Updates v1.3.0

Author: pdudotdev

.gitignore

@@ -11,6 +11,7 @@ build/
 logs/
 data/
 testing/manual_results/
+platform_coverage_results.md
 dbl/
 clab-dblcheck/
 legacy/

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [1.3.0] — 2026-03-23
+
+### CI Pipeline
+
+- GitHub Actions workflow with 4 parallel jobs: lint (ruff), type-check (pyright), test (pytest), coverage (pytest-cov)
+- Consolidated tool configs into `pyproject.toml` (ruff + pyright)
+- 85% test coverage baseline
+
+### Live Device Test Suite
+
+- 89 live SSH tests across 5 vendors (IOS-XE, EOS, JunOS, AOS-CX, RouterOS) covering every PLATFORM_MAP query per device
+- Automated SSH host key refresh fixture for containerlab restarts (removes stale keys, scans fresh ones before test session)
+- Result classifier detects vendor-specific error patterns: IOS `% Invalid input`, EOS `% <msg>`, JunOS `error:` prefix, AOS-CX `Invalid input:` (no `%` prefix), empty output
+- Markdown coverage report generated per run (`testing/live/platform_coverage_results.md`)
+
+### Platform Map Fixes
+
+- AOS-CX: replaced bare `show running-config` with targeted commands for ospf/config, bgp/config, policy_based_routing, access_lists
+- JunOS: fixed ospf/config, bgp/config, route_maps, prefix_lists commands that caused syntax errors
+
+### Bug Fixes
+
+- Fixed `SSH_STRICT_HOST_KEY=False` not actually disabling strict host key checking (scrapli `BinOptions` defaulted to strict when transport was `None`)
+- Fixed `run_tests.sh` not exporting `NO_LAB` variable to pytest subprocess
+- Fixed test data paths from gitignored `legacy/` to tracked `testing/mock/resources/`
+- Removed duplicate test functions flagged by ruff (F811)
+- Linted codebase with ruff: removed unused imports, fixed import ordering across ~30 files
+
+---
+
 ## [1.2.0] — 2026-03-19
 
 ### Jira Incident Lifecycle

README.md

@@ -1,6 +1,6 @@
 # ✨ dblCheck
 
-[![Version](https://img.shields.io/badge/ver.-1.2.0-1a1a2e)](https://github.com/pdudotdev/dblCheck/releases/tag/1.2.0)
+[![Version](https://img.shields.io/badge/ver.-1.3.0-1a1a2e)](https://github.com/pdudotdev/dblCheck/releases/tag/1.3.0)
 ![License](https://img.shields.io/badge/license-BSL1.1-1a1a2e)
 [![Last Commit](https://img.shields.io/github/last-commit/pdudotdev/dblCheck?color=1a1a2e)](https://github.com/pdudotdev/dblCheck/commits/main/)
 
@@ -15,7 +15,7 @@
 - 📜 **dblCheck**
   - [🔭 Overview](#-overview)
   - [🍀 Here's a Quick Demo](#-heres-a-quick-demo)
-  - [⭐ What's New in v1.2](#-whats-new-in-v12)
+  - [⭐ What's New in v1.3](#-whats-new-in-v13)
   - [⚒️ Core Tech Stack](#️-core-tech-stack)
   - [📋 Validation Scope](#-validation-scope)
   - [🛠️ Installation & Usage](#️-installation--usage)
@@ -43,7 +43,7 @@ Continuously checks **live network state against design intent** and invokes a C
 - [x] **HashiCorp Vault** - All secrets (device creds, NetBox token, Jira key etc.) stored in Vault
 - [x] **NetBox** - Network inventory and expected state loaded automatically
 - [x] **Jira** - Network state drift and deviations logged to Jira
-- [x] **711 tests** - 21 suites (17 unit + 3 integration + 1 live)
+- [x] **711 tests** - 21 suites (17 unit + 3 integration + 1 live device SSH), CI via GitHub Actions
 
 ▫️ **Supported models:**
 - [x] Haiku 4.5
@@ -63,7 +63,7 @@ Continuously checks **live network state against design intent** and invokes a C
 ## 🍀 Here's a Quick Demo
 - [x] *Demo video coming soon...*
 
-## ⭐ What's New in v1.2
+## ⭐ What's New in v1.3
 - [x] See [**CHANGELOG.md**](CHANGELOG.md)
 
