},
+		{"pkg-a", []string{}, false},
+		{"anything", []string{"*"}, true},
+	}
+	for _, tc := range cases {
+		got := policy.MatchesAny(tc.candidate, tc.patterns)
+		if got != tc.want {
+			t.Errorf("MatchesAny(%q, %v) = %v, want %v", tc.candidate, tc.patterns, got, tc.want)
+		}
+	}
+}
+
+// TestParityMatcherAllowList verifies nil = allow-all semantics.
+func TestParityMatcherAllowList(t *testing.T) {
+	if !policy.MatchesAllowList("anything", nil) {
+		t.Errorf("nil allowlist should permit everything")
+	}
+	if policy.MatchesAllowList("pkg-a", []string{}) {
+		t.Errorf("empty allowlist should permit nothing")
+	}
+	if !policy.MatchesAllowList("pkg-a", []string{"pkg-*"}) {
+		t.Errorf("pkg-a should match pkg-*")
+	}
+}
+
+// TestParityMatcherDenyList verifies nil = deny-nothing semantics.
+func TestParityMatcherDenyList(t *testing.T) {
+	if policy.MatchesDenyList("pkg-a", nil) {
+		t.Errorf("nil denylist should deny nothing")
+	}
+	if policy.MatchesDenyList("pkg-a", []string{}) {
+		t.Errorf("empty denylist should deny nothing")
+	}
+	if !policy.MatchesDenyList("bad-pkg", []string{"bad-*"}) {
+		t.Errorf("bad-pkg should match bad-*")
+	}
+}