yams/tests/scripts/raw_environment_allowlist.txt
0xkite 05bdb14cf4
test(policy): allowlist the per-process XDG_STATE_HOME setenv in catch2_main (#312)
#296 sets XDG_STATE_HOME before Catch2 starts so each test process gets a
private state directory. The support library links no yams config, so it
calls setenv/_putenv_s directly, and raw_environment_policy has failed the
Tests job on every platform since. Record both sites as reviewed.

Signed-off-by: trvon <me@trevon.dev>
Co-authored-by: trvon <me@trevon.dev>
2026-10-16 09:43:38 -06:00

15 lines
1.4 KiB
Text

# Reviewed first-party raw environment mutations. New sites fail the policy gate.
# Task #71 owns migration of compatibility/process writes unless noted otherwise.
include/yams/compat/unistd.h:14:raw-env/setenv # Windows POSIX compatibility shim
include/yams/compat/unistd.h:17:raw-env/_putenv_s # Windows POSIX compatibility shim
include/yams/compat/unistd.h:20:raw-env/unsetenv # Windows POSIX compatibility shim
include/yams/compat/unistd.h:21:raw-env/_putenv_s # Windows POSIX compatibility shim
plugins/onnx/onnx_gpu_provider.h:120:raw-env/_putenv_s # ONNX provider environment default-if-unset compatibility
plugins/onnx/onnx_gpu_provider.h:122:raw-env/setenv # ONNX provider environment default-if-unset compatibility
src/extraction/plugin_process.cpp:282:raw-env/setenv # Child plugin process environment construction
tests/support/catch2_main.cpp:173:raw-env/_putenv_s # Pre-thread per-process XDG_STATE_HOME isolation; main lib links no yams config
tests/support/catch2_main.cpp:175:raw-env/setenv # Pre-thread per-process XDG_STATE_HOME isolation; main lib links no yams config
tools/fuzzing/fuzz_plugin_abi_mount.cpp:55:raw-env/setenv # Single-process fuzz harness setup
tools/fuzzing/fuzz_plugin_abi_negotiation.cpp:51:raw-env/setenv # Single-process fuzz harness setup
tools/yams-cli/main.cpp:40:raw-env/setenv # Pre-thread one-shot executable marker
tools/yams-cli/main.cpp:42:raw-env/_putenv_s # Pre-thread one-shot executable marker