clawbot
4c2932d6d6
check / check (push) Failing after 2m11s
make fmt and make fmt-check now cover every Markdown file with prettier (4-space tabs, proseWrap always), as template-app-go does: prettier is pinned by package.json and yarn.lock and runs in a docker build on a digest-pinned node image, never on the host. The check is forced to run with --no-cache-filter, as script/lint is. script/fmt-check is split into a Go half and a Markdown half because the Dockerfile lint stage cannot run docker: that stage now runs the Go half and script/cibuild runs the Markdown half after the build. *.md leaves .dockerignore so documents reach the build context. README.md, TESTING.md and TODO.md are reformatted by make fmt; apart from the README Entrypoints entries, its make fmt line under Building and the TODO entry, that diff is mechanical. Model: opus-5-5
45 lines
1.9 KiB
Markdown
45 lines
1.9 KiB
Markdown
# Testing Policy
|
||
|
||
## DNS Resolution Tests
|
||
|
||
DNS is never mocked in this project, not in tests and not anywhere else; see the
|
||
README section "No DNS mocking. Ever." Every test that looks something up in DNS
|
||
**MUST** query live DNS servers, never a stand-in. Logic that works on record
|
||
data, such as comparing or formatting records, may be tested on that data
|
||
directly with no lookup.
|
||
|
||
### Rationale
|
||
|
||
The resolver performs iterative resolution from root nameservers through the
|
||
full delegation chain. Mocked responses cannot faithfully represent the variety
|
||
of real-world DNS behavior (truncation, referrals, glue records, DNSSEC, varied
|
||
response times, EDNS, etc.). Testing against real servers ensures the resolver
|
||
works correctly in production.
|
||
|
||
### Constraints
|
||
|
||
- Tests hit real DNS infrastructure and require network access
|
||
- Test duration depends on network conditions; timeout tuning keeps the suite
|
||
within the 60-second target
|
||
- Query timeout is calibrated to 3× maximum antipodal RTT (~300ms) plus
|
||
processing margin
|
||
- Root server fan-out is limited to reduce parallel query load
|
||
- Live lookups that expect an answer go through `internal/livednstest`, which
|
||
limits how many run at once in a test binary and retries a lookup that got
|
||
none
|
||
- Flaky failures from transient network issues are acceptable and should be
|
||
investigated as potential resolver bugs, not papered over with mocks or skip
|
||
flags
|
||
|
||
### What NOT to do
|
||
|
||
- **Do not mock, fake or stub DNS** anywhere: no stand-in `DNSClient`, no
|
||
stand-in for the watcher's `DNSResolver`, no fake DNS server, no canned
|
||
responses
|
||
- **Do not add `-short` flags** to skip slow tests
|
||
- **Do not increase `-timeout`** to hide hanging queries
|
||
- **Do not remove `-count=1` from `script/test`** — Go's test cache replays a
|
||
previous run's output without querying anything, so a cached pass is not
|
||
evidence that live resolution works
|
||
- **Do not modify linter configuration** to suppress findings
|