laily
681aa9e237
Keep DEB/Docker publish keys out of the project's .env. Scripts and check.py --ready only read .env.builder; empty values count as missing.
239 lines
9.1 KiB
Python
239 lines
9.1 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import os
|
|
import shutil
|
|
import subprocess
|
|
import tempfile
|
|
import unittest
|
|
from io import StringIO
|
|
from pathlib import Path
|
|
from unittest import mock
|
|
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[1]
|
|
SCRIPTS = REPO_ROOT / "skills" / "builder" / "scripts"
|
|
CHECK_PY = SCRIPTS / "check.py"
|
|
TEMPLATE = REPO_ROOT / "skills" / "builder" / "templates" / "makefile.builder"
|
|
|
|
spec = importlib.util.spec_from_file_location("builder_check", CHECK_PY)
|
|
assert spec is not None and spec.loader is not None
|
|
builder_check = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(builder_check)
|
|
|
|
|
|
def git(cwd: Path, *args: str) -> None:
|
|
result = subprocess.run(
|
|
["git", *args],
|
|
cwd=cwd,
|
|
text=True,
|
|
capture_output=True,
|
|
check=False,
|
|
env={
|
|
**os.environ,
|
|
"GIT_AUTHOR_NAME": "Test",
|
|
"GIT_AUTHOR_EMAIL": "test@example.com",
|
|
"GIT_COMMITTER_NAME": "Test",
|
|
"GIT_COMMITTER_EMAIL": "test@example.com",
|
|
},
|
|
)
|
|
if result.returncode != 0:
|
|
raise AssertionError(f"git {args} failed: {result.stderr}")
|
|
|
|
|
|
def init_repo(path: Path) -> None:
|
|
git(path, "init", "-b", "main")
|
|
git(path, "config", "user.email", "test@example.com")
|
|
git(path, "config", "user.name", "Test")
|
|
(path / "README").write_text("x\n", encoding="utf-8")
|
|
git(path, "add", "README")
|
|
git(path, "commit", "-m", "init")
|
|
|
|
|
|
def write_contract_makefile(project: Path) -> None:
|
|
text = TEMPLATE.read_text(encoding="utf-8")
|
|
text = text.replace(
|
|
"include $(HOME)/.pouch/skills/builder/scripts/version.mk",
|
|
f"include {SCRIPTS / 'version.mk'}",
|
|
)
|
|
(project / "makefile.builder").write_text(text, encoding="utf-8")
|
|
|
|
|
|
def run_check(
|
|
project: Path,
|
|
*flags: str,
|
|
env: dict[str, str] | None = None,
|
|
which: dict[str, str | None] | None = None,
|
|
) -> tuple[int, str]:
|
|
merged = os.environ.copy()
|
|
if env:
|
|
merged.update(env)
|
|
merged["BUILDER_SKILL_DIR"] = str(SCRIPTS.parent)
|
|
stdout = StringIO()
|
|
stderr = StringIO()
|
|
real_which = shutil.which
|
|
|
|
def fake_which(name: str, *args: object, **kwargs: object) -> str | None:
|
|
if which is not None and name in which:
|
|
return which[name]
|
|
return real_which(name)
|
|
|
|
with mock.patch.dict(os.environ, merged, clear=True):
|
|
with mock.patch("sys.stdout", stdout), mock.patch("sys.stderr", stderr):
|
|
with mock.patch.object(builder_check.shutil, "which", side_effect=fake_which):
|
|
code = builder_check.main([str(project), *flags])
|
|
return code, stdout.getvalue() + stderr.getvalue()
|
|
|
|
|
|
class BuilderCheckTests(unittest.TestCase):
|
|
def test_skill_documents_init_and_does_not_call_create_makefile(self) -> None:
|
|
skill = (REPO_ROOT / "skills" / "builder" / "SKILL.md").read_text(encoding="utf-8")
|
|
contract = (
|
|
REPO_ROOT / "skills" / "builder" / "references" / "contract.md"
|
|
).read_text(encoding="utf-8")
|
|
self.assertIn("## 初始化", skill)
|
|
self.assertIn("check.py", skill)
|
|
self.assertIn("--ready", skill)
|
|
self.assertIn("makefile.builder", skill)
|
|
self.assertIn(".env.builder", skill)
|
|
self.assertIn("不要改用户的 `Makefile`", skill)
|
|
self.assertIn("不要调用 create-makefile", skill)
|
|
self.assertIn("不要用 create-makefile", contract)
|
|
self.assertIn("makefile.builder", contract)
|
|
self.assertIn(".env.builder", contract)
|
|
self.assertIn("不要读取或改写用户 `.env`", contract)
|
|
|
|
def test_no_makefile_without_ready_is_usage_error(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
code, text = run_check(project)
|
|
self.assertEqual(code, 2)
|
|
self.assertIn("no makefile.builder", text)
|
|
|
|
def test_ready_without_makefile_fails_with_repair_hint(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
code, text = run_check(project, "--ready")
|
|
self.assertEqual(code, 1)
|
|
