Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/tests/test_controller_artifact_promoter.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import re
+import shlex
 from pathlib import Path
 
 import pytest
@@ -8,6 +9,22 @@ import pytest
 ROOT = Path(__file__).resolve().parents[2]
 
 
+def test_promoter_archive_covers_every_required_installer_source():
+    from backend.app.services.controller_artifact_promoter import helper_container_spec
+
+    spec = helper_container_spec(revision="a" * 40, image_id="sha256:" + "b" * 64)
+    command = spec["Cmd"][2].replace("\\\n", " ")
+    archive = re.search(r'archive --format=tar "\$revision"(.*?)> "\$work/controller.tar"', command, re.S)
+    assert archive is not None
+    packaged = shlex.split(archive.group(1))
+    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
+    required_block = re.search(r"(?m)^source_paths=\(\n(.*?)\n\)", installer, re.S)
+    assert required_block is not None
+    required = shlex.split(required_block.group(1))
+    assert required
+    assert all(any(path == prefix or path.startswith(prefix + "/") for prefix in packaged) for path in required)
+
+
 def test_controller_promoter_action_is_fixed_and_registered():
     registry = (ROOT / "backend/app/services/action_registry.py").read_text(encoding="utf-8")
     execution = (ROOT / "backend/app/services/action_execution.py").read_text(encoding="utf-8")
@@ -28,39 +45,103 @@ def test_controller_promoter_helper_spec_is_fixed_and_bounded():
     image_id = "sha256:" + "b" * 64
     spec = helper_container_spec(revision=revision, image_id=image_id)
 
-    assert HELPER_NAME == "itworx-controller-artifact-promoter"
-    assert CONTROLLER_VERSION == "2.1.13"
+    assert HELPER_NAME == "itworx-controller-artifact-promoter-modern"
+    assert CONTROLLER_VERSION == "2.1.14"
     assert re.fullmatch(r"2\.1\.\d+", CONTROLLER_VERSION)
     assert spec["Image"] == image_id
     assert spec["HostConfig"]["Privileged"] is False
     assert spec["HostConfig"]["NetworkMode"] == "host"
     assert spec["HostConfig"]["SecurityOpt"] == ["no-new-privileges:true"]
+    assert spec["HostConfig"]["ReadonlyRootfs"] is True
+    assert spec["HostConfig"]["PidsLimit"] <= 128
+    assert spec["HostConfig"]["Memory"] <= 1024 * 1024 * 1024
+    assert spec["HostConfig"]["CpuQuota"] <= spec["HostConfig"]["CpuPeriod"]
+    assert set(spec["HostConfig"]["Tmpfs"]) == {"/tmp"}
     assert set(spec["HostConfig"]["Binds"]) == {
         "/mnt/cache:/mnt/cache",
         "/mnt/user:/mnt/user",
-        "/srv/example/appdata/gitea/git/repositories:/gitea-repositories:ro",
         "/var/lib/docker:/var/lib/docker:ro",
+        "/srv/example/appdata/gitea/git/repositories:/gitea-repositories:ro",
         "/var/run/docker.sock:/var/run/docker.sock",
     }
     assert spec["Cmd"][:2] == ["/bin/bash", "-lc"]
     command = spec["Cmd"][2]
-    assert "scripts/upgrade_deployment_controller.sh" in command
-    assert "UPGRADE_DEPLOYMENT_CONTROLLER_V2" in command
-    assert revision in command
-    assert CONTROLLER_VERSION in command
-    assert "/gitea-repositories/jens/unraid-appops-gateway.git" in command
+    assert "mktemp -d -p /tmp itworx-controller-artifact-promoter-" in command
     assert f"itworx-controller-artifact-promoter-{revision[:12]}.XXXXXX" in command
+    assert "/mnt/cache/appdata/gitea-deploy-runners/.controller-promoter-" not in command
     assert "work='/mnt/cache" not in command
     assert "rm -rf -- \"$work\"" in command
+    assert "scripts/upgrade_deployment_controller.sh > \"$work/controller.tar\"" in command
     assert "chmod 0600 \"$work/controller.tar\"" in command
     assert "scripts/prepare_controller_hub_release_volume.py" in command
+    assert "scripts/run_repopulse_adoption.py" in command
+    assert "UPGRADE_DEPLOYMENT_CONTROLLER_V2" in command
+    assert revision in command
+    assert "--image-id" in command
+    assert CONTROLLER_VERSION in command
+    assert "version='2.1.14'" in command
+    assert "/gitea-repositories/jens/unraid-appops-gateway.git" in command
     archive_start = command.index('git --git-dir="$repo" archive')
     archive_end = command.index('> "$work/controller.tar"', archive_start)
     assert "scripts/vendor" in command[archive_start:archive_end]
     assert "scripts/upgrade_deployment_controller.sh > \"$work/controller.tar\"" in command
-    assert f"--image-id '{image_id}'" in command
+    assert '--image-id "$image_id"' in command
 
 
+def test_controller_promoter_bootstrap_child_spec_binds_legacy_target_identity():
+    from backend.app.services.controller_artifact_promoter import helper_container_spec
+
+    revision = "a" * 40
+    image_id = "sha256:" + "b" * 64
+    target_id = "c" * 64
+    target_revision = "d" * 40
+    target_tree = "e" * 40
+    spec = helper_container_spec(
+        revision=revision,
+        image_id=image_id,
+        current_controller_id=target_id,
+        current_controller_revision=target_revision,
+        current_controller_tree=target_tree,
+        current_controller_version="2.1.12",
+    )
+
+    assert spec["Image"] == image_id
+    assert spec["Labels"] == {
+        "itworx.controller.promoter": "true",
+        "itworx.source.repository": "jens/unraid-appops-gateway",
+        "itworx.source.revision": revision,
+        "itworx.controller.version": "2.1.14",
+        "itworx.controller.bootstrap.target.id": target_id,
+        "itworx.controller.bootstrap.target.image": image_id,
+        "itworx.controller.bootstrap.target.revision": target_revision,
+        "itworx.controller.bootstrap.target.tree": target_tree,
+        "itworx.controller.bootstrap.target.version": "2.1.12",
+    }
+
+
+def test_controller_promoter_rejects_partial_or_mutable_bootstrap_binding():
+    from backend.app.services.controller_artifact_promoter import helper_container_spec
+
+    base = {"revision": "a" * 40, "image_id": "sha256:" + "b" * 64}
+    with pytest.raises(ValueError):
+        helper_container_spec(**base, current_controller_id="c" * 64)
+    with pytest.raises(ValueError):
+        helper_container_spec(
+            **base,
+            current_controller_id="c" * 64,
+            current_controller_revision="../controller",
+            current_controller_tree="e" * 40,
+            current_controller_version="2.1.12",
+        )
+    with pytest.raises(ValueError):
+        helper_container_spec(
+            **base,
+            current_controller_id="../controller",
+            current_controller_revision="d" * 40,
+            current_controller_tree="e" * 40,
+            current_controller_version="2.1.12",
+        )
+
 @pytest.mark.parametrize(
     "revision,image_id",
     [