mirror of
https://github.com/larksuite/cli.git
synced 2026-08-03 08:32:46 +08:00
ae56d30ce3
The layering graph was built from Imports and Deps only. `go list` keeps a package's test dependencies in two other fields — TestImports for the in-package test files, XTestImports for the external test package — and listedPackage did not declare either, so every denied dependency reached through a _test.go file went unreported. Ten packages were already through the gap: shortcuts/mail's tests import internal/auth, internal/vfs and internal/vfs/localfileio, and the rule that denies exactly those to shortcuts stayed green. TestLayeringBuildConfigsSelectEveryFile made it worse than a plain omission. It counts TestGoFiles and XTestGoFiles as selected, on the stated ground that "an import edge only reaches the rules through a selected file" — so the check that exists to prove nothing is unscanned was vouching for files the rules never read. TestPackageLayering now walks a second graph, testDependencyView, built from those two lists: direct imports for a Direct rule, and for a Transitive one the closure through each test import's production deps. A package's own import path is dropped, because `package foo_test` always imports foo and errs-leaf denies this module wholesale — counting that would fail the leaf on the test that tests it. The two graphs need different answers, so Rule gains TestExempt. A shortcut's test builds the runtime the shortcut is handed at run time, which means naming the credential, auth and filesystem packages that runtime is assembled from; denying those in tests moves no production import and would only park ten packages in the exception registry for writing ordinary tests. keychain and client stay denied in tests too: a test needs neither to construct a RuntimeContext, and reaching for them means it is talking to the real keyring or issuing real requests. Direction stays denied everywhere — a test may reach down for scaffolding, never up. That last part left one real violation, and it was an inversion rather than scaffolding: internal/output's frozen-oracle test imported shortcuts/common to run the same fixtures through RuntimeContext.Out*. The Emitter half stays where the fixtures are; the wiring half moves to the layer that owns those methods, as shortcuts/common/runner_emitter_wiring_test.go — each Out* has to hand the Emitter the option its name promises, which the bytes show (Raw decides whether `<p>a&b</p>` survives). It also covers OutFormatRaw, which the oracle was the only test to reach. Statement coverage is unchanged in both packages, 83.5% and 72.6%. Verified by probe, both buckets: an XTest-only and an in-package-test-only import of a denied package under shortcuts/mail each fail the gate now, reported with in=test files, and passed it before this change.