Publish curated Unraid-AppOps-Gateway source from ba66029223865607deddc234e283c11127324eb8

backend/tests/test_mcp_hub_release_candidates.py

@@ -54,6 +54,7 @@ def prepared(controller, tmp_path, monkeypatch):
     project = {
         "_mcp_hub_contract": controller.MCP_HUB_TOPOLOGY_CONTRACT,
         "_repository_path": str(tmp_path / "hub.git"),
+        "compose_project": controller.MCP_HUB_PROJECT,
         "_deployment_metadata": metadata,
         "_mcp_hub_source_date_epoch": "1790888863",
     }
@@ -89,6 +90,10 @@ def prepared(controller, tmp_path, monkeypatch):
         ref = f"fixture/{service}@sha256:" + f"{index:064x}"
         if service == "contextforge":
             ref = f"itworx-mcp-hub/contextforge-schema:{revision}"
+        elif service == "connector-ingestion":
+            repository = controller.MCP_HUB_OWNED_IMAGE_REPOSITORIES[service]
+            archive_ref = f"{repository}:{revision}-run-21531-attempt-2"
+            ref = f"{archive_ref}@sha256:" + f"{index:064x}"
         model["services"][service] = {"image": ref}
         vuln = {
             "SchemaVersion": 2,
@@ -142,6 +147,27 @@ def prepared(controller, tmp_path, monkeypatch):
     }
     candidate_sha = write("candidate.json", candidate)
     exceptions_sha = write("exceptions.json", {"exceptions": []})
+    write(
+        "import-receipt.json",
+        {
+            "schema": "itworx.mcp-hub-import-receipt/v1",
+            "repository": controller.MCP_HUB_REPOSITORY,
+            "sourceRevision": revision,
+            "sourceTree": metadata["tree"],
+            "workflowRunId": 21531,
+            "workflowRunAttempt": 2,
+            "artifactId": 882,
+            "artifactName": "hub-release-candidate-" + revision,
+            "artifactZipSha256": "1" * 64,
+            "manifestSha256": "2" * 64,
+            "dockerTarSha256": "3" * 64,
+            "candidateSha256": candidate_sha,
+            "draftExceptionsSha256": exceptions_sha,
+            "imageIds": {
+                service: image["imageId"] for service, image in images.items()
+            },
+        },
+    )
     write(
         "approval.json",
         {
@@ -162,8 +188,17 @@ def prepared(controller, tmp_path, monkeypatch):
         v["imageRef"]: {
             "Id": v["imageId"],
             "Config": {"User": "10001:10001", "Labels": dict(labels)},
+            **(
+                {
+                    "RepoDigests": [
+                        f"{controller.MCP_HUB_OWNED_IMAGE_REPOSITORIES['connector-ingestion']}@{v['imageRef'].rsplit('@', 1)[1]}"
+                    ]
+                }
+                if service == "connector-ingestion"
+                else {}
+            ),
         }
-        for v in images.values()
+        for service, v in images.items()
     }
     monkeypatch.setattr(controller, "inspect_image", lambda ref: facts.get(ref))
     return types.SimpleNamespace(
@@ -182,6 +217,9 @@ def prepared(controller, tmp_path, monkeypatch):
 def test_fresh_complete_candidate_freezes_metadata_and_checks_explicit_gate(
     controller, prepared
 ):
+    prepared.project["environment"] = {
+        "CONNECTOR_INGESTION_IMAGE": "attacker.invalid/connector:latest"
+    }
     result = controller.mcp_hub_load_release_candidate(
         prepared.project, prepared.revision
     )
@@ -191,6 +229,35 @@ def test_fresh_complete_candidate_freezes_metadata_and_checks_explicit_gate(
     controller.mcp_hub_require_candidate_images(
         prepared.project, prepared.model, prepared.revision
     )
+    binding = prepared.project["_mcp_hub_connector_ingestion_binding"]
+    environment = controller.deployment_environment(
+        prepared.project,
+        prepared.revision,
+        controller.MCP_HUB_REPOSITORY,
+        prepared.metadata,
+    )
+    assert environment["CONNECTOR_INGESTION_IMAGE"] == binding["imageRef"]
+
+
+@pytest.mark.parametrize("mutation", ["missing", "attempt", "image_id"])
+def test_import_receipt_is_required_and_binds_connector_ingestion_attempt(
+    controller, prepared, mutation
+):
+    path = prepared.directory / "import-receipt.json"
+    if mutation == "missing":
+        path.unlink()
+    else:
+        receipt = json.loads(path.read_text(encoding="utf-8"))
+        if mutation == "attempt":
+            receipt["workflowRunAttempt"] = 1
+        else:
+            receipt["imageIds"]["connector-ingestion"] = "sha256:" + "f" * 64
+        prepared.write("import-receipt.json", receipt)
+    with pytest.raises(controller.DeployError):
+        controller.mcp_hub_load_release_candidate(
+            prepared.project, prepared.revision
+        )
+    assert prepared.checks == []
 
 
 @pytest.mark.parametrize(
@@ -435,7 +502,8 @@ def test_compose_operations_pin_all_scanned_ids_without_changing_source_model(
 
     def compose(project):
         path = Path(project["_mcp_hub_image_override_file"])
-        assert path.stat().st_mode & 0o777 == 0o600
+        if controller.os.name != "nt":
+            assert path.stat().st_mode & 0o777 == 0o600
         observed.append((path, json.loads(path.read_text())))
         return prepared.directory, ["docker", "compose", "-f", str(path)]
 
@@ -775,6 +843,11 @@ def test_actual_high_findings_are_bound_to_current_service_tags(controller, prep
     }
     prepared.candidate["summarySha256"] = prepared.write("scan-summary.json", summary)
     candidate_sha = prepared.write("candidate.json", prepared.candidate)
+    receipt = json.loads(
+        (prepared.directory / "import-receipt.json").read_text(encoding="utf-8")
+    )
+    receipt["candidateSha256"] = candidate_sha
+    prepared.write("import-receipt.json", receipt)
     prepared.write(
         "approval.json",
         {
@@ -804,6 +877,11 @@ def test_fixable_high_findings_cannot_be_approved_around(controller, prepared):
         "vulnerability-web.json", report
     )
     candidate_sha = prepared.write("candidate.json", prepared.candidate)
+    receipt = json.loads(
+        (prepared.directory / "import-receipt.json").read_text(encoding="utf-8")
+    )
+    receipt["candidateSha256"] = candidate_sha
+    prepared.write("import-receipt.json", receipt)
     prepared.write(
         "approval.json",
         {