From 7cdfb52a3cc52e95b9419325b2f56afc4de3570e Mon Sep 17 00:00:00 2001 From: Senthil Ravichandran Date: Thu, 30 Jul 2026 09:59:09 -0700 Subject: [PATCH 1/4] fix(hermes): accept uv version metadata --- agents/hermes/Dockerfile.base | 4 +++- test/hermes-dependency-review.test.ts | 24 ++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/agents/hermes/Dockerfile.base b/agents/hermes/Dockerfile.base index 1364b7a0e1d..ef5da59a5ed 100644 --- a/agents/hermes/Dockerfile.base +++ b/agents/hermes/Dockerfile.base @@ -412,7 +412,9 @@ RUN printf '%s\n' \ # skip rather than doing a nondeterministic dependency resolve during image # build. RUN pip3 install --no-cache-dir --break-system-packages "uv==${UV_VERSION}" \ - && test "$(uv --version)" = "uv ${UV_VERSION}" + && uv_version_output="$(uv --version)" \ + && uv_version="${uv_version_output#uv }" \ + && test "${uv_version%% *}" = "${UV_VERSION}" # Upstream tests are not part of the production runtime and can contain # intentionally hostile security-test fixtures. Remove them in the extraction # RUN so their bytes never enter a published image layer. diff --git a/test/hermes-dependency-review.test.ts b/test/hermes-dependency-review.test.ts index 3a35357291a..c3360966032 100644 --- a/test/hermes-dependency-review.test.ts +++ b/test/hermes-dependency-review.test.ts @@ -1,6 +1,7 @@ // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. // SPDX-License-Identifier: Apache-2.0 +import { spawnSync } from "node:child_process"; import fs from "node:fs"; import path from "node:path"; @@ -32,6 +33,18 @@ function arg(name: string): string { return match?.[1] ?? ""; } +function uvVersionCheckStatus(output: string): number | null { + const script = [ + 'uv() { printf "%s\\n" "$UV_OUTPUT"; }', + 'uv_version_output="$(uv --version)"', + 'uv_version="${uv_version_output#uv }"', + 'test "${uv_version%% *}" = "${UV_VERSION}"', + ].join("\n"); + return spawnSync("/bin/sh", ["-c", script], { + env: { ...process.env, UV_OUTPUT: output, UV_VERSION: "0.11.33" }, + }).status; +} + describe("Hermes 0.19.0 dependency review", () => { it("binds every active source identity to the reviewed release", () => { expect(arg("HERMES_VERSION")).toBe("v2026.7.20"); @@ -79,6 +92,13 @@ describe("Hermes 0.19.0 dependency review", () => { } }); + it("accepts uv build metadata and rejects a different semantic version", () => { + expect( + uvVersionCheckStatus("uv 0.11.33 (fece32fc5 2026-07-28 aarch64-unknown-linux-gnu)"), + ).toBe(0); + expect(uvVersionCheckStatus("uv 0.11.32 (different build metadata)")).not.toBe(0); + }); + it("ships the reviewed Python dependency remediations and records residual debt", () => { expect(dockerfileBase).toContain( "COPY agents/hermes/security-dependencies.patch /tmp/hermes-security-dependencies.patch", @@ -89,6 +109,10 @@ describe("Hermes 0.19.0 dependency review", () => { expect(dockerfileBase).toContain("uv pip check --python /opt/hermes/.venv/bin/python"); expect(arg("NODE_VERSION")).toBe("24.18.1"); expect(arg("UV_VERSION")).toBe("0.11.33"); + expect(dockerfileBase).toContain('uv_version_output="$(uv --version)"'); + expect(dockerfileBase).toContain('uv_version="${uv_version_output#uv }"'); + expect(dockerfileBase).toContain('test "${uv_version%% *}" = "${UV_VERSION}"'); + expect(dockerfileBase).not.toContain('test "$(uv --version)" = "uv ${UV_VERSION}"'); for (const selection of [ '"cryptography==48.0.1"', '"mcp==1.28.1"', From 96c79c594d7ec81ae98cdb9e234dc3b5f32fefb0 Mon Sep 17 00:00:00 2001 From: Senthil Ravichandran Date: Thu, 30 Jul 2026 10:11:24 -0700 Subject: [PATCH 2/4] test(hermes): derive uv version fixtures --- test/hermes-dependency-review.test.ts | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/test/hermes-dependency-review.test.ts b/test/hermes-dependency-review.test.ts index c3360966032..47469ae9a7c 100644 --- a/test/hermes-dependency-review.test.ts +++ b/test/hermes-dependency-review.test.ts @@ -33,7 +33,7 @@ function arg(name: string): string { return match?.