diff --git a/.bestpractices.json b/.bestpractices.json index 8fa3b0e4..0fa34914 100644 --- a/.bestpractices.json +++ b/.bestpractices.json @@ -128,7 +128,7 @@ "test_invocation_justification": "Headless tests run via `pwsh -NoProfile -File ./Test-SnipIT.ps1`. CI invocation lives in .github/workflows/test.yml (`test` job, Linux + Windows matrix). Documented in README.md §Building from source and in CONTRIBUTING.md.", "test_most_status": "Met", - "test_most_justification": "126 tests across two suites cover the production surface breadth-completely: (1) Test-SnipIT.ps1 — 84 headless unit tests over the 10 pure functions exported by the Core region (Get-DragRectangle, Test-IsClickVsDrag, Get-LoupeSourceRect, Get-LoupePosition, Get-DefaultSnipFilename, Get-ImageFormatNameFromPath, Test-CaptureRectValid, Get-CropBounds, Get-InstallPaths, Get-ShortcutArguments) — every code branch in each function exercised, including edge cases (negative-origin multi-monitor, DPI-aware crop bounds, MinSize boundary, dot-prefixed hidden filenames, uppercase extensions). (2) Test-SnipIT-Interactive.ps1 — 42 WPF integration tests over the preview-window's named closures (pan, zoom 5%–1000%, drawing tools highlight/rect/arrow/text, six-color palette, undo/redo, hit-test topmost-wins, full HandleMouseDown dispatch, text-tool live-color editing, flattening). Line-coverage percentage is not measured today (no Coveralls/Codecov integration); coverage is judged by branch+behaviour breadth per the testing policy in CONTRIBUTING.md.", + "test_most_justification": "576 tests across two suites cover the production surface breadth-completely: (1) Test-SnipIT.ps1 — 337 headless unit tests over the 65 pure functions exported by src/00-Core.ps1 (Get-DragRectangle, Test-IsClickVsDrag, Get-LoupeSourceRect, Get-LoupePosition, Get-DefaultSnipFilename, Get-ImageFormatNameFromPath, Test-CaptureRectValid, Get-CropBounds, Get-InstallPaths, Get-ShortcutArguments, the annotation model and hit-testing helpers, the capture-coordinator state machine, and the theme/palette and hotkey helpers among them) — every code branch in each function exercised, including edge cases (negative-origin multi-monitor, DPI-aware crop bounds, MinSize boundary, dot-prefixed hidden filenames, uppercase extensions). (2) Test-SnipIT-Interactive.ps1 — 239 WPF integration tests over the preview-window's named closures (pan, zoom 5%–1000%, drawing tools highlight/rect/arrow/text, six-color palette, undo/redo, hit-test topmost-wins, full HandleMouseDown dispatch, text-tool live-color editing, flattening). Line-coverage percentage is not measured today (no Coveralls/Codecov integration); coverage is judged by branch+behaviour breadth per the testing policy in CONTRIBUTING.md.", "test_most_url": "https://github.com/RandomCodeSpace/snipIT/blob/main/Test-SnipIT.ps1", "test_continuous_integration_status": "Met", @@ -212,7 +212,7 @@ "static_analysis_often_status": "Met", "static_analysis_often_justification": "Static analysis runs on every push to main and every pull request via .github/workflows/security.yml — fail-fast off so all signals (Semgrep, PSScriptAnalyzer, Trivy, Gitleaks, jscpd, SBOM) surface on a single run. No commit reaches main without a clean pass.", - "dynamic_analysis_justification": "Test-SnipIT-Interactive.ps1 (42 tests) is the project's dynamic-analysis tool: it dot-sources SnipIT.ps1 in test-mode, builds a synthetic bitmap, launches Show-PreviewWindow on the real WPF dispatcher (in-process, off-screen, hidden window) via the -TestKit/-TestAction hook, and drives every named closure (pan, zoom, drawing, color picker, undo/redo, hit-test, full HandleMouseDown dispatch, text-tool live editing) against actual WPF event surfaces and real System.Drawing.Bitmap state. This is dynamic analysis — it executes the production code under realistic state transitions, not a static lint or scan (those are separate, in .github/workflows/security.yml). Network-fuzzing is not in scope: snipIT has no untrusted-network input surface (input is screen-bitmap / clipboard / user file-save dialog).", + "dynamic_analysis_justification": "Test-SnipIT-Interactive.ps1 (239 tests) is the project's dynamic-analysis tool: it dot-sources SnipIT.ps1 in test-mode, builds a synthetic bitmap, launches Show-PreviewWindow on the real WPF dispatcher (in-process, off-screen, hidden window) via the -TestKit/-TestAction hook, and drives every named closure (pan, zoom, drawing, color picker, undo/redo, hit-test, full HandleMouseDown dispatch, text-tool live editing) against actual WPF event surfaces and real System.Drawing.Bitmap state. This is dynamic analysis — it executes the production code under realistic state transitions, not a static lint or scan (those are separate, in .github/workflows/security.yml). Network-fuzzing is not in scope: snipIT has no untrusted-network input surface (input is screen-bitmap / clipboard / user file-save dialog).", "dynamic_analysis_status": "Met", "dynamic_analysis_url": "https://github.com/RandomCodeSpace/snipIT/blob/main/Test-SnipIT-Interactive.ps1", diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a66a3898..bd43ad13 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -22,7 +22,7 @@ CI gates every PR on the following — please run them locally before requesting | Gate | Local command | Where it lives | |---|---|---| -| Headless tests | `pwsh -NoProfile -File ./Test-SnipIT.ps1` (84/84 must pass) | `.github/workflows/test.yml` | +| Headless tests | `pwsh -NoProfile -File ./Test-SnipIT.ps1` (the full pure-logic suite must pass) | `.github/workflows/test.yml` | | Windows AST parse | `pwsh -NoProfile -Command "[System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path ./SnipIT.ps1), [ref]\$null, [ref]\$errors)"` | `.github/workflows/test.yml` | | **PSScriptAnalyzer** (PowerShell lint) | `pwsh -c "Invoke-ScriptAnalyzer -Path ./SnipIT.ps1 -Severity Error"` (0 errors) | `.github/workflows/security.yml` | | Trivy filesystem scan | (CI only) | `.github/workflows/security.yml` |