| 1 | """CI test wrapper for the prompt security linter. |
| 2 | |
| 3 | Ensures prompt templates maintain security guardrails on every PR. Fails if |
| 4 | any prompt template has unguarded external variables, missing closing security |
| 5 | constraints, or unknown/unclassified template variables. |
| 6 | """ |
| 7 | |
| 8 | from pathlib import Path |
| 9 | |
| 10 | from scripts.lint_prompts import lint_prompt |
| 11 | |
| 12 | PROMPTS_DIR = Path(__file__).resolve().parent.parent / "prompts" |
| 13 | |
| 14 | |
| 15 | def test_all_prompts_pass_security_lint(): |
| 16 | """All prompt templates must pass the security linter.""" |
| 17 | prompt_files = sorted(PROMPTS_DIR.glob("*.md")) |
| 18 | assert prompt_files, ( |
| 19 | f"No prompt templates found in {PROMPTS_DIR}; expected at least one .md file to lint" |
| 20 | ) |
| 21 | errors: list[str] = [] |
| 22 | for prompt_file in prompt_files: |
| 23 | errors.extend(lint_prompt(prompt_file)) |
| 24 | |
| 25 | assert not errors, f"{len(errors)} prompt security issue(s):\n" + "\n".join(errors) |