sneak
a75d4d51fd
check / check (push) Successful in 1m38s
The live-DNS retry and concurrency limit is only for tests, but nothing stopped program code from importing it and compiling it into the binary. Its directory name now ends in test, and its import path is on the test-support deny list in .golangci.yml, so make lint fails when program code imports it. Every import and mention is updated to the new name. Model: opus-5-5
46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# Testing Policy
|
||
|
||
## DNS Resolution Tests
|
||
|
||
DNS is never mocked in this project, not in tests and not anywhere
|
||
else; see the README section "No DNS mocking. Ever." Every test that
|
||
looks something up in DNS **MUST** query live DNS servers, never a
|
||
stand-in. Logic that works on record data, such as comparing or
|
||
formatting records, may be tested on that data directly with no
|
||
lookup.
|
||
|
||
### Rationale
|
||
|
||
The resolver performs iterative resolution from root nameservers through
|
||
the full delegation chain. Mocked responses cannot faithfully represent
|
||
the variety of real-world DNS behavior (truncation, referrals, glue
|
||
records, DNSSEC, varied response times, EDNS, etc.). Testing against
|
||
real servers ensures the resolver works correctly in production.
|
||
|
||
### Constraints
|
||
|
||
- Tests hit real DNS infrastructure and require network access
|
||
- Test duration depends on network conditions; timeout tuning keeps
|
||
the suite within the 60-second target
|
||
- Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
|
||
plus processing margin
|
||
- Root server fan-out is limited to reduce parallel query load
|
||
- Live lookups that expect an answer go through `internal/livednstest`,
|
||
which limits how many run at once in a test binary and retries a
|
||
lookup that got none
|
||
- Flaky failures from transient network issues are acceptable and
|
||
should be investigated as potential resolver bugs, not papered over
|
||
with mocks or skip flags
|
||
|
||
### What NOT to do
|
||
|
||
- **Do not mock, fake or stub DNS** anywhere: no stand-in `DNSClient`,
|
||
no stand-in for the watcher's `DNSResolver`, no fake DNS server, no
|
||
canned responses
|
||
- **Do not add `-short` flags** to skip slow tests
|
||
- **Do not increase `-timeout`** to hide hanging queries
|
||
- **Do not remove `-count=1` from `script/test`** — Go's test cache
|
||
replays a previous run's output without querying anything, so a
|
||
cached pass is not evidence that live resolution works
|
||
- **Do not modify linter configuration** to suppress findings
|