PR State:
merged
PR:
#103
Commit:
f163aebe69ddaa808ef68f8b4e9fba1ee8c0bf70
[FIX] viin_ai_ops: an unprovable proposal gets the strictest outcome, not the default
Acceptance rejected the previous fix on six High-tier scenarios, and it was
right. That fix moved the unknown-model case from auto-executed to pending, and
stopped there. But an administrator's model-scoped block yields rejected for a
proposal that names its model, while the same proposal with the field empty
yielded pending - which one approver can wave through, after which it executes.
Omitting impacted_model still downgraded a hard block into an approvable request.
Two code reviews read that as defensible; the rule requires monotone OVERSIGHT,
and rank 1 is not rank 2.
The scan no longer aborts at the first policy it cannot rule out. It runs to
completion and takes the maximum over the oversight lattice of every outcome
still reachable: each policy that agrees on all the proposal's OTHER axes and is
scoped to a model that cannot be excluded, plus the first unscoped policy reached
(nothing behind it is reachable for any model), or the unmatched fallback when no
catch-all is reached. Taking the first rather than the max is exactly what made
the earlier attempt wrong.
Nothing is recorded as the matching policy. The status stays "model
unidentified" and policy is None, because the resolved action is a statement
about the policy SET - nothing configured here permits less than this - not an
attribution to one rule. Naming the strictest candidate would assert that a rule
scoped to a model the proposal may never have touched governed it, which is a
false statement in an auditable subsystem, and it would break the workflow
bridge that reads this status to tell "no orchestration configured" from "the
governing policy could not be determined".
The sudo gate generalises the same way: allow_runs_as_sudo is now the AND over
candidates, since an opt-in must not be borrowed from a rule that may not govern.
An unranked action falls back to maximum oversight rather than raising.
Both directions are held. The over-correction set - a permissive rule legitimately
in front of a block, a block filtered out by risk or scope, another company's
policy - passes at HEAD AND after the fix, which is what proves the change is not
a blanket block. Reverting the model file reds 14 tests and errors 2 more; the
S9 discriminator names the twins and the strictest outcome in its failure message.
Two consequences stated rather than buried. A single model-scoped block now
blocks every proposal recording no impacted_model, not only those that might have
hit that model - a real widening, and what the rule's wording forces. And two
legacy assertions changed, because they encoded the earlier partial fix.
96 tests green on two databases, plus the bridge, approval, approval_account and
workflow suites.
Test setup now archives pre-existing policies inside its own rolled-back
transaction. A shared test database carried leftover fixtures that reddened 13
tests before any of this; the suite should not depend on which rows a previous
run forgot.
Branch:
17.0
Odoo 17 Test Suite Using Docker
Check the quality with Pylint: from test_lint to test_pylint
- install_module test_lint,test_pylint
- exec_odoo --db_port 5432 --log-level=test --max-cron-threads=0 --load=base,web,to_base --stop-after-init --test-enable --test-tags=/test_lint,/test_pylint,/test_lint,/test_pylint,-:.test_pofiles_string_formatting
| Create Date | Level | Message |
|---|---|---|
| 07/27/2026 23:00:15 | INFO |
Using Docker Image Odoo 17 Ubuntu 22.04 Python 3.10:
FROM ubuntu:jammy ENV LANG C.UTF-8 ENV ODOO_TEST_FAILURE_RETRIES=2 USER root SHELL ["/bin/bash", "-c"] # Install debian packages RUN set -x ; \ apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends apt-transport-https build-essential ca-certificates curl ffmpeg file fonts-freefont-ttf fonts-noto-cjk gawk gnupg gsfonts libldap2-dev libjpeg9-dev libsasl2-dev libxslt1-dev lsb-release node-less ocrmypdf sed sudo unzip xfonts-75dpi zip zlib1g-dev git build-essential cython3 libffi-dev libev-dev \ && rm -rf /var/lib/apt/lists/* # Install Python3 packages RUN set -x ; \ apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends python3 python3-dbfread python3-dev python3-pip python3-setuptools python3-wheel python3-markdown python3-mock python3-phonenumbers python3-websocket python3-cffi libpq-dev \ && rm -rf /var/lib/apt/lists/* # Install wkhtml RUN curl -sSL https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6-1/wkhtmltox_0.12.6-1.focal_amd64.deb -o /tmp/wkhtmltox_0.12.6-1.focal_amd64.deb \ && curl -sSL http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.0g-2ubuntu4_amd64.deb -o /tmp/libssl1.1_1.1.0g-2ubuntu4_amd64.deb \ && apt-get update \ && dpkg -i /tmp/libssl1.1_1.1.0g-2ubuntu4_amd64.deb \ && apt install -y -f --no-install-recommends /tmp/wkhtmltox_0.12.6-1.focal_amd64.deb \ && rm /tmp/libssl1.1_1.1.0g-2ubuntu4_amd64.deb /tmp/wkhtmltox_0.12.6-1.focal_amd64.deb # Install Odoo:Depends ADD https://raw.githubusercontent.com/brendangregg/FlameGraph/master/flamegraph.pl /usr/local/bin/flamegraph.pl RUN chmod +rx /usr/local/bin/flamegraph.pl ADD https://raw.githubusercontent.com/Viindoo/odoo/17.0/debian/control /tmp/control.txt RUN apt-get update \ && sed -n '/^Depends:/,/^[A-Z]/p' /tmp/control.txt \ | awk '/^ [a-z]/ { gsub(/,/,"") ; print $1 }' | sort -u \ | egrep -v 'postgresql-client' \ | sed 's/python-imaging/python-pil/'| sed 's/python-pypdf/python-pypdf2/' | sed 's/python3-lxml-html-clean/python3-lxml/' \ | DEBIAN_FRONTEND=noninteractive xargs apt-get install -y -qq \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* RUN python3 -m pip install --no-cache-dir setuptools wheel && \ python3 -m pip install coverage==7.4.4 flamegraph RUN apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install -y postgresql-client-14 \ && rm -rf /var/lib/apt/lists/* # Install Google Chrome ARG CHROME_VERSION=141.0.7390.54 RUN set -eux; \ echo 'repo_add_once="false"' > /etc/default/google-chrome; \ curl -sSLf "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}-1_amd64.deb" \ -o /tmp/chrome.deb; \ apt-get update; \ apt-get -y install --no-install-recommends /tmp/chrome.deb; \ apt-mark hold google-chrome-stable; \ rm -f /tmp/chrome.deb /etc/apt/sources.list.d/google-chrome.list; \ rm -rf /var/lib/apt/lists/*; \ google-chrome --version | grep -F "${CHROME_VERSION}" # Install phantomjs RUN curl -sSL https://nightly.odoo.com/resources/phantomjs.tar.bz2 -o /tmp/phantomjs.tar.bz2 \ && tar xvfO /tmp/phantomjs.tar.bz2 phantomjs-2.1.1-linux-x86_64/bin/phantomjs > /usr/local/bin/phantomjs \ && chmod +x /usr/local/bin/phantomjs \ && rm -f /tmp/phantomjs.tar.bz2 ADD https://raw.githubusercontent.com/Viindoo/odoo/17.0/requirements.txt /root/requirements.txt RUN python3 -m pip install --no-cache-dir wheel setuptools && \ python3 -m pip install --upgrade --no-cache-dir -r /root/requirements.txt && \ python3 -m pip install --no-cache-dir ebaysdk==2.1.5 pdf417gen==0.7.1 RUN python3 -m pip install --no-cache-dir requests pyOpenSSL # Install debian packages RUN set -x ; \ apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends openssl iputils-ping openssh-client chromium-browser \ && rm -rf /var/lib/apt/lists/* RUN python3 -m pip install --no-cache-dir --upgrade websocket-client==1.2.3 flake8==4.0.1 RUN python3 -m pip uninstall pylint pylint-odoo isort Pygments -y RUN python3 -m pip install --no-cache-dir --upgrade pylint-odoo==9.0.5 RUN python3 -m pip install --no-cache-dir --upgrade Pygments==2.15.0 --no-deps RUN python3 -m pip install --no-cache-dir --upgrade odoo_test_helper # Install nodejs RUN curl -fsSLO --compressed "https://nodejs.org/dist/v18.20.0/node-v18.20.0-linux-x64.tar.xz" \ && tar -xJf "node-v18.20.0-linux-x64.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ && rm "node-v18.20.0-linux-x64.tar.xz" \ && ln -s /usr/local/bin/node /usr/local/bin/nodejs #RUN npm install -g rtlcss es-check eslint@8 RUN python3 -m pip install --no-cache-dir --upgrade setuptools==61 # để tương thích với python-pkcs11-0.7.0 # Install cloc package RUN set -x ; \ apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends cloc \ && rm -rf /var/lib/apt/lists/* RUN npm install -g rtlcss@3.4.0 es-check@6.0.0 eslint@8.57.1 prettier@2.7.1 eslint-config-prettier@8.5.0 eslint-plugin-prettier@4.2.1 --save-dev |
| 07/27/2026 23:00:15 | INFO |
Check the quality with Pylint: from test_lint to test_pylint:
Command: install_module args: test_lint,test_pylint |
| 07/27/2026 23:00:15 | INFO |
Check the quality with Pylint: from test_lint to test_pylint:
Command: exec_odoo args: --db_port 5432 --log-level=test --max-cron-threads=0 --load=base,web,to_base --stop-after-init --test-enable --test-tags=/test_lint,/test_pylint,/test_lint,/test_pylint,-:.test_pofiles_string_formatting |
| 07/27/2026 23:00:15 | INFO |
Docker command:
cd /data/build; python3 -m pip install --user --progress-bar off -r Viindoo-tvtmaaddons-17.0/requirements.txt && python3 -m pip install --user --progress-bar off -r Viindoo-erponline-enterprise-17.0/requirements.txt && python3 Viindoo-odoo-17.0/odoo-bin --addons-path Viindoo-odoo-17.0/odoo/addons,Viindoo-odoo-17.0/addons,Viindoo-tvtmaaddons-17.0,Viindoo-erponline-enterprise-17.0,Viindoo-branding-17.0,rb-f163aeb-223409 -d rb-f163aeb-223409-398452 --data-dir /data/build/datadir -i test_lint,test_pylint --db_port 5432 --log-level=test --max-cron-threads=0 --load=base,web,to_base --stop-after-init --test-enable --test-tags=/test_lint,/test_pylint,/test_lint,/test_pylint,-:.test_pofiles_string_formatting ; |
| 07/27/2026 23:00:15 | INFO |
Container rb-f163aeb-223409-398452 started !
|
| 07/27/2026 23:20:10 | INFO |
Container rb-f163aeb-223409-398452 stopped !
|
| 07/27/2026 23:20:10 | INFO |
Cleaning all resource
|
| 07/27/2026 23:20:10 | INFO |
Cleanup finished
|