fix(ci): 供应真实原生工具链并修正 C Terraform Elm 验收

Author: loong10k

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
           cargo +1.85.0 check --locked --workspace --all-targets --features wasm-precheck
   gate:
     # ubuntu-latest 预装稳定版 Rust；Cargo.toml 声明 rust-version = 1.85 / edition = 2024。
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       # Linux 完整 DWARF 测试制品会超出 SDK 的 256 MiB 宿主制品读取预算。
       # 仅去掉测试调试符号；保留 debug assertions 和产品读取上限。
@@ -52,6 +52,10 @@ jobs:
       - name: Verify crate layering debt does not grow
         run: python3 scripts/check_layering.py
 
+      - name: Provision real acceptance toolchains
+        # 仅安装到临时 CI runner；缺工具不能冒充负例检出或通过。
+        run: bash scripts/setup_ci_native_toolchains.sh
+
       - name: Build workspace
         run: cargo build --workspace --all-targets
 

crates/codeguard-cli/tests/c_six_category_acceptance.rs

@@ -1,7 +1,7 @@
 use std::process::Command;
 
 fn ensure_clean_dir(name: &str) -> std::path::PathBuf {
-    let tmp = std::env::temp_dir().join(name);
+    let tmp = std::env::temp_dir().join(format!("{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&tmp);
     std::fs::create_dir_all(&tmp).unwrap();
     tmp
@@ -12,8 +12,18 @@ fn valid_c_samples_pass_compile() {
     let tmp = ensure_clean_dir("c-valid-test");
     std::fs::write(tmp.join("main.c"), "#include <stdio.h>\n\n/** Adds two integers. */\nint add(int a, int b) {\n    return a + b;\n}\n\nint main(void) {\n    printf(\"%d\\n\", add(1, 2));\n    return 0;\n}\n").unwrap();
 
+    // C11 不允许隐式函数声明；统一正负例标准，避免旧 GCC 仅警告后返回成功。
     let output = Command::new("cc")
-        .args(["-Wall", "-Wextra", "-c", "main.c", "-o", "main.o"])
+        .args([
+            "-std=c11",
+            "-Wall",
+            "-Wextra",
+            "-Werror=implicit-function-declaration",
+            "-c",
+            "main.c",
+            "-o",
+            "main.o",
+        ])
         .current_dir(&tmp)
         .output()
         .expect("cc 不可用");
@@ -35,8 +45,18 @@ fn invalid_c_samples_are_detected() {
     )
     .unwrap();
 
+    // C11 不允许隐式函数声明；统一正负例标准，避免旧 GCC 仅警告后返回成功。
     let output = Command::new("cc")
-        .args(["-Wall", "-Wextra", "-c", "main.c", "-o", "main.o"])
+        .args([
+            "-std=c11",
+            "-Wall",
+            "-Wextra",
+            "-Werror=implicit-function-declaration",
+            "-c",
+            "main.c",
+            "-o",
+            "main.o",
+        ])
         .current_dir(&tmp)
         .output()
         .expect("cc 不可用");
@@ -57,8 +77,18 @@ fn formatting_cannot_impersonate_comment_checking() {
     // 格式正确但缺少文档——编译器不检查文档
     std::fs::write(tmp.join("main.c"), "#include <stdio.h>\n\nint undocumented(int a) {\n    return a * 2;\n}\n\n/** Has docs. */\nint documented(int a) {\n    return a + 1;\n}\n\nint main(void) {\n    printf(\"%d\\n\", undocumented(5) + documented(3));\n    return 0;\n}\n").unwrap();
 
+    // C11 不允许隐式函数声明；统一正负例标准，避免旧 GCC 仅警告后返回成功。
     let output = Command::new("cc")
-        .args(["-Wall", "-Wextra", "-c", "main.c", "-o", "main.o"])
+        .args([
+            "-std=c11",
+            "-Wall",
+            "-Wextra",
+            "-Werror=implicit-function-declaration",
+            "-c",
+            "main.c",
+            "-o",
+            "main.o",
+        ])
         .current_dir(&tmp)
         .output()
         .expect("cc 不可用");

crates/codeguard-cli/tests/elm_six_category_acceptance.rs

@@ -7,6 +7,21 @@ fn ensure_clean_dir(name: &str) -> std::path::PathBuf {
     let tmp = std::env::temp_dir().join(name);
     let _ = std::fs::remove_dir_all(&tmp);
     std::fs::create_dir_all(&tmp).unwrap();
+    // 固定实际使用的源码目录与依赖，避免交互初始化失败后用环境错误冒充负例。
+    std::fs::write(
+        tmp.join("elm.json"),
+        r#"{
+    "type": "application",
+    "source-directories": ["."],
+    "elm-version": "0.19.1",
+    "dependencies": {
+        "direct": {"elm/core": "1.0.5", "elm/html": "1.0.0"},
+        "indirect": {"elm/json": "1.1.3", "elm/virtual-dom": "1.0.3"}
+    },
+    "test-dependencies": {"direct": {}, "indirect": {}}
+}"#,
+    )
+    .unwrap();
     tmp
 }
 
