From 7776004977792b293c999918a08a6ded681767af Mon Sep 17 00:00:00 2001 From: hector <42570491+majinghe@users.noreply.github.com> Date: Sun, 13 Sep 2026 08:50:32 +0800 Subject: [PATCH] ci: tolerate ANSI reset escapes in security verdicts; fix tier product counts (#7712) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The overnight run after #7708 proved the security verdict greps still counted zero: real verdict lines are '\e[1;31m[FAIL]\e[0m STS-105 ...' — the reset escape sits between the tag and the case id, and the pattern only tolerated escapes before the tag. Allow escapes on both sides; the fixture now emits the reset too, mirroring the real suite. The tier case table is produced by rustfs_tier_report.py and its rows lead with the topology column, so the case-ID-first table grep matched nothing ('Product result: 0 passed, 0 failed'). Parse the PASS/FAIL counts from the '## Case Summary' bullets the report always emits, falling back to a topology-aware table grep. --- .github/workflows/rustfs-security-test.yml | 13 +++++++------ .github/workflows/rustfs-tier-test.yml | 18 ++++++++++++++---- scripts/test_security_workflow.py | 8 +++++--- 3 files changed, 26 insertions(+), 13 deletions(-) diff --git a/.github/workflows/rustfs-security-test.yml b/.github/workflows/rustfs-security-test.yml index 5079afde2..2924ce0e6 100644 --- a/.github/workflows/rustfs-security-test.yml +++ b/.github/workflows/rustfs-security-test.yml @@ -190,15 +190,16 @@ jobs: # Product gate: failing cases keep the run green — they are reported # below and tracked in rustfs/backlog. Only harness/environment - # breakdowns turn the workflow red. The suite log lines may carry - # ANSI color escapes in front of the verdict tag, so the pattern - # allows any number of them before the leading '['. + # breakdowns turn the workflow red. The suite log lines carry ANSI + # color escapes both before and after the verdict tag + # (e.g. "\e[1;31m[FAIL]\e[0m STS-105 ..."), so the pattern allows + # any number of escapes on each side of it. ESC=$'\033' - VERDICTS_TOTAL="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[(PASS|FAIL|UNSUPPORTED)\] [A-Z]" "${LOG_FILE}" 2>/dev/null || true)" - VERDICTS_FAIL="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[FAIL\] [A-Z]" "${LOG_FILE}" 2>/dev/null || true)" + VERDICTS_TOTAL="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[(PASS|FAIL|UNSUPPORTED)\](${ESC}\[[0-9;]*m)* [A-Z]" "${LOG_FILE}" 2>/dev/null || true)" + VERDICTS_FAIL="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[FAIL\](${ESC}\[[0-9;]*m)* [A-Z]" "${LOG_FILE}" 2>/dev/null || true)" VERDICTS_TOTAL=$(( ${VERDICTS_TOTAL:-0} + 0 )); VERDICTS_FAIL=$(( ${VERDICTS_FAIL:-0} + 0 )) VERDICTS_PASS=$(( VERDICTS_TOTAL - VERDICTS_FAIL )) - VERDICTS_SKIPPED="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[SKIP\] [A-Z]" "${LOG_FILE}" 2>/dev/null || true)" + VERDICTS_SKIPPED="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[SKIP\](${ESC}\[[0-9;]*m)* [A-Z]" "${LOG_FILE}" 2>/dev/null || true)" VERDICTS_SKIPPED=$(( ${VERDICTS_SKIPPED:-0} + 0 )) HARNESS_OK=0 if [ "${TEST_OUTCOME}" = "success" ]; then diff --git a/.github/workflows/rustfs-tier-test.yml b/.github/workflows/rustfs-tier-test.yml index 481374571..edf5c2d88 100644 --- a/.github/workflows/rustfs-tier-test.yml +++ b/.github/workflows/rustfs-tier-test.yml @@ -344,10 +344,20 @@ jobs: echo "Structured report generation failed before producing output (exit ${CASE_GATE_RC})." } > "${CASE_TABLE}" fi - CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)" - CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)" - CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 )) - CASES_PASS=$(( CASES_TOTAL - CASES_FAIL )) + # The tier case table carries a "## Case Summary" bullet list + # (Total/PASS/FAIL/...); parse the counts from there. Fall back to + # the case-ID table rows if the bullets are absent. + CASES_FAIL="$(grep -m1 -E '^- FAIL: [0-9]+' "${CASE_TABLE}" 2>/dev/null | grep -oE '[0-9]+' || true)" + if [ -n "${CASES_FAIL}" ]; then + CASES_PASS="$(grep -m1 -E '^- PASS: [0-9]+' "${CASE_TABLE}" 2>/dev/null | grep -oE '[0-9]+' || true)" + CASES_PASS=$(( ${CASES_PASS:-0} + 0 )) + else + CASES_TOTAL="$(grep -cE '^\| [A-Za-z0-9_.-]+ \| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)" + CASES_FAIL="$(grep -cE '^\| [A-Za-z0-9_.-]+ \| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)" + CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 )) + CASES_PASS=$(( CASES_TOTAL - CASES_FAIL )) + fi + CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 )) { echo "# RustFS tier test report" echo "" diff --git a/scripts/test_security_workflow.py b/scripts/test_security_workflow.py index 8b33c7138..639fe3e5d 100644 --- a/scripts/test_security_workflow.py +++ b/scripts/test_security_workflow.py @@ -117,14 +117,16 @@ class SecurityWorkflowTests(WorkflowSteps, unittest.TestCase): self.artifacts = self.directory / "rustfs-security-314159-2" suite = self.directory / "auto-testing/rustfs-security-test.sh" suite.parent.mkdir() - ansi = {"ANSI_GREEN": "\033[1;32m", "ANSI_RED": "\033[1;31m", "ANSI_YELLOW": "\033[1;33m"} + ansi = {"ANSI_GREEN": "\033[1;32m", "ANSI_RED": "\033[1;31m", "ANSI_YELLOW": "\033[1;33m", "ANSI_RESET": "\033[0m"} suite.write_text( '#!/usr/bin/env bash\nset -euo pipefail\n' 'log_dir=$(mktemp -d "$TMPDIR/rustfs-security.XXXXXX")\n' # Verdict lines carry ANSI color escapes and are printed to stdout # (captured via tee into the artifacts suite.log), exactly like the - # real suite output the report step has to grep through. - 'printf "%s\\n" "${ANSI_GREEN}[PASS] IAM-101 ok" "${ANSI_RED}[FAIL] STS-105 broken" "${ANSI_YELLOW}[SKIP] OIDC-103 skipped" | tee "$log_dir/suite.log"\n' + # real suite output the report step has to grep through: a color + # tag before the verdict and a reset escape between the tag and + # the case id. + 'printf "%s\\n" "${ANSI_GREEN}[PASS]${ANSI_RESET} IAM-101 ok" "${ANSI_RED}[FAIL]${ANSI_RESET} STS-105 broken" "${ANSI_YELLOW}[SKIP]${ANSI_RESET} OIDC-103 skipped" | tee "$log_dir/suite.log"\n' 'echo "CURRENT SUITE LOG" >> "$log_dir/suite.log"\n' 'echo "CURRENT SUITE STDOUT"; echo "CURRENT SUITE STDERR" >&2\n' 'case "$FAKE_REPORT" in\n'