cmux-next gate: never run the pushed perf cron tests in the pre-push hook

Merged
LA
3d ago
+36-31

Summary

The pre-push hook must never run code that the push controls (docs/contributor-verification.md, trust boundary). The cmux-next gate's perf_cron_tests broke this rule. For a push that changes the perf cron, it ran the pushed head's own test_perf_cron.py (git archive of the head, then unittest). So a pushed branch's test file, or the perf-cron.py that the tests import, ran on the machine that pushed it. Running the reviewed copy of the tests would not fix this, because the copy still imports the pushed perf-cron.py.

Now the gate only names the changed perf cron files and prints the command to run their tests on code the person trusts. It never runs that code, and it does not refuse the push. CI does not run these tests either (no new CI tests), which was also true before this gate step was added in 9d483d2fd90.

An independent review of #34169 found this.

Testing

Red on 18753d8f596 (the test is in its own commit, 6d8a01f8f8d), green on the head:

(cd tests && python3 -m unittest -k perf_cron_never test_cmux_next_prepush_gate)
  • On the base, a push that changes the perf cron runs a pushed test_perf_cron.py that writes a marker file.
  • On the head, the marker is never written, and the push output names the perf cron and the command to run its tests.

Observed / Not run

Observed:

  • python3 tests/test_cmux_next_prepush_gate.py: 88 tests OK.
  • python3 scripts/cmux-next/prepush-gate.py: no new violations.

Not run:

  • A real push through an installed hook on a Mac.

Changelog

none

Proof

No capture: hook tooling only.

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Stops the cmux-next pre-push hook from running code that the push controls, closing a trust-boundary violation where a pushed branch's own test_perf_cron.py (or the perf-cron.py it imports) ran on the machine that pushed it.

  • The perf-cron gate previously extracted the pushed head's test files with git archive and ran them via unittest, so a contributor's branch could execute arbitrary code in the hook.
  • The gate now only names the changed perf cron files and prints the command to run their unit tests on code the person trusts; it never runs that code and does not refuse the push.
  • CI does not run these tests either, which was also the case before the gate step was added.