From 3d0a388511c577395d9481263158539150a07c01 Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Thu, 23 Jul 2026 07:13:32 +0000 Subject: [PATCH] Fail the ping test on an unknown topology profile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every section of ping-test.sh is guarded by the profile name, so an unrecognised profile fell through all of them and the script exited 0 having run no assertion. A typo in the caller's argument produced a green run that tested nothing. Give it an else branch that names the valid profiles and exits 2. No existing leg changes behaviour: the hosted runner gates the ping step on matrix.type == 'static', which only static-mesh and static-chain carry, and ci-local passes only the two names in STATIC_SUITES. Worth noting while confirming that, though: ping-test.sh accepts a mesh-public profile that neither runner ever passes. Also record why the convergence waits are `|| true` — they are settling delays rather than assertions, and the directed-pair pings are what decides the run — and add admission-cap to the suite list in the ci-local header, which ran it without listing it. --- testing/ci-local.sh | 4 ++-- testing/static/scripts/ping-test.sh | 17 +++++++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/testing/ci-local.sh b/testing/ci-local.sh index cee312c..083b783 100755 --- a/testing/ci-local.sh +++ b/testing/ci-local.sh @@ -28,8 +28,8 @@ # Integration suites (default coverage): # static-mesh, static-chain, rekey, rekey-accept-off, # rekey-outbound-only, gateway, -# acl-allowlist, firewall, nat-cone, nat-symmetric, nat-lan, -# nostr-publish-consume, stun-faults, +# acl-allowlist, admission-cap, firewall, nat-cone, nat-symmetric, +# nat-lan, nostr-publish-consume, stun-faults, # chaos-smoke-10, chaos-churn-mixed-10, chaos-ethernet-mesh, # chaos-ethernet-only, chaos-tcp-mesh, chaos-bottleneck-parent, # chaos-cost-avoidance, chaos-cost-reeval, chaos-cost-stability, diff --git a/testing/static/scripts/ping-test.sh b/testing/static/scripts/ping-test.sh index 1411223..fb6069c 100755 --- a/testing/static/scripts/ping-test.sh +++ b/testing/static/scripts/ping-test.sh @@ -75,6 +75,16 @@ echo "=== FIPS Ping Test ($PROFILE topology) ===" echo "" # Wait for nodes to converge — all nodes must reach expected peer counts. +# +# Every wait below is `|| true` on purpose, for the same reason the +# wait_until_connected call further down is: these are settling delays, not +# assertions. A node that has not reached its configured peer count by the +# deadline may still be reachable, and the directed-pair pings are what +# actually decide the run. Letting a wait fail the script here would turn a +# slow convergence into a failure the pings would have passed. +# +# The converse is what makes it safe: because these cannot fail, they also +# cannot pass, so nothing about the run's verdict rests on them. echo "Waiting for mesh convergence..." if [ "$PROFILE" = "chain" ]; then # Chain: A-B-C-D-E, each interior node has 2 peers, endpoints have 1 @@ -90,6 +100,13 @@ elif [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then wait_for_peers fips-node-c${FIPS_CI_NAME_SUFFIX:-} 3 20 || true wait_for_peers fips-node-d${FIPS_CI_NAME_SUFFIX:-} 3 20 || true wait_for_peers fips-node-e${FIPS_CI_NAME_SUFFIX:-} 3 20 || true +else + # An unrecognised profile used to fall straight through, and every + # section below is guarded by these same profile names, so the script + # ran no assertion at all and exited 0. A typo in the caller's profile + # argument produced a green run that tested nothing. + echo "ERROR: unknown profile '$PROFILE' (expected: chain, mesh, mesh-public)" >&2 + exit 2 fi # Wait for full pairwise connectivity, progress-aware: the actual pings # are the convergence signal, the deadline extends while more pairs come