81 lines
3.0 KiB
Python
81 lines
3.0 KiB
Python
"""Keep publication credentials and builds behind the protected release trigger."""
|
|
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
CHECKOUT = "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
|
|
UPLOAD = "ChristopherHX/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2"
|
|
|
|
|
|
def release_job() -> dict:
|
|
workflow = yaml.safe_load(
|
|
(ROOT / ".gitea/workflows/managed-validation.yml").read_text(encoding="utf-8")
|
|
)
|
|
return workflow["jobs"]["release-images"]
|
|
|
|
|
|
def test_all_checkouts_use_the_canonical_authenticated_https_origin() -> None:
|
|
workflow = yaml.safe_load(
|
|
(ROOT / ".gitea/workflows/managed-validation.yml").read_text(encoding="utf-8")
|
|
)
|
|
checkouts = [
|
|
step
|
|
for job in workflow["jobs"].values()
|
|
for step in job["steps"]
|
|
if step.get("uses") == CHECKOUT
|
|
]
|
|
assert len(checkouts) == 2
|
|
for checkout in checkouts:
|
|
assert checkout["with"]["github-server-url"] == "https://gitea.example.com"
|
|
assert "token" not in checkout["with"]
|
|
|
|
|
|
def test_release_build_requires_successful_validation_and_exact_main_push() -> None:
|
|
job = release_job()
|
|
assert job["name"] == "release-images"
|
|
assert job["needs"] == ["full"]
|
|
assert job["if"] == (
|
|
"${{ gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' "
|
|
"&& gitea.repository == 'Jens/ITWorx_MCP_Hub' }}"
|
|
)
|
|
assert job["runs-on"] == "itworx-ci-build"
|
|
assert 0 < job["timeout-minutes"] <= 150
|
|
assert job["permissions"] == {"contents": "read", "actions": "read"}
|
|
assert "env" not in job and "container" not in job and "services" not in job
|
|
|
|
|
|
def test_release_credentials_only_reach_the_bounded_producer() -> None:
|
|
steps = release_job()["steps"]
|
|
assert len(steps) == 3
|
|
assert steps[0]["uses"] == CHECKOUT
|
|
assert steps[0]["with"]["persist-credentials"] is False
|
|
assert steps[0]["with"]["fetch-depth"] == 1
|
|
assert "env" not in steps[0] and "env" not in steps[2]
|
|
assert steps[1]["env"] == {
|
|
"GITEA_TOKEN": "${{ secrets.GITEA_TOKEN }}",
|
|
"HUB_RELEASE_REGISTRY_TOKEN": "${{ secrets.HUB_RELEASE_REGISTRY_TOKEN }}",
|
|
}
|
|
command = steps[1]["run"]
|
|
assert "set -euo pipefail" in command
|
|
assert "set -x" not in command and "docker login" not in command
|
|
assert 'python3 scripts/build_mcp_hub_release_images.py --revision "$GITHUB_SHA"' in command
|
|
assert "--prepare-security-bases" not in command
|
|
assert '--run-id "$GITHUB_RUN_ID"' in command
|
|
assert '--output "${RUNNER_TEMP}/hub-release-candidate-${GITHUB_SHA}"' in command
|
|
|
|
|
|
def test_release_artifact_is_pinned_uncompressed_and_cannot_overwrite() -> None:
|
|
upload = release_job()["steps"][2]
|
|
assert upload["uses"] == UPLOAD
|
|
assert "if" not in upload
|
|
assert upload["with"] == {
|
|
"name": "hub-release-candidate-${{ github.sha }}",
|
|
"path": "${{ runner.temp }}/hub-release-candidate-${{ github.sha }}/*",
|
|
"if-no-files-found": "error",
|
|
"retention-days": 90,
|
|
"compression-level": 0,
|
|
"overwrite": False,
|
|
}
|