93 lines
3.8 KiB
Python
93 lines
3.8 KiB
Python
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def test_controller_promoter_action_is_fixed_and_registered():
|
|
registry = (ROOT / "backend/app/services/action_registry.py").read_text(encoding="utf-8")
|
|
execution = (ROOT / "backend/app/services/action_execution.py").read_text(encoding="utf-8")
|
|
assert "'controller.artifact.promote'" in registry
|
|
assert "return 'tower/deployment-controller'" in registry
|
|
assert 'action == "controller.artifact.promote"' in execution
|
|
assert 'target.strip().lower() != "tower/deployment-controller"' in execution
|
|
|
|
|
|
def test_controller_promoter_helper_spec_is_fixed_and_bounded():
|
|
from backend.app.services.controller_artifact_promoter import (
|
|
CONTROLLER_VERSION,
|
|
HELPER_NAME,
|
|
helper_container_spec,
|
|
)
|
|
|
|
revision = "a" * 40
|
|
image_id = "sha256:" + "b" * 64
|
|
spec = helper_container_spec(revision=revision, image_id=image_id)
|
|
|
|
assert HELPER_NAME == "itworx-controller-artifact-promoter"
|
|
assert CONTROLLER_VERSION == "2.1.13"
|
|
assert re.fullmatch(r"2\.1\.\d+", CONTROLLER_VERSION)
|
|
assert spec["Image"] == image_id
|
|
assert spec["HostConfig"]["Privileged"] is False
|
|
assert spec["HostConfig"]["NetworkMode"] == "host"
|
|
assert spec["HostConfig"]["SecurityOpt"] == ["no-new-privileges:true"]
|
|
assert set(spec["HostConfig"]["Binds"]) == {
|
|
"/mnt/cache:/mnt/cache",
|
|
"/mnt/user:/mnt/user",
|
|
"/srv/example/appdata/gitea/git/repositories:/gitea-repositories:ro",
|
|
"/var/lib/docker:/var/lib/docker:ro",
|
|
"/var/run/docker.sock:/var/run/docker.sock",
|
|
}
|
|
assert spec["Cmd"][:2] == ["/bin/bash", "-lc"]
|
|
command = spec["Cmd"][2]
|
|
assert "scripts/upgrade_deployment_controller.sh" in command
|
|
assert "UPGRADE_DEPLOYMENT_CONTROLLER_V2" in command
|
|
assert revision in command
|
|
assert CONTROLLER_VERSION in command
|
|
assert "/gitea-repositories/jens/unraid-appops-gateway.git" in command
|
|
assert f"itworx-controller-artifact-promoter-{revision[:12]}.XXXXXX" in command
|
|
assert "work='/mnt/cache" not in command
|
|
assert "rm -rf -- \"$work\"" in command
|
|
assert "chmod 0600 \"$work/controller.tar\"" in command
|
|
assert "scripts/prepare_controller_hub_release_volume.py" in command
|
|
archive_start = command.index('git --git-dir="$repo" archive')
|
|
archive_end = command.index('> "$work/controller.tar"', archive_start)
|
|
assert "scripts/vendor" in command[archive_start:archive_end]
|
|
assert "scripts/upgrade_deployment_controller.sh > \"$work/controller.tar\"" in command
|
|
assert f"--image-id '{image_id}'" in command
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"revision,image_id",
|
|
[
|
|
("main", "sha256:" + "b" * 64),
|
|
("a" * 39, "sha256:" + "b" * 64),
|
|
("a" * 40, "ubuntu:latest"),
|
|
("a" * 40, "sha256:" + "z" * 64),
|
|
],
|
|
)
|
|
def test_controller_promoter_rejects_mutable_or_invalid_identity(revision: str, image_id: str):
|
|
from backend.app.services.controller_artifact_promoter import helper_container_spec
|
|
|
|
with pytest.raises(ValueError):
|
|
helper_container_spec(revision=revision, image_id=image_id)
|
|
|
|
|
|
def test_controller_promoter_uses_only_protected_main_and_push_gate():
|
|
source = (ROOT / "backend/app/services/controller_artifact_promoter.py").read_text(encoding="utf-8")
|
|
assert 'branch = "main"' in source
|
|
assert 'REQUIRED_PUSH_CONTEXT = "Managed validation / full (push)"' in source
|
|
assert "controller_promoter_main_not_validated" in source
|
|
assert "caller_revision" not in source
|
|
|
|
|
|
def test_deployment_broker_exposes_bounded_controller_health():
|
|
source = (ROOT / "backend/app/services/deployment_broker.py").read_text(encoding="utf-8")
|
|
assert "def controller_health(self)" in source
|
|
assert 'f"{self.base_url}/health"' in source
|
|
assert "_MAX_CONTROLLER_HEALTH_BYTES" in source
|