 ## ⚒️ Core Tech Stack

platforms/platform_map.py

@@ -62,7 +62,7 @@
             "redistribution":       "show running-config section redistribute",
             "route_maps":           "show route-map",
             "prefix_lists":         "show ip prefix-list",
-            "policy_based_routing": "show ip policy",
+            "policy_based_routing": "show policy-map type pbr",
             "access_lists":         "show ip access-lists",
         },
         "interfaces": {
@@ -78,23 +78,23 @@
             "neighbors":  {"default": "show ospf neighbor",  "vrf": "show ospf neighbor instance {vrf}"},
             "database":   {"default": "show ospf database",  "vrf": "show ospf database instance {vrf}"},
             "borders":    {"default": "show ospf route abr", "vrf": "show ospf route abr instance {vrf}"},
-            "config":     "show configuration protocols ospf",
+            "config":     {"default": "show ospf overview",  "vrf": "show ospf overview instance {vrf}"},
             "interfaces": {"default": "show ospf interface", "vrf": "show ospf interface instance {vrf}"},
             "details":    {"default": "show ospf overview",  "vrf": "show ospf overview instance {vrf}"},
         },
         "bgp": {
             "summary":   {"default": "show bgp summary",        "vrf": "show bgp summary instance {vrf}"},
             "table":     {"default": "show route protocol bgp", "vrf": "show route protocol bgp table {vrf}.inet.0"},
-            "config":    "show configuration protocols bgp",
+            "config":    {"default": "show bgp summary",        "vrf": "show bgp summary instance {vrf}"},
             "neighbors": {"default": "show bgp neighbor",       "vrf": "show bgp neighbor instance {vrf}"},
         },
         "routing_table": {
             "ip_route":  {"default": "show route",              "vrf": "show route table {vrf}.inet.0"},
         },
         "routing_policies": {
             "redistribution":       "show configuration policy-options",
-            "route_maps":           "show configuration policy-options policy-statement",
-            "prefix_lists":         "show configuration policy-options prefix-list",
+            "route_maps":           "show configuration policy-options",
+            "prefix_lists":         "show configuration policy-options",
             "policy_based_routing": "show configuration routing-options",
             "access_lists":         "show configuration firewall",
         },
@@ -110,16 +110,16 @@
     "aos": {
         "ospf": {
             "neighbors":  {"default": "show ip ospf neighbors",      "vrf": "show ip ospf neighbors vrf {vrf}"},
-            "database":   {"default": "show ip ospf database",       "vrf": "show ip ospf database vrf {vrf}"},
+            "database":   {"default": "show ip ospf lsdb",       "vrf": "show ip ospf lsdb vrf {vrf}"},
             "borders":    {"default": "show ip ospf border-routers", "vrf": "show ip ospf border-routers vrf {vrf}"},
-            "config":     "show running-config",
+            "config":     {"default": "show ip ospf",                "vrf": "show ip ospf vrf {vrf}"},
             "interfaces": {"default": "show ip ospf interface",      "vrf": "show ip ospf interface vrf {vrf}"},
             "details":    {"default": "show ip ospf",                "vrf": "show ip ospf vrf {vrf}"},
         },
         "bgp": {
             "summary":   {"default": "show bgp ipv4 unicast summary",   "vrf": "show bgp vrf {vrf} ipv4 unicast summary"},
             "table":     {"default": "show bgp ipv4 unicast",           "vrf": "show bgp vrf {vrf} ipv4 unicast"},
-            "config":    "show running-config",
+            "config":    {"default": "show bgp ipv4 unicast",           "vrf": "show bgp vrf {vrf} ipv4 unicast"},
             "neighbors": {"default": "show bgp ipv4 unicast neighbors", "vrf": "show bgp vrf {vrf} ipv4 unicast neighbors"},
         },
         "routing_table": {
@@ -129,8 +129,8 @@
             "redistribution":       "show running-config",
             "route_maps":           "show route-map",
             "prefix_lists":         "show ip prefix-list",
-            "policy_based_routing": "show running-config",
-            "access_lists":         "show running-config",
+            "policy_based_routing": "show pbr summary",
+            "access_lists":         "show access-list",
         },
         "interfaces": {
             "interface_status": "show interface brief",

