Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_security_gate_rc_metadata.py

@@ -0,0 +1,32 @@
+"""Guard the release security gate's exact RC metadata and runbook URL rules."""
+
+from __future__ import annotations
+
+import runpy
+from pathlib import Path
+
+import pytest
+
+GATE = runpy.run_path(str(Path(__file__).resolve().parents[2] / "scripts" / "security_gate.py"))
+
+
+def test_first_party_rc_wheel_version_matches_only_the_same_release() -> None:
+    matches = GATE["_matches_first_party_version"]
+
+    assert matches("1.3.0-rc.1", "1.3.0-rc.1")
+    assert matches("1.3.0rc1", "1.3.0-rc.1")
+    assert not matches("1.3.0rc2", "1.3.0-rc.1")
+    assert not matches("1.3.1rc1", "1.3.0-rc.1")
+    assert not matches(None, "1.3.0-rc.1")
+
+
+def test_web_bundle_allows_only_repository_runbook_context() -> None:
+    validate = GATE["_validate_non_api_origin_contexts"]
+    input_bytes = (
+        b"https://git.example.com/example/modelforge/"
+        b"src/branch/master/docs/operations/RUNBOOK_NODE_OFFLINE.md"
+    )
+
+    validate(input_bytes)
+    with pytest.raises(GATE["GateInputError"]):
+        validate(b"https://git.example.com/api/v1/tokens")