Jens/ModelForge-Public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

Browse Source
This commit is contained in:
Public Source Publisher committed 2026-09-30 09:23:17 +00:00
1 parent 7082ab955a
commit 848f0d8f8a
434 files changed
+67298 -4315
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitea/tests/test_rc_acceptance_policy.py
+157 -4
View File
@@ -2,13 +2,15 @@
from __future__ import annotations
import subprocess
import importlib.util
import json
import os
import signal
import subprocess
import tempfile
import unittest
from pathlib import Path
from unittest import mock
ROOT = Path(__file__).resolve().parents[2]
WORKFLOW = ROOT / ".gitea" / "workflows" / "public-candidate-acceptance.yml"
@@ -39,9 +41,23 @@ class RcAcceptancePolicyTests(unittest.TestCase):
def test_exact_source_and_docker_are_required(self) -> None:
self.assertIn(r"^[0-9a-f]{40}$", self.workflow)
self.assertIn("ref: ${{ inputs.source_commit }}", self.workflow)
self.assertIn("--canonical-source-commit", self.workflow)
self.assertIn('"--canonical-source-commit", canonical_commit', self.acceptance)
self.assertIn('"source_commit": canonical_commit', self.acceptance)
self.assertIn("docker version", self.workflow)
self.assertNotIn("SKIPPED: no docker", self.workflow)
def test_optional_candidate_freeze_retains_only_a_verified_transport_bundle(self) -> None:
self.assertIn("retain_image_bundle:", self.workflow)
self.assertIn("RETAIN_IMAGE_BUNDLE: ${{ inputs.retain_image_bundle }}", self.workflow)
self.assertIn("--retain-image-bundle", self.workflow)
self.assertIn("--image-bundle", self.acceptance)
self.assertIn("acceptance-evidence/release/*.tar", self.workflow)
self.assertIn("acceptance-evidence/release/*.tar.gz", self.workflow)
self.assertIn("atexit.register(cleanup_candidate_images", self.acceptance)
self.assertIn('canonical_commit="${{ inputs.source_commit }}"', self.workflow)
self.assertNotIn("candidate_commit=", self.workflow)
def test_security_tools_are_downloaded_with_exact_checksums(self) -> None:
self.assertIn("GITLEAKS_VERSION: 8.30.1", self.workflow)
self.assertIn(
@@ -78,18 +94,38 @@ class RcAcceptancePolicyTests(unittest.TestCase):
self.assertIn("apt-get purge --yes linux-libc-dev", self.runtime_dockerfile)
self.assertNotIn("apt-get autoremove", self.runtime_dockerfile)
self.assertIn("pip check", self.runtime_dockerfile)
self.assertIn("python -m pip uninstall --yes pip setuptools wheel", self.runtime_dockerfile)
for dependency in (
"filelock==3.20.3",
"h2==4.4.1",
"idna==3.15",
"lief==0.17.2",
"Pillow==12.3.0",
"Pygments==2.20.0",
"protobuf==5.29.6",
"requests==2.33.0",
"sentencepiece==0.2.2",
"sentence-transformers==6.0.1",
"transformers==5.16.1",
"urllib3==2.7.0",
):
self.assertIn(dependency, self.runtime_pyproject)
self.assertNotIn("'filelock==3.20.3'", self.runtime_dockerfile)
def test_runtime_worker_has_only_group_read_access_to_the_agent_credential(self) -> None:
self.assertIn(
"groupadd --system --gid 101 modelforge-agent", self.runtime_dockerfile
)
self.assertIn(
"--groups modelforge-agent --home /app modelforge-runtime",
self.runtime_dockerfile,
)
def test_compose_project_is_isolated_and_always_removed(self) -> None:
self.assertIn('project = f"modelforge-rc-', self.acceptance)
self.assertIn('project = f"modelforge-validation-', self.acceptance)
self.assertIn('"MODELFORGE_SOURCE_REFERENCE": "validation-acceptance"', self.acceptance)
self.assertIn('project="modelforge-validation-${suffix}"', self.workflow)
self.assertNotIn('project = f"modelforge-rc-', self.acceptance)
self.assertIn('"MODELFORGE_API_BIND": "127.0.0.1"', self.acceptance)
self.assertIn('"MODELFORGE_API_PUBLISHED_PORT": "0"', self.acceptance)
self.assertIn('"production_changed": False', self.acceptance)
@@ -100,6 +136,123 @@ class RcAcceptancePolicyTests(unittest.TestCase):
self.assertNotIn("docker-compose.runtime-worker.yml", self.acceptance)
self.assertNotIn("docker-compose.node-agent.yml", self.acceptance)
def test_acceptance_override_disables_restarts_for_every_service(self) -> None:
spec = importlib.util.spec_from_file_location("rc_server_acceptance", ACCEPTANCE)