self.assertIn("[FAIL] 1. makefile.builder 存在", text)
|
|
self.assertIn("makefile.builder", text)
|
|
self.assertIn("RESULT: FAILED", text)
|
|
|
|
def test_contract_makefile_without_env_passes_build_and_skips_publish_keys(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
init_repo(project)
|
|
write_contract_makefile(project)
|
|
code, text = run_check(
|
|
project, "--ready", which={"dpkg-deb": "/usr/bin/dpkg-deb"}
|
|
)
|
|
self.assertEqual(code, 0, text)
|
|
self.assertIn("RESULT: PASSED", text)
|
|
self.assertIn("[SKIP] 11. 发布环境变量键名", text)
|
|
self.assertIn("DEB_SERVER_URL: MISSING", text)
|
|
self.assertIn("blocks publish, not build", text)
|
|
self.assertNotRegex(text, r"DEB_TOKEN: (?!MISSING|present).+")
|
|
|
|
def test_env_keys_present_without_printing_values(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
init_repo(project)
|
|
write_contract_makefile(project)
|
|
(project / ".env.builder").write_text(
|
|
"DEB_SERVER_URL=https://secret.example.com\n"
|
|
"DEB_TOKEN=super-secret-token-value\n"
|
|
"DEB_REPOSITORY=main\n",
|
|
encoding="utf-8",
|
|
)
|
|
code, text = run_check(
|
|
project, "--ready", which={"dpkg-deb": "/usr/bin/dpkg-deb"}
|
|
)
|
|
self.assertEqual(code, 0, text)
|
|
self.assertIn("DEB_SERVER_URL: present", text)
|
|
self.assertIn("DEB_TOKEN: present", text)
|
|
self.assertNotIn("super-secret-token-value", text)
|
|
self.assertNotIn("https://secret.example.com", text)
|
|
|
|
def test_user_dotenv_is_ignored(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
init_repo(project)
|
|
write_contract_makefile(project)
|
|
(project / ".env").write_text(
|
|
"DEB_SERVER_URL=https://user.example.com\n"
|
|
"DEB_TOKEN=user-env-secret-token\n"
|
|
"DEB_REPOSITORY=main\n",
|
|
encoding="utf-8",
|
|
)
|
|
code, text = run_check(
|
|
project, "--ready", which={"dpkg-deb": "/usr/bin/dpkg-deb"}
|
|
)
|
|
self.assertEqual(code, 0, text)
|
|
self.assertIn("DEB_SERVER_URL: MISSING", text)
|
|
self.assertNotIn("user-env-secret-token", text)
|
|
self.assertNotIn("https://user.example.com", text)
|
|
|
|
def test_empty_env_builder_values_count_as_missing(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
init_repo(project)
|
|
write_contract_makefile(project)
|
|
(project / ".env.builder").write_text(
|
|
"DEB_SERVER_URL=\nDEB_TOKEN=\nDEB_REPOSITORY=\n",
|
|
encoding="utf-8",
|
|
)
|
|
code, text = run_check(
|
|
project, "--ready", which={"dpkg-deb": "/usr/bin/dpkg-deb"}
|
|
)
|
|
self.assertEqual(code, 0, text)
|
|
self.assertIn("DEB_TOKEN: MISSING", text)
|
|
|
|
def test_ready_fails_when_docker_track_missing_docker(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
init_repo(project)
|
|
write_contract_makefile(project)
|
|
(project / "Dockerfile").write_text("FROM scratch\n", encoding="utf-8")
|
|
code, text = run_check(
|
|
project,
|
|
"--ready",
|
|
which={"docker": None, "dpkg-deb": "/usr/bin/dpkg-deb"},
|
|
)
|
|
self.assertEqual(code, 1, text)
|
|
self.assertIn("[FAIL] 10. 轨道工具链", text)
|
|
self.assertIn("docker: MISSING", text)
|
|
|
|
def test_user_makefile_does_not_satisfy_contract(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
(project / "Makefile").write_text(
|
|
"help:\n\t@echo user\nbuild:\n\t@echo user-build\n",
|
|
encoding="utf-8",
|
|
)
|
|
code, text = run_check(project, "--ready")
|
|
self.assertEqual(code, 1, text)
|
|
self.assertIn("no makefile.builder", text)
|
|
|
|
def test_user_makefile_is_ignored_when_builder_file_exists(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp:
|
|
project = Path(temp)
|
|
init_repo(project)
|
|
write_contract_makefile(project)
|
|
(project / "Makefile").write_text(
|
|
"TOKEN=super-secret-user-makefile-token\n"
|
|
"help:\n\t@echo hijacked\n"
|
|
"docker:\n\tdocker push example:latest\n",
|
|
encoding="utf-8",
|
|
)
|
|
code, text = run_check(
|
|
project, "--ready", which={"dpkg-deb": "/usr/bin/dpkg-deb"}
|
|
)
|
|
self.assertEqual(code, 0, text)
|
|
self.assertNotIn("super-secret-user-makefile-token", text)
|
|
self.assertNotIn("hijacked", text)
|
|
self.assertNotIn(":latest", text)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|