[1] ?? ""; } -function uvVersionCheckStatus(output: string): number | null { +function uvVersionCheckStatus(output: string, expectedVersion: string): number | null { const script = [ 'uv() { printf "%s\\n" "$UV_OUTPUT"; }', 'uv_version_output="$(uv --version)"', @@ -41,7 +41,7 @@ function uvVersionCheckStatus(output: string): number | null { 'test "${uv_version%% *}" = "${UV_VERSION}"', ].join("\n"); return spawnSync("/bin/sh", ["-c", script], { - env: { ...process.env, UV_OUTPUT: output, UV_VERSION: "0.11.33" }, + env: { ...process.env, UV_OUTPUT: output, UV_VERSION: expectedVersion }, }).status; } @@ -93,10 +93,19 @@ describe("Hermes 0.19.0 dependency review", () => { }); it("accepts uv build metadata and rejects a different semantic version", () => { + const expectedVersion = arg("UV_VERSION"); + const differentVersion = expectedVersion.replace(/\d+$/u, (patch) => + String(Number.parseInt(patch, 10) + 1), + ); expect( - uvVersionCheckStatus("uv 0.11.33 (fece32fc5 2026-07-28 aarch64-unknown-linux-gnu)"), + uvVersionCheckStatus( + `uv ${expectedVersion} (fece32fc5 2026-07-28 aarch64-unknown-linux-gnu)`, + expectedVersion, + ), ).toBe(0); - expect(uvVersionCheckStatus("uv 0.11.32 (different build metadata)")).not.toBe(0); + expect( + uvVersionCheckStatus(`uv ${differentVersion} (different build metadata)`, expectedVersion), + ).toBe(1); }); it("ships the reviewed Python dependency remediations and records residual debt", () => { From 8478ec6ca04b3de4f4c8e0e8f756af2a14edf330 Mon Sep 17 00:00:00 2001 From: Prekshi Vyas Date: Thu, 30 Jul 2026 10:31:00 -0700 Subject: [PATCH 3/4] test(hermes): execute Dockerfile uv version check Signed-off-by: Prekshi Vyas --- test/hermes-dependency-review.test.ts | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/test/hermes-dependency-review.test.ts b/test/hermes-dependency-review.test.ts index 47469ae9a7c..c49a03d9615 100644 --- a/test/hermes-dependency-review.test.ts +++ b/test/hermes-dependency-review.test.ts @@ -34,11 +34,27 @@ function arg(name: string): string { } function uvVersionCheckStatus(output: string, expectedVersion: string): number | null { + const dockerfileLines = dockerfileBase.split("\n"); + const installIndex = dockerfileLines.findIndex( + (line) => line.startsWith("RUN pip3 install ") && line.includes('"uv==${UV_VERSION}"'), + ); + expect(installIndex, "Missing Dockerfile uv install command").toBeGreaterThanOrEqual(0); + + const commandLines: string[] = []; + for (let index = installIndex; index < dockerfileLines.length; index += 1) { + const line = dockerfileLines[index] ?? ""; + commandLines.push(line); + if (!line.endsWith("\\")) { + break; + } + } + const versionCheckLines = commandLines.slice(1); + expect(versionCheckLines, "Missing Dockerfile uv version check").not.toHaveLength(0); + const script = [ 'uv() { printf "%s\\n" "$UV_OUTPUT"; }', - 'uv_version_output="$(uv --version)"', - 'uv_version="${uv_version_output#uv }"', - 'test "${uv_version%% *}" = "${UV_VERSION}"', + "set -e", + ...versionCheckLines.map((line) => line.replace(/^\s*&&\s*/u, "").replace(/\s*\\$/u, "")), ].join("\n"); return spawnSync("/bin/sh", ["-c", script], { env: { ...process.env, UV_OUTPUT: output, UV_VERSION: expectedVersion }, @@ -118,10 +134,6 @@ describe("Hermes 0.19.0 dependency review", () => { expect(dockerfileBase).toContain("uv pip check --python /opt/hermes/.venv/bin/python"); expect(arg("NODE_VERSION")).toBe("24.18.1"); expect(arg("UV_VERSION")).toBe("0.11.33"); - expect(dockerfileBase).toContain('uv_version_output="$(uv --version)"'); - expect(dockerfileBase).toContain('uv_version="${uv_version_output#uv }"'); - expect(dockerfileBase).toContain('test "${uv_version%% *}" = "${UV_VERSION}"'); - expect(dockerfileBase).not.toContain('test "$(uv --version)" = "uv ${UV_VERSION}"'); for (const selection of [ '"cryptography==48.0.1"', '"mcp==1.28.1"', From 1809aa6cadefb6af67a0df784c00a5a3a848b6ba Mon Sep 17 00:00:00 2001 From: Prekshi Vyas Date: Thu, 30 Jul 2026 10:39:17 -0700 Subject: [PATCH 4/4] test(hermes): satisfy conditional growth guardrail Signed-off-by: Prekshi Vyas --- test/hermes-dependency-review.test.ts | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/test/hermes-dependency-review.test.ts b/test/hermes-dependency-review.test.ts index c49a03d9615..8273c2aa0c7 100644 --- a/test/hermes-dependency-review.test.ts +++ b/test/hermes-dependency-review.test.ts @@ -40,15 +40,9 @@ function uvVersionCheckStatus(output: string, expectedVersion: string): number | ); expect(installIndex, "Missing Dockerfile uv install command").toBeGreaterThanOrEqual(0); - const commandLines: string[] = []; - for (let index = installIndex; index < dockerfileLines.length; index += 1) { - const line = dockerfileLines[index] ?? ""; - commandLines.push(line); - if (!line.endsWith("\\")) { - break; - } - } - const versionCheckLines = commandLines.slice(1); + const commandLines = dockerfileLines.slice(installIndex); + const commandEndIndex = commandLines.findIndex((line) => !line.endsWith("\\")); + const versionCheckLines = commandLines.slice(1, commandEndIndex + 1); expect(versionCheckLines, "Missing Dockerfile uv version check").not.toHaveLength(0); const script = [