93 lines
5.0 KiB
Python
93 lines
5.0 KiB
Python
from __future__ import annotations
|
|
|
|
import re
|
|
import shlex
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def test_windows_wrapper_archives_every_file_required_by_root_installer():
|
|
installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
|
|
wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
|
|
|
|
required = re.search(r"source_paths=\(\s*(.*?)\n\)", installer, re.DOTALL)
|
|
archived = re.search(r"& git archive --format=tar .*? \$SourceRevision (.*?)\r?\n", wrapper)
|
|
assert required is not None and archived is not None
|
|
archive_paths = set(shlex.split(archived.group(1)))
|
|
required_paths = shlex.split(required.group(1))
|
|
assert all(
|
|
path in archive_paths
|
|
or any(path.startswith(f"{directory}/") for directory in archive_paths)
|
|
for path in required_paths
|
|
)
|
|
vendor_sources = sorted(
|
|
path.relative_to(ROOT).as_posix()
|
|
for path in (ROOT / "scripts/vendor").rglob("*")
|
|
if path.is_file() and (path.suffix == ".py" or path.name == "pyyaml-LICENSE")
|
|
)
|
|
required_vendor_sources = sorted(
|
|
path for path in required_paths if path.startswith("scripts/vendor/")
|
|
)
|
|
assert vendor_sources == required_vendor_sources
|
|
assert "scripts/prepare_controller_hub_release_volume.py" in archived.group(1)
|
|
assert "ops/gitea-deploy-broker/forge_first_install.py" in required_paths
|
|
assert "ops/gitea-deploy-broker/forge_database_credentials.py" in required_paths
|
|
assert "ops/gitea-deploy-broker/forge_backup_paths.py" in required_paths
|
|
assert "ops/gitea-deploy-broker/forge_secret_bundle.py" in required_paths
|
|
assert "scripts/upgrade_deployment_controller.sh" in archived.group(1)
|
|
assert "scripts/vendor" in archived.group(1)
|
|
assert "scripts/vendor/pyyaml-LICENSE" in required.group(1)
|
|
assert "scripts/vendor/yaml/__init__.py" in required.group(1)
|
|
assert 'mkdir -m 0700 "${work}/vendor" "${work}/vendor/yaml"' in installer
|
|
assert '"${work}/vendor/yaml/${vendor_file}"' in installer
|
|
assert ('[[ -d "${script_dir}/vendor" && ! -L "${script_dir}/vendor" && '
|
|
'-d "${script_dir}/vendor/yaml" && ! -L "${script_dir}/vendor/yaml" ]]') in installer
|
|
assert "forge_first_install.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
|
|
assert "forge_database_credentials.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
|
|
assert "forge_backup_paths.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
|
|
assert "forge_secret_bundle.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
|
|
|
|
|
|
def test_forge_first_install_module_is_bound_into_controller_release_and_config():
|
|
renderer = (ROOT / "scripts/prepare_controller_artifact.py").read_text(encoding="utf-8")
|
|
preparer = (ROOT / "scripts/prepare_controller_hub_release_volume.py").read_text(encoding="utf-8")
|
|
|
|
assert '"forge_first_install.py"' in renderer.split("_ARTIFACT_FILES = (", 1)[1].split(")", 1)[0]
|
|
release_files = preparer.split("RELEASE_FILES = (", 1)[1].split(")", 1)[0]
|
|
legacy_role_release_files = preparer.split(
|
|
"LEGACY_RELEASE_FILES_WITH_ROLE_HELPER = (", 1
|
|
)[1].split(")", 1)[0]
|
|
assert "'forge_first_install.py'" in legacy_role_release_files
|
|
assert "'forge_database_credentials.py'" in legacy_role_release_files
|
|
assert "*LEGACY_RELEASE_FILES_WITH_ROLE_HELPER" in release_files
|
|
assert "'forge_backup_paths.py'" in release_files
|
|
assert "'forge_secret_bundle.py'" in release_files
|
|
assert "'forge-first-install.json'" in preparer.split("CONFIG_FILES = {", 1)[1].split("}", 1)[0]
|
|
assert "'forge-bootstrap-secrets'" in preparer.split("CONFIG_SECRET_DIRS = {", 1)[1].split("}", 1)[0]
|
|
|
|
|
|
def test_windows_wrapper_supplies_private_archive_and_exact_image_identity():
|
|
wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
|
|
installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
|
|
|
|
assert "mktemp -d -p /tmp 'itworx-controller-artifact-promoter-" in wrapper
|
|
assert "^/tmp/itworx-controller-artifact-promoter-" in wrapper
|
|
assert '"chmod 600 \'$remoteArchive\' && chmod 700 \'$remoteScript\'' in wrapper
|
|
assert "docker inspect --format '{{.Image}}' gitea-deploy-control" in wrapper
|
|
assert "-cnotmatch '^sha256:[0-9a-f]{64}$'" in wrapper
|
|
assert "--image-id '$imageId'" in wrapper
|
|
assert "--image-id) image_id=\"$2\"" in installer
|
|
assert '[[ "$archive_parent" =~ ^/tmp/itworx-controller-artifact-promoter-' in installer
|
|
|
|
|
|
def test_state_reconciliation_is_committed_only_after_volume_verification():
|
|
installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
|
|
verify = installer.index('python3 "${work}/${PREPARER_NAME}" verify --backup "$backup"')
|
|
commit = installer.index(
|
|
'python3 "${work}/reconcile_controller_state.py" --journal-path "$migration_journal" --commit'
|
|
)
|
|
|
|
assert verify < commit
|
|
assert installer.index("reconciliation_active=0", commit) > commit
|