assert spec and spec.loader
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
write_override = getattr(module, "write_acceptance_compose_override", None)
self.assertIsNotNone(
write_override,
"acceptance must expose the same override writer used by the RC run",
)
with tempfile.TemporaryDirectory() as directory:
override = Path(directory) / "acceptance-compose.override.yml"
write_override(override)
env = os.environ.copy()
env.update(
{
"MODELFORGE_VERSION": "9.9.9-test",
"MODELFORGE_COMMIT": "a" * 40,
"MODELFORGE_BUILT_AT": "2099-01-01T00:00:00+00:00",
"MODELFORGE_POSTGRES_DB": "modelforge_validation_test",
"MODELFORGE_POSTGRES_ADMIN_PASSWORD": "admin-test-password",
"MODELFORGE_MIGRATION_DB_PASSWORD": "owner-test-password",
"MODELFORGE_RUNTIME_DB_PASSWORD": "runtime-test-password",
"MODELFORGE_MIGRATION_DATABASE_URL": (
"postgresql+psycopg://modelforge:owner-test-password@"
"postgres:5432/modelforge_validation_test"
),
"MODELFORGE_RUNTIME_DATABASE_URL": (
"postgresql+psycopg://modelforge_runtime:runtime-test-password@"
"postgres:5432/modelforge_validation_test"
),
"MODELFORGE_BACKUP_ENCRYPTION_KEY": "acceptance-test-key",
"MODELFORGE_CORS_ORIGINS": "https://modelforge.example.test",
"VITE_API_BASE_URL": "https://modelforge.example.test",
}
)
result = subprocess.run(
[
"docker",
"compose",
"-f",
str(ROOT / "docker-compose.yml"),
"-f",
str(ROOT / "docker-compose.production.yml"),
"-f",
str(override),
"config",
"--format",
"json",
],
cwd=ROOT,
env=env,
text=True,
capture_output=True,
check=False,
)
self.assertEqual(result.returncode, 0, result.stderr)
services = json.loads(result.stdout)["services"]
self.assertTrue(services)
self.assertEqual(
{name: service.get("restart") for name, service in services.items()},
{name: "no" for name in services},
)
def test_compose_cleanup_runs_when_acceptance_receives_sigterm(self) -> None:
spec = importlib.util.spec_from_file_location("rc_server_acceptance_cleanup", ACCEPTANCE)
assert spec and spec.loader
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
managed_cleanup = getattr(module, "managed_compose_cleanup", None)
self.assertIsNotNone(
managed_cleanup,
"acceptance must guard its RC project with interruption-safe cleanup",
)
compose = ("docker", "compose", "-p", "modelforge-validation-test")
env = {"COMPOSE_PROJECT_NAME": "modelforge-validation-test"}
commands: list[tuple[tuple[str, ...], dict[str, object]]] = []
registered: list[object] = []
unregistered: list[object] = []
handlers: dict[int, object] = {}
def fake_run(*args: str, **kwargs: object) -> str:
commands.append((args, kwargs))
return ""
def fake_signal(signum: int, handler: object) -> object:
previous = handlers.get(signum, signal.SIG_DFL)
handlers[signum] = handler
return previous
with (
mock.patch.object(module, "run", side_effect=fake_run),
mock.patch.object(module.atexit, "register", side_effect=registered.append),
mock.patch.object(module.atexit, "unregister", side_effect=unregistered.append),
mock.patch.object(module.signal, "signal", side_effect=fake_signal),
self.assertRaises(SystemExit) as raised,
managed_cleanup(compose, env),
):
handler = handlers[signal.SIGTERM]
assert callable(handler)
handler(signal.SIGTERM, None)
self.assertEqual(raised.exception.code, 128 + signal.SIGTERM)
self.assertEqual(
commands,
[
(
compose + ("down", "--volumes", "--remove-orphans"),
{"env": env, "check": False},
)
],
)
self.assertEqual(len(registered), 1)
self.assertEqual(unregistered, registered)
def test_clean_install_bootstraps_roles_across_a_remote_docker_daemon(self) -> None:
self.assertIn("def provision_database_roles(", self.acceptance)
self.assertIn('run("docker", "cp", str(bootstrap)', self.acceptance)
@@ -152,7 +305,7 @@ class RcAcceptancePolicyTests(unittest.TestCase):
self.assertNotIn("docker system prune", cleanup)
def test_python_entrypoints_compile(self) -> None:
for path in (ACCEPTANCE, TRIVY_VALIDATOR):
for path in (ACCEPTANCE, TRIVY_VALIDATOR, ROOT / "scripts" / "release_build.py"):
result = subprocess.run(
["python", "-m", "py_compile", str(path)],
capture_output=True,