33 lines
1.0 KiB
Python
33 lines
1.0 KiB
Python
"""Guard the release security gate's exact RC metadata and runbook URL rules."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import runpy
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
GATE = runpy.run_path(str(Path(__file__).resolve().parents[2] / "scripts" / "security_gate.py"))
|
|
|
|
|
|
def test_first_party_rc_wheel_version_matches_only_the_same_release() -> None:
|
|
matches = GATE["_matches_first_party_version"]
|
|
|
|
assert matches("1.3.0-rc.1", "1.3.0-rc.1")
|
|
assert matches("1.3.0rc1", "1.3.0-rc.1")
|
|
assert not matches("1.3.0rc2", "1.3.0-rc.1")
|
|
assert not matches("1.3.1rc1", "1.3.0-rc.1")
|
|
assert not matches(None, "1.3.0-rc.1")
|
|
|
|
|
|
def test_web_bundle_allows_only_repository_runbook_context() -> None:
|
|
validate = GATE["_validate_non_api_origin_contexts"]
|
|
input_bytes = (
|
|
b"https://git.example.com/example/modelforge/"
|
|
b"src/branch/master/docs/operations/RUNBOOK_NODE_OFFLINE.md"
|
|
)
|
|
|
|
validate(input_bytes)
|
|
with pytest.raises(GATE["GateInputError"]):
|
|
validate(b"https://git.example.com/api/v1/tokens")
|