Publish curated ITWorx_MCP_Hub source from 5d65966d0393e868ed5df1d95a21412a4c587d78

tests/test_release_images_workflow.py

@@ -0,0 +1,63 @@
+"""Keep publication credentials and builds behind the protected release trigger."""
+
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+CHECKOUT = "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
+UPLOAD = "ChristopherHX/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2"
+
+
+def release_job() -> dict:
+    workflow = yaml.safe_load(
+        (ROOT / ".gitea/workflows/managed-validation.yml").read_text(encoding="utf-8")
+    )
+    return workflow["jobs"]["release-images"]
+
+
+def test_release_build_requires_successful_validation_and_exact_main_push() -> None:
+    job = release_job()
+    assert job["name"] == "release-images"
+    assert job["needs"] == ["full"]
+    assert job["if"] == (
+        "${{ gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' "
+        "&& gitea.repository == 'Jens/ITWorx_MCP_Hub' }}"
+    )
+    assert job["runs-on"] == "itworx-ci-build"
+    assert 0 < job["timeout-minutes"] <= 150
+    assert job["permissions"] == {"contents": "read", "actions": "read"}
+    assert "env" not in job and "container" not in job and "services" not in job
+
+
+def test_release_credentials_only_reach_the_bounded_producer() -> None:
+    steps = release_job()["steps"]
+    assert len(steps) == 3
+    assert steps[0]["uses"] == CHECKOUT
+    assert steps[0]["with"]["persist-credentials"] is False
+    assert steps[0]["with"]["fetch-depth"] == 1
+    assert "env" not in steps[0] and "env" not in steps[2]
+    assert steps[1]["env"] == {
+        "GITEA_TOKEN": "${{ secrets.GITEA_TOKEN }}",
+        "HUB_RELEASE_REGISTRY_TOKEN": "${{ secrets.HUB_RELEASE_REGISTRY_TOKEN }}",
+    }
+    command = steps[1]["run"]
+    assert "set -euo pipefail" in command
+    assert "set -x" not in command and "docker login" not in command
+    assert 'python3 scripts/build_mcp_hub_release_images.py --revision "$GITHUB_SHA"' in command
+    assert '--run-id "$GITHUB_RUN_ID"' in command
+    assert '--output "${RUNNER_TEMP}/hub-release-candidate-${GITHUB_SHA}"' in command
+
+
+def test_release_artifact_is_pinned_uncompressed_and_cannot_overwrite() -> None:
+    upload = release_job()["steps"][2]
+    assert upload["uses"] == UPLOAD
+    assert "if" not in upload
+    assert upload["with"] == {
+        "name": "hub-release-candidate-${{ github.sha }}",
+        "path": "${{ runner.temp }}/hub-release-candidate-${{ github.sha }}/*",
+        "if-no-files-found": "error",
+        "retention-days": 90,
+        "compression-level": 0,
+        "overwrite": False,
+    }