mirror of
https://github.com/galaxyproject/galaxy.git
synced 2026-11-02 03:33:04 +08:00
paperbenni
bec3d3ad9c
Drop Python 3.8 support in 5 Pulsar-compatible packages (job_metrics, tool_util, tool_util_models, util, objectstore) and run pyupgrade --py310-plus on their source code. - Bump requires-python from >=3.8 to >=3.10 in all 5 packages - Remove Python 3.8 and 3.9 classifiers - Remove ruff per-file-ignores for UP rules on these paths - Remove backports.zoneinfo conditional dependency - Remove pydyf<0.11 pin from conditional-requirements.txt - Update Makefile pyupgrade target (remove PY38_PYUPGRADE_PATHS) - Update CI workflow to test with Python 3.10 instead of 3.8 Clean up unused deprecated typing imports after pyupgrade Remove now-unused typing imports (Dict, List, Optional, Set, Tuple, Type, Union) that became dead after pyupgrade --py310-plus converted annotations to use built-in types and | syntax. Also run ruff check --fix --select=UP007,UP045 across the entire codebase to convert remaining Optional[X] -> X | None and Union[X, Y] -> X | Y patterns. Enable ruff UP007/UP045 for Python 3.10 union syntax Remove UP007 (Union[X,Y] -> X | Y) and UP045 (Optional[X] -> X | None) from the ruff ignore list and convert all type aliases across the codebase. These rules were deferred while Python 3.9 was supported; requires-python is now >=3.10. A custom script was used because neither ruff --fix nor pyupgrade --py310-plus converts Optional[X]/Union[X,Y] in type alias positions (e.g. X = Union[A, B]) — they only handle annotation positions (e.g. def f(x: Optional[int])). All 167 violations were module-level type aliases. A few edge cases were fixed manually: single-element Union[X,], typing.Union qualified refs, runtime Optional[type] calls, and Annotated[Optional[...]] pydantic fields. Fix UP007 autofix regression with string forward reference type aliases Commit fa6bd955a0 enabled ruff UP007/UP045 and auto-fixed module-level type aliases using Union with string forward references, producing invalid 'str | str' expressions. This was a known ruff bug (charliermarsh/ruff#826) that has since been fixed in later ruff versions, but this codebase was converted before the fix was in place. Revert to Union syntax and restore TYPE_CHECKING imports that ruff's TCH rule cleaned up as a side effect when it thought the forward references were unused.
83 lines
3.3 KiB
Python
83 lines
3.3 KiB
Python
"""Integration tests for aiocop blocking-I/O detection.
|
|
|
|
Spins up a Galaxy server with aiocop enabled and registers test-only debug
|
|
endpoints that intentionally perform high-severity blocking I/O from inside
|
|
an async handler. The aiocop audit hook must catch the call and the test
|
|
interactor must fail the request via the ``X-Aiocop-Violations`` header.
|
|
|
|
The debug endpoints are **only** added to the test server — they never
|
|
exist in a production Galaxy instance.
|
|
"""
|
|
|
|
import socket
|
|
|
|
import pytest
|
|
|
|
from galaxy.webapps.galaxy.fast_app import initialize_fast_app
|
|
from galaxy_test.base.api import AIOCOP_ENABLED
|
|
from galaxy_test.driver import integration_util
|
|
|
|
|
|
def _init_fast_app_with_debug_routes(wsgi_webapp, gx_app):
|
|
"""Wrap the standard FastAPI initializer to add debug blocking routes.
|
|
|
|
Routes must be injected before the WSGI catch-all mount (``app.mount("/", ...)``)
|
|
that ``initialize_fast_app`` adds, otherwise Starlette never reaches them.
|
|
We pop the catch-all, register our routes, then re-append it.
|
|
"""
|
|
app = initialize_fast_app(wsgi_webapp, gx_app)
|
|
|
|
wsgi_catch_all = app.routes.pop()
|
|
|
|
@app.get("/api/debug/block")
|
|
async def block_event_loop() -> dict:
|
|
# socket.getaddrinfo is a high-severity blocking call in aiocop's
|
|
# severity table and will trigger the audit hook.
|
|
try:
|
|
socket.getaddrinfo("invalid.local.test.galaxy.example", 80)
|
|
except socket.gaierror:
|
|
pass
|
|
return {"status": "blocked"}
|
|
|
|
@app.get("/api/debug/ok")
|
|
async def ok() -> dict:
|
|
return {"status": "ok"}
|
|
|
|
app.routes.append(wsgi_catch_all)
|
|
return app
|
|
|
|
|
|
@pytest.mark.skipif(
|
|
not AIOCOP_ENABLED,
|
|
reason="GALAXY_TEST_AIOCOP not set",
|
|
)
|
|
class TestAiocopBlockingDetection(integration_util.IntegrationTestCase):
|
|
init_fast_app = staticmethod(_init_fast_app_with_debug_routes)
|
|
|
|
def test_ok_endpoint_does_not_block(self):
|
|
"""A trivial async endpoint must not trigger a high-severity aiocop violation.
|
|
|
|
Low-severity events (e.g. ``os.stat`` from Galaxy middleware) may
|
|
still appear in the ``X-Aiocop-Violations`` header; only events at
|
|
``AIOCOP_FAIL_SEVERITY`` or above fail the request.
|
|
"""
|
|
response = self._get("debug/ok")
|
|
self._assert_status_code_is(response, 200)
|
|
assert response.json()["status"] == "ok"
|
|
if header := response.headers.get("x-aiocop-violations", ""):
|
|
fields = dict(p.split("=", 1) for p in header.split(";") if "=" in p)
|
|
assert (
|
|
int(fields.get("severity", "0")) < 50
|
|
), f"OK endpoint triggered high-severity aiocop violation: {header!r}"
|
|
|
|
def test_blocking_endpoint_detected(self):
|
|
"""An endpoint that makes a blocking syscall must be caught by aiocop."""
|
|
with pytest.raises(AssertionError, match="aiocop detected high-severity blocking I/O"):
|
|
self._get("debug/block")
|
|
|
|
def test_violations_header_present_on_block(self):
|
|
"""The X-Aiocop-Violations header must be set when blocking I/O occurs."""
|
|
response = self.galaxy_interactor._get("debug/block")
|
|
header = response.headers.get("x-aiocop-violations", "")
|
|
assert "count=" in header and "severity=" in header, f"Missing aiocop violation summary: {header!r}"
|