testing/live/conftest.py

@@ -4,9 +4,46 @@
 Sets up sys.path only. Tests in testing/live/ connect to real lab devices
 via the actual transport layer (SSH). Set NO_LAB=0 to enable.
 """
+import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 _ROOT = Path(__file__).resolve().parent.parent.parent
 if str(_ROOT) not in sys.path:
     sys.path.insert(0, str(_ROOT))
+
+
+@pytest.fixture(autouse=True, scope="session")
+def refresh_host_keys():
+    """Remove stale and scan fresh SSH host keys for all lab devices.
+
+    Containerlab regenerates device host keys on every restart. This fixture
+    runs once before any live test to keep ~/.ssh/known_hosts in sync, so
+    SSH_STRICT_HOST_KEY=True remains effective without manual intervention.
+    """
+    from core.inventory import devices
+
+    known_hosts = Path.home() / ".ssh" / "known_hosts"
+    known_hosts.parent.mkdir(mode=0o700, exist_ok=True)
+    known_hosts.touch(exist_ok=True)
+
+    hosts = [d["host"] for d in devices.values()]
+
+    # Remove all stale entries for lab IPs
+    for host in hosts:
+        subprocess.run(
+            ["ssh-keygen", "-R", host],
+            capture_output=True,
+        )
+
+    # Scan and append fresh keys for all devices in one pass
+    result = subprocess.run(
+        ["ssh-keyscan", "-T", "5"] + hosts,
+        capture_output=True,
+        text=True,
+    )
+    if result.stdout:
+        with known_hosts.open("a") as f:
+            f.write(result.stdout)

testing/live/test_platform_coverage.py

@@ -95,12 +95,28 @@ def classify_result(result) -> tuple[str, str]:
 
     raw = result.get("raw", "")
 
-    if isinstance(raw, str) and "% Invalid input" in raw:
-        return "FAIL", raw.strip()[:200]
+    if isinstance(raw, str):
+        stripped = raw.strip()
 
-    # IOS/EOS "% <msg>" = feature not configured → EMPTY (not a command error)
-    if isinstance(raw, str) and raw.strip().startswith("% "):
-        return "EMPTY", ""
+        # Empty output — device returned nothing meaningful
+        if not stripped:
+            return "EMPTY", ""
+
+        # IOS/EOS: "% Invalid input ..."
+        if "% Invalid input" in stripped:
+            return "FAIL", stripped[:200]
+
+        # AOS-CX: "Invalid input: <keyword>" (no % prefix)
+        if stripped.startswith("Invalid input"):
+            return "FAIL", stripped[:200]
+
+        # JunOS: "error: syntax error, ..." or "error: unknown command"
+        if stripped.startswith("error:"):
+            return "FAIL", stripped[:200]
+
+        # IOS/EOS "% <msg>" = feature not configured → EMPTY (not a command error)
+        if stripped.startswith("% "):
+            return "EMPTY", ""
 
     return "PASS", ""
 

testing/run_tests.sh

@@ -8,7 +8,7 @@ set -euo pipefail
 # Parse flags
 for arg in "$@"; do
     case "$arg" in
-        --live) NO_LAB=0 ;;
+        --live) export NO_LAB=0 ;;
     esac
 done
 
@@ -43,7 +43,7 @@ run_suite() {
     printf "  %-8s  %-55s  " "$suite_id" "$suite_name"
 
     local output
-    if output=$(cd "$PROJECT_ROOT" && $PYTEST "$suite_file" -v --tb=short -q 2>&1); then
+    if output=$(cd "$PROJECT_ROOT" && $PYTEST "$suite_file" -v --tb=short -q --timeout=60 2>&1); then
         printf "${GREEN}PASS${RESET}\n"
         PASS_COUNT=$((PASS_COUNT + 1))
     else
@@ -91,7 +91,7 @@ run_suite "IT-003" "testing/mock/integration/test_cli_orchestration.py"  "CLI or
 echo ""
 if [[ "${NO_LAB:-1}" == "0" ]]; then
     echo "  ── Live Device Tests ──────────────────────────────────────────"
-    run_suite "LT-001" "testing/live/test_platform_coverage.py" "Platform coverage (6 vendors, real SSH)"
+    run_suite "LT-001" "testing/live/test_platform_coverage.py" "Platform coverage (5 vendors, real SSH)"
 else
     printf "  ${YELLOW}Live tests skipped${RESET} — rerun with --live to include\n"
     SKIP_COUNT=$((SKIP_COUNT + 1))

transport/ssh.py

@@ -86,7 +86,7 @@ def _build_cli(device: dict, timeout_ops: int | None = None) -> Cli:
     elif SSH_STRICT_HOST_KEY:
         transport = BinOptions(enable_strict_key=True, known_hosts_path=_known_hosts)
     else:
-        transport = None
+        transport = BinOptions(enable_strict_key=False)
 
     return Cli(
         host=device["host"],