sneak
a535ae864b
All checks were successful
check / check (push) Successful in 53s
DNS is never mocked in this repository: tests exercise live DNS, and robustness comes from handling real-world DNS behavior with tolerant assertions and sensible timeouts, not from mocks. watcher: drop mockResolver and wire the real iterative resolver into the tests, querying stable public names (example.com, www.example.com). Change detection is exercised by seeding the state store with a synthetic previous observation that live DNS cannot match (reserved .invalid nameserver names and RFC 5737 documentation addresses); DNS stays live in every run. The port checker, TLS checker, and notifier remain test doubles since they are not DNS, keeping notification and state assertions deterministic against whatever addresses live DNS returns. resolver: drop the timeoutClient fake DNSClient and the NewFromLoggerWithClient mock constructor. The timeout test is replaced by a live query against an RFC 5737 documentation address where no nameserver can exist, asserting a classified non-OK response with no records. TESTING.md: extend the live-DNS policy to every package and remove the carve-out that permitted DNS mocks in packages that consume the resolver. TODO.md: update stale references to hermetic mocked-DNS work to reflect the no-mocking policy and the current state of feature/resolver. Intentionally dropped coverage: the exact StatusTimeout classification (previously forced by the fake client) is no longer asserted, because a genuinely unreachable server may fail fast instead of timing out depending on the network path; the live test tolerantly accepts any failure classification.
42 lines
1.7 KiB
Markdown
42 lines
1.7 KiB
Markdown
# Testing Policy
|
||
|
||
## DNS Resolution Tests
|
||
|
||
All tests that involve DNS resolution — in every package, including
|
||
consumers of the resolver such as the watcher — **MUST** use live
|
||
queries against real DNS servers. No mocking, faking, or stubbing of
|
||
DNS at any layer is permitted.
|
||
|
||
### Rationale
|
||
|
||
The resolver performs iterative resolution from root nameservers through
|
||
the full delegation chain. Mocked responses cannot faithfully represent
|
||
the variety of real-world DNS behavior (truncation, referrals, glue
|
||
records, DNSSEC, varied response times, EDNS, etc.). Testing against
|
||
real servers ensures the resolver works correctly in production.
|
||
Robustness comes from handling real-world DNS behavior with tolerant
|
||
assertions and sensible timeouts, not from mocks.
|
||
|
||
### Constraints
|
||
|
||
- Tests hit real DNS infrastructure and require network access
|
||
- Test duration depends on network conditions; timeout tuning keeps
|
||
the suite within the 30-second target
|
||
- Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
|
||
plus processing margin
|
||
- Root server fan-out is limited to reduce parallel query load
|
||
- Flaky failures from transient network issues are acceptable and
|
||
should be investigated as potential resolver bugs, not papered over
|
||
with mocks or skip flags
|
||
- Watcher change-detection tests seed a synthetic *previous state*
|
||
and compare it against fresh live lookups; the DNS side is never
|
||
faked
|
||
|
||
### What NOT to do
|
||
|
||
- **Do not mock `DNSClient`**, the watcher's `DNSResolver` interface,
|
||
or any other DNS abstraction — in any package, for any reason
|
||
- **Do not add `-short` flags** to skip slow tests
|
||
- **Do not increase `-timeout`** to hide hanging queries
|
||
- **Do not modify linter configuration** to suppress findings
|