@@ -17,19 +32,17 @@ fn valid_elm_samples_pass_parse() {
     // 使用 elm make 直接编译单文件
     std::fs::write(tmp.join("Main.elm"), "module Main exposing (main)\n\nimport Html exposing (text)\n\n-- Adds two numbers.\nadd : Int -> Int -> Int\nadd a b =\n    a + b\n\nmain =\n    text (String.fromInt (add 1 2))\n").unwrap();
 
-    // 初始化 elm 项目
-    let _ = Command::new("sh")
-        .args(["-c", "echo 'Y' | elm init"])
-        .current_dir(&tmp)
-        .output();
-
     let output = Command::new("elm")
         .args(["make", "Main.elm", "--output=/dev/null"])
         .current_dir(&tmp)
         .output()
         .expect("elm 不可用");
 
-    assert!(output.status.success(), "有效 Elm 代码应通过编译: {:?}", output);
+    assert!(
+        output.status.success(),
+        "有效 Elm 代码应通过编译: {:?}",
+        output
+    );
     std::fs::remove_dir_all(&tmp).unwrap();
 }
 
@@ -39,18 +52,18 @@ fn invalid_elm_samples_are_detected() {
     let tmp = ensure_clean_dir("elm-invalid-test");
     std::fs::write(tmp.join("Main.elm"), "module Main exposing (main)\n\nimport Html exposing (text)\n\nbroken : Int -> Int -> Int\nbroken a b =\n    a + b + notDefinedAnywhere\n\nmain =\n    text (String.fromInt (broken 1 2))\n").unwrap();
 
-    let _ = Command::new("sh")
-        .args(["-c", "echo 'Y' | elm init"])
-        .current_dir(&tmp)
-        .output();
-
     let output = Command::new("elm")
-        .args(["make", "Main.elm", "--output=/dev/null"])
+        .args(["make", "Main.elm", "--output=/dev/null", "--report=json"])
         .current_dir(&tmp)
         .output()
         .expect("elm 不可用");
 
     assert!(!output.status.success(), "未定义变量应被检出");
+    let diagnostic = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        diagnostic.contains("NAMING ERROR") && diagnostic.contains("notDefinedAnywhere"),
+        "必须实际检出目标未定义变量，依赖或初始化失败不能作为负例证据: {diagnostic}"
+    );
     std::fs::remove_dir_all(&tmp).unwrap();
 }
 
@@ -61,17 +74,16 @@ fn formatting_cannot_impersonate_comment_checking() {
     // 格式正确但缺少注释
     std::fs::write(tmp.join("Main.elm"), "module Main exposing (main)\n\nimport Html exposing (text)\n\nundocumented : Int -> Int\nundocumented a =\n    a * 2\n\n-- Has docs.\ndocumented : Int -> Int\ndocumented a =\n    a + 1\n\nmain =\n    text (String.fromInt (undocumented 5 + documented 3))\n").unwrap();
 
-    let _ = Command::new("sh")
-        .args(["-c", "echo 'Y' | elm init"])
-        .current_dir(&tmp)
-        .output();
-
     let output = Command::new("elm")
         .args(["make", "Main.elm", "--output=/dev/null"])
         .current_dir(&tmp)
         .output()
         .expect("elm 不可用");
 
-    assert!(output.status.success(), "Elm 应通过（语法正确），但注释合规需另查: {:?}", output);
+    assert!(
+        output.status.success(),
+        "Elm 应通过（语法正确），但注释合规需另查: {:?}",
+        output
+    );
     std::fs::remove_dir_all(&tmp).unwrap();
 }

crates/codeguard-cli/tests/terraform_six_category_acceptance.rs

@@ -1,10 +1,13 @@
-//! Terraform 六类别真实工具验收
-//! 验收标准：正例通过 + 负例检出 + 格式≠注释合规
+//! Terraform 真实工具语法验收：使用内置 terraform_data，不下载外部 provider。
+//! 正例、错误配置、修复复验和缺少注释样本均实际调用原生 Terraform。
 
-use std::process::Command;
+use std::{
+    path::Path,
+    process::{Command, Output},
+};
 
 fn ensure_clean_dir(name: &str) -> std::path::PathBuf {
-    let tmp = std::env::temp_dir().join(name);
+    let tmp = std::env::temp_dir().join(format!("{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&tmp);
     std::fs::create_dir_all(&tmp).unwrap();
     tmp
@@ -14,69 +17,77 @@ fn terraform_bin() -> String {
     std::env::var("CODEGUARD_TERRAFORM_BIN").unwrap_or_else(|_| "terraform".to_string())
 }
 
-/// 正例通过
-#[test]
-fn valid_terraform_samples_pass_validate() {
-    let tmp = ensure_clean_dir("terraform-valid-test");
-    std::fs::write(tmp.join("main.tf"), "# Adds a resource.\nresource \"null_resource\" \"example\" {\n  triggers = {\n    value = \"test\"\n  }\n}\n").unwrap();
-
-    let output = Command::new(terraform_bin())
-        .args(["init", "-backend=false"])
-        .current_dir(&tmp)
+fn run(tmp: &Path, args: &[&str]) -> Output {
+    Command::new(terraform_bin())
+        .args(args)
+        .env("TF_IN_AUTOMATION", "1")
+        .env("CHECKPOINT_DISABLE", "1")
+        .current_dir(tmp)
         .output()
-        .expect("terraform 不可用");
+        .expect("terraform 不可用")
+}
 
