Remove exec permissions from all test files and add CI check to enforce moving forward

.github/check_file_permissions.py

@@ -0,0 +1,73 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Check testfiles data directory for non-executable permissions.
+"""
+
+import sys
+import logging
+import argparse
+import subprocess
+from pathlib import Path
+
+logger = logging.getLogger("capa.tests.data")
+
+
+def main(argv=None):
+    if argv is None:
+        argv = sys.argv[1:]
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("testfiles", type=str, help="Path to tests/data repository root")
+    args = parser.parse_args(args=argv)
+
+    test_failed = check_permissions(Path(args.testfiles))
+    if test_failed:
+        return 1
+    else:
+        logger.info("test file permissions look good!")
+        return 0
+
+
+def check_permissions(testfiles_path: Path) -> bool:
+    """
+    Ensure all files in the testfiles repository are tracked in Git as non-executable (100644).
+    """
+    test_failed = False
+    try:
+        output = subprocess.check_output(
+            ["git", "ls-files", "-s"],
+            cwd=testfiles_path,
+            text=True,
+        )
+        for line in output.splitlines():
+            if not line:
+                continue
+
+            # Git format: <mode> <hash> <stage>\t<filename>
+            header, _, filename = line.partition("\t")
+            mode = header.split(" ", 1)[0]
+
+            if mode == "100755":
+                logger.error("file tracked as executable (100755): %s", filename.strip('"'))
+                test_failed = True
+    except (subprocess.SubprocessError, FileNotFoundError) as e:
+        logger.warning("could not verify git file modes: %s", e)
+
+    return test_failed
+
+
+if __name__ == "__main__":
+    logging.basicConfig(level=logging.INFO)
+    sys.exit(main())

.github/check_runtimes.py

@@ -22,6 +22,7 @@
 from pathlib import Path
 
 import capa.main
+from capa.main import E_FILE_LIMITATION
 
 logger = logging.getLogger("capa.tests.data")
 
@@ -49,19 +50,22 @@ def main(argv=None):
             continue
 
         time0 = time.time()
-        capa_ret = capa.main.main(["-q", "-v", "-d", str(file)])
-        diff = time.time() - time0
+        try:
+            capa_ret = capa.main.main(["-q", "-v", "-d", str(file)])
+            diff = time.time() - time0
 
-        if capa_ret:
-            logger.info("capa failed on file %s", file)
+            if capa_ret not in (0, E_FILE_LIMITATION):
+                logger.error("capa failed on file %s with return code %s", file, capa_ret)
+                test_failed = True
+            elif diff > THRESHOLD:
+                logger.error("capa ran for %s seconds on %s, please provide a different sample so we can test more quickly", diff, file)
+                test_failed = True
+            else:
+                logger.info("all good, capa ran for %.2f seconds on %s", diff, file)
+        except Exception as e:
+            logger.error("capa encountered an exception on file %s: %s", file, e, exc_info=True)
             test_failed = True
 
-        if diff > THRESHOLD:
-            logger.info("capa ran for %s seconds, please provide a different sample so we can test more quickly", diff)
-            test_failed = True
-        else:
-            logger.info("all good, capa ran for %s seconds", diff)
-
     if test_failed:
         return 1
     else:

.github/workflows/tests.yml

@@ -22,6 +22,18 @@ jobs:
         python-version: '3.10'
     - name: Test repository files
       run: python .github/check_sample_filenames.py .
+  # file permission consistency
+  test_permissions:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout testfiles repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - name: Set up Python 3.10
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.10'
+    - name: Test repository file permissions
+      run: python .github/check_file_permissions.py .
   # to allow quicker tests, capa should run less than THRESHOLD seconds on added/modified test files
   test_runtime:
     runs-on: ubuntu-latest

README.md

@@ -26,3 +26,7 @@ We use the following conventions to organize the capa test data.
   - `/dotnet`: .NET test binaries
   - `/sigs`: test signatures
   - `/source`: source language test files e.g. C# and Python
+
+## File permissions
+All files in this repository must be tracked in Git with non-executable permissions (`100644`).
+Do not set the executable bit (`+x` / `100755`) on any test files or test scripts.