Publish curated Unraid-AppOps-Gateway source from d013be0be977c530311fae02934026709d8a952f

backend/tests/test_runner_build_launcher_refresh.py

@@ -172,6 +172,12 @@ def launcher(monkeypatch, tmp_path):
     original = copy.deepcopy(containers["itworx-ci-build"])
 
     def docker(args, **_k):
+        if args[:2] == ["docker", "exec"]:
+            assert args == [
+                "docker", "exec", "-e", "DOCKER_HOST=" + module._DIND_DOCKER_HOST,
+                module.DIND_NAME, "docker", "ps", "-a", "-q",
+            ]
+            return ""
         if args[:3] == ["docker", "image", "inspect"]:
             return json.dumps([{"Id": args[-1]}])
         if args[:2] == ["docker", "inspect"]:
@@ -426,6 +432,43 @@ class Interrupted(BaseException):
     pass
 
 
+@pytest.mark.parametrize("operation", ["refresh", "recovery"])
+@pytest.mark.parametrize("inventory", ["stopped_container", "connection_failure"])
+def test_launcher_inventory_uses_trusted_socket_and_fails_closed(
+    launcher, monkeypatch, operation, inventory
+):
+    module, containers, rows, _, effects, _ = launcher
+    if operation == "recovery":
+        preflight = module._build_launcher_preflight("refresh")
+        module._apply_build_launcher("refresh", preflight["preflightSha256"])
+        receipt = module._build_launcher_receipt()
+        receipt["status"] = "created"
+        module._write_private_atomic(module._build_launcher_receipt_path(), module._canonical_bytes(receipt))
+    before = copy.deepcopy(containers), copy.deepcopy(rows)
+    effects.clear()
+    original = module._run
+
+    def inventory_result(args, **kwargs):
+        if args[:2] == ["docker", "exec"]:
+            assert args == [
+                "docker", "exec", "-e", "DOCKER_HOST=" + module._DIND_DOCKER_HOST,
+                module.DIND_NAME, "docker", "ps", "-a", "-q",
+            ]
+            if inventory == "connection_failure":
+                raise module.RunnerFleetSpecializeError("runner_fleet_specialization_command_failed")
+            return "f" * 64
+        return original(args, **kwargs)
+
+    monkeypatch.setattr(module, "_run", inventory_result)
+    with pytest.raises(module.RunnerFleetSpecializeError):
+        if operation == "recovery":
+            module._build_launcher_recovery_preflight()
+        else:
+            module._build_launcher_preflight("refresh")
+    assert effects == []
+    assert (containers, rows) == before
+
+
 @pytest.mark.parametrize(
     "point",
     ["backup", "prepared", "rename", "create", "created", "before_applied", "applied"],