-    let output2 = Command::new(terraform_bin())
-        .args(["validate"])
-        .current_dir(&tmp)
-        .output()
-        .expect("terraform 不可用");
+fn initialize(tmp: &Path) {
+    let output = run(
+        tmp,
+        &["init", "-backend=false", "-input=false", "-no-color"],
+    );
+    assert!(
+        output.status.success(),
+        "Terraform 初始化必须成功，不能把工具缺失当作负例检出: {output:?}"
+    );
+}
+
+const VALID: &str = "# Stores an example value.\nresource \"terraform_data\" \"example\" {\n  input = \"test\"\n}\n";
 
-    assert!(output2.status.success(), "有效 Terraform 代码应通过验证: {:?}", output2);
-    std::fs::remove_dir_all(&tmp).unwrap();
+#[test]
+fn valid_terraform_samples_pass_validate() {
+    let tmp = ensure_clean_dir("terraform-valid-test");
+    std::fs::write(tmp.join("main.tf"), VALID).unwrap();
+    initialize(&tmp);
+    let output = run(&tmp, &["validate", "-no-color"]);
+    assert!(
+        output.status.success(),
+        "有效 Terraform 代码应通过验证: {output:?}"
+    );
+    std::fs::remove_dir_all(tmp).unwrap();
 }
 
-/// 负例检出
 #[test]
 fn invalid_terraform_samples_are_detected() {
     let tmp = ensure_clean_dir("terraform-invalid-test");
-    std::fs::write(tmp.join("main.tf"), "resource \"null_resource\" \"example\" {\n  triggers = {\n    value = \"test\"\n  }\n").unwrap();
-
-    let output = Command::new(terraform_bin())
-        .args(["init", "-backend=false"])
-        .current_dir(&tmp)
-        .output()
-        .expect("terraform 不可用");
-
-    let output2 = Command::new(terraform_bin())
-        .args(["validate"])
-        .current_dir(&tmp)
-        .output()
-        .expect("terraform 不可用");
-
-    assert!(!output2.status.success(), "语法错误应被检出");
-    std::fs::remove_dir_all(&tmp).unwrap();
+    let file = tmp.join("main.tf");
+    std::fs::write(&file, VALID).unwrap();
+    initialize(&tmp);
+    // 保持有效 HCL，由内置 provider 的真实 schema 拒绝未知属性。
+    std::fs::write(
+        &file,
+        "resource \"terraform_data\" \"example\" {\n  unsupported = true\n}\n",
+    )
+    .unwrap();
+    let output = run(&tmp, &["validate", "-no-color"]);
+    assert!(!output.status.success(), "错误配置应被检出");
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("Unsupported argument"),
+        "失败必须来自目标配置错误: {output:?}"
+    );
+    // 同一个初始化目录中修复并复验，排除缺工具/缺 provider 造成的假阴性。
+    std::fs::write(&file, VALID).unwrap();
+    let repaired = run(&tmp, &["validate", "-no-color"]);
+    assert!(repaired.status.success(), "修复后应重新通过: {repaired:?}");
+    std::fs::remove_dir_all(tmp).unwrap();
 }
 
-/// 格式≠注释合规
 #[test]
 fn formatting_cannot_impersonate_comment_checking() {
     let tmp = ensure_clean_dir("terraform-comment-test");
-    // 格式正确但缺少注释
-    std::fs::write(tmp.join("main.tf"), "resource \"null_resource\" \"undocumented\" {\n  triggers = {\n    value = \"test\"\n  }\n}\n\n# Has docs.\nresource \"null_resource\" \"documented\" {\n  triggers = {\n    value = \"test\"\n  }\n}\n").unwrap();
-
-    let output = Command::new(terraform_bin())
-        .args(["init", "-backend=false"])
-        .current_dir(&tmp)
-        .output()
-        .expect("terraform 不可用");
-
-    let output2 = Command::new(terraform_bin())
-        .args(["validate"])
-        .current_dir(&tmp)
-        .output()
-        .expect("terraform 不可用");
-
-    assert!(output2.status.success(), "Terraform 应通过（语法正确），但注释合规需另查: {:?}", output2);
-    std::fs::remove_dir_all(&tmp).unwrap();
+    std::fs::write(tmp.join("main.tf"), "resource \"terraform_data\" \"undocumented\" {\n  input = \"test\"\n}\n\n# Has docs.\nresource \"terraform_data\" \"documented\" {\n  input = \"test\"\n}\n").unwrap();
+    initialize(&tmp);
+    let output = run(&tmp, &["validate", "-no-color"]);
+    assert!(
+        output.status.success(),
+        "Terraform 应通过语法验证，但注释合规需另查: {output:?}"
+    );
+    std::fs::remove_dir_all(tmp).unwrap();
 }