ci: the CI ceiling is 180s so the standalone import and legacy benchmark tests fit on a runner; the 4.0.1 tests type-check under mypy

Author: rennf93

.github/workflows/ci.yml

@@ -125,7 +125,7 @@ jobs:
 
       - name: Run tests
         run: |
-          IPINFO_TOKEN='${{ secrets.IPINFO_TOKEN }}' REDIS_URL='redis://localhost:6379' GUARD_TESTS_MAX_TEST_SECONDS=60 uv run pytest -v --cov=guard_core --cov-fail-under=100 -W error
+          IPINFO_TOKEN='${{ secrets.IPINFO_TOKEN }}' REDIS_URL='redis://localhost:6379' GUARD_TESTS_MAX_TEST_SECONDS=180 uv run pytest -v --cov=guard_core --cov-fail-under=100 -W error
 
       - name: Notify Success on Slack Channel
         uses: rennf93/good-comms@master
@@ -202,7 +202,7 @@ jobs:
 
       - name: Run tests in Docker
         run: |
-          COMPOSE_BAKE=true PYTHON_VERSION=3.10 docker compose run --rm --build -e GUARD_TESTS_MAX_TEST_SECONDS=60 guard-core pytest -q -p no:cacheprovider -W error --ignore=tests/live_smoke --cov=guard_core --cov-branch --cov-fail-under=100
+          COMPOSE_BAKE=true PYTHON_VERSION=3.10 docker compose run --rm --build -e GUARD_TESTS_MAX_TEST_SECONDS=180 guard-core pytest -q -p no:cacheprovider -W error --ignore=tests/live_smoke --cov=guard_core --cov-branch --cov-fail-under=100
 
       - name: Tear down Docker Compose
         if: always()

tests/test_core/test_check_rate_limit_by_ip_autoban.py

@@ -241,9 +241,10 @@ async def test_already_banned_ip_makes_zero_additional_ban_calls() -> None:
 
         async def fake_ban(
             ip: str, duration: int, reason: str = "threshold_exceeded"
-        ) -> None:
+        ) -> bool:
             ban_calls.append((ip, duration, reason))
             manager.banned_ips[ip] = time.time() + duration
+            return True
 
         manager.ban_ip = fake_ban  # type: ignore[method-assign]
 

tests/test_sus_patterns/test_redos_cost_arbiter.py

@@ -1,6 +1,8 @@
 import logging
 import re
 import time
+from collections.abc import Callable
+from typing import Any
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -205,10 +207,14 @@ def _fail_if_called(*args: object, **kwargs: object) -> None:
     assert result is None
 
 
+def _repeat_builder(unit: str) -> Callable[[int], str]:
+    return lambda size: unit * size
+
+
 def test_time_reach_probes_subprocess_clips_timeout_to_remaining_budget() -> None:
     captured: dict[str, float] = {}
 
-    def _fake_run(*args: object, **kwargs: object) -> None:
+    def _fake_run(*args: object, **kwargs: Any) -> None:
         captured["timeout"] = kwargs["timeout"]
         raise OSError("stop before actually spawning")
 
@@ -438,7 +444,7 @@ def _fake_timing(
         _fake_timing,
     )
 
-    builders = [(lambda size, ch=ch: ch * size) for ch in ("a", "b", "c")]
+    builders = [_repeat_builder(ch) for ch in ("a", "b", "c")]
     reason = _first_over_budget_reason(
         r"(\w+)*$", builders, _PATTERN_SAFETY_DEFAULT_CAP, None, _far_deadline()
     )

tests/test_sync/test_core/test_check_rate_limit_by_ip_autoban.py

@@ -237,9 +237,10 @@ def test_already_banned_ip_makes_zero_additional_ban_calls() -> None:
 
         def fake_ban(
             ip: str, duration: int, reason: str = "threshold_exceeded"
-        ) -> None:
+        ) -> bool:
             ban_calls.append((ip, duration, reason))
             manager.banned_ips[ip] = time.time() + duration
+            return True
 
         manager.ban_ip = fake_ban  # type: ignore[method-assign]
 

tests/test_sync/test_sus_patterns/test_redos_cost_arbiter.py

@@ -1,6 +1,8 @@
 import logging
 import re
 import time
+from collections.abc import Callable
+from typing import Any
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -205,10 +207,14 @@ def _fail_if_called(*args: object, **kwargs: object) -> None:
     assert result is None
 
 
+def _repeat_builder(unit: str) -> Callable[[int], str]:
+    return lambda size: unit * size
+
+
 def test_time_reach_probes_subprocess_clips_timeout_to_remaining_budget() -> None:
     captured: dict[str, float] = {}
 
-    def _fake_run(*args: object, **kwargs: object) -> None:
+    def _fake_run(*args: object, **kwargs: Any) -> None:
         captured["timeout"] = kwargs["timeout"]
         raise OSError("stop before actually spawning")
 
@@ -438,7 +444,7 @@ def _fake_timing(
         _fake_timing,
     )
 
-    builders = [(lambda size, ch=ch: ch * size) for ch in ("a", "b", "c")]
+    builders = [_repeat_builder(ch) for ch in ("a", "b", "c")]
     reason = _first_over_budget_reason(
         r"(\w+)*$", builders, _PATTERN_SAFETY_DEFAULT_CAP, None, _far_deadline()
     )

tests/test_sync/test_threat_ban_config.py

@@ -1,5 +1,5 @@
 import logging
-from typing import Any
+from typing import Any, cast
 from unittest.mock import MagicMock
 
 import pytest
@@ -447,7 +447,7 @@ def test_refused_ban_falls_through_to_400_not_403(
     caplog.set_level(logging.WARNING)
     check.check(request)
 
-    check.middleware.create_error_response.assert_called_once_with(
+    cast(MagicMock, check.middleware.create_error_response).assert_called_once_with(
         status_code=400,
         default_message="Suspicious activity detected",
     )
@@ -482,7 +482,7 @@ def test_applied_ban_still_gives_403(
 
     check.check(request)
 
-    check.middleware.create_error_response.assert_called_once_with(
+    cast(MagicMock, check.middleware.create_error_response).assert_called_once_with(
         status_code=403,
         default_message="IP has been banned",
     )

tests/test_threat_ban_config.py

@@ -1,5 +1,5 @@
 import logging
-from typing import Any
+from typing import Any, cast
 from unittest.mock import AsyncMock, MagicMock
 
 import pytest
@@ -447,7 +447,7 @@ async def test_refused_ban_falls_through_to_400_not_403(
     caplog.set_level(logging.WARNING)
     await check.check(request)
 
-    check.middleware.create_error_response.assert_called_once_with(
+    cast(AsyncMock, check.middleware.create_error_response).assert_called_once_with(
         status_code=400,
         default_message="Suspicious activity detected",
     )
@@ -482,7 +482,7 @@ async def test_applied_ban_still_gives_403(
 
     await check.check(request)
 
-    check.middleware.create_error_response.assert_called_once_with(
+    cast(AsyncMock, check.middleware.create_error_response).assert_called_once_with(
         status_code=403,
         default_message="IP has been banned",
     )