Pytest Plugin

The Asqav SDK ships a pytest plugin that signs each test result during a run and writes a Merkle-rooted compliance bundle at the end. One flag, no conftest.py changes, one artifact ready for an auditor.

Install

pip install asqav

The plugin auto-registers via the SDK's pytest entry point. No extras flag needed.

Run

# Sign every test outcome and emit a bundle on session finish
ASQAV_API_KEY=sk_live_... pytest --asqav

# Custom output path, agent name, and framework
pytest --asqav \
  --asqav-agent ci-runner \
  --asqav-output out/compliance.json \
  --asqav-framework eu_ai_act_art12

If ASQAV_API_KEY is not set when --asqav is passed, pytest exits with a usage error rather than half-signing the run.

What it captures

The plugin signs each test outcome via agent.sign("test:result", context={...}) in the call phase. Every passed, failed, and skipped test ends up on the bundle. The signed context for each result carries:

• nodeid - the pytest test identifier (file plus test name).
• outcome - "passed", "failed", or "skipped".
• duration - the test's call-phase duration in seconds.
• framework - the compliance framework key for this run.

At session finish the plugin calls asqav.compliance.export_bundle(signatures, framework=...) and writes the bundle (with Merkle root) to --asqav-output.

Flags

• --asqav - enable the plugin for this run.
• --asqav-agent NAME - agent name used when signing test results. Default test-runner.
• --asqav-output PATH - bundle output path. Default audit-bundle.json.
• --asqav-framework NAME - compliance framework. Default soc2. See asqav compliance frameworks for the full list.

Programmatic API

If you have a custom test runner that signs results itself, build the same bundle without spinning up pytest:

from asqav.pytest_plugin import make_bundle_from_report

bundle = make_bundle_from_report(signatures, framework="soc2")
bundle.to_file("audit-bundle.json")

Notes

• A failed signature never masks a failed test. The exception is appended to the test's Asqav section, the test result stands on its own.
• The plugin is a no-op unless --asqav is passed, so committing the workflow change is safe even before CI has the API key.

Related

• GitHub Actions - drop-in CI workflow that pairs with this plugin.
• CLI Reference - asqav compliance export for non-pytest runners.
• Compliance Reports - framework definitions.