feat(governance): expose gitea private inventory p0 readback
This commit is contained in:
Your Name
@@ -4,9 +4,7 @@ from fastapi import FastAPI
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
from src.api.v1.agents import router
|
||||
from src.services.awoooi_production_deploy_readback_blocker import (
|
||||
load_latest_awoooi_production_deploy_readback_blocker,
|
||||
)
|
||||
from src.services.delivery_closure_workbench import load_delivery_closure_workbench
|
||||
|
||||
|
||||
def test_delivery_closure_workbench_endpoint_returns_product_summary():
|
||||
@@ -18,637 +16,125 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
_assert_delivery_workbench_shape(data)
|
||||
|
||||
|
||||
def test_delivery_closure_workbench_uses_gitea_private_inventory_lane():
|
||||
payload = load_delivery_closure_workbench()
|
||||
|
||||
_assert_delivery_workbench_shape(payload)
|
||||
lanes = {lane["id"]: lane for lane in payload["lanes"]}
|
||||
sources = {source["id"]: source for source in payload["source_statuses"]}
|
||||
|
||||
assert "github" not in lanes
|
||||
assert "github_private_backup" not in sources
|
||||
assert lanes["gitea_private_inventory"]["source_id"] == (
|
||||
"gitea_private_inventory_p0_scorecard"
|
||||
)
|
||||
assert lanes["gitea_private_inventory"]["blocker_count"] == 4
|
||||
assert lanes["gitea_private_inventory"]["completion_percent"] == 60
|
||||
assert lanes["gitea_private_inventory"]["metric"]["kind"] == "private_inventory"
|
||||
assert lanes["gitea_private_inventory"]["metric"]["workplan_id"] == "P0-003"
|
||||
assert lanes["gitea_private_inventory"]["metric"]["private_inventory_source"] == "gitea"
|
||||
assert lanes["gitea_private_inventory"]["metric"]["gitea_repo_inventory_status"] == "partial"
|
||||
assert lanes["gitea_private_inventory"]["metric"]["gitea_visibility_scope"] == "public_only"
|
||||
assert lanes["gitea_private_inventory"]["metric"]["expected_product_count"] == 11
|
||||
assert lanes["gitea_private_inventory"]["metric"]["present_product_row_count"] == 11
|
||||
assert lanes["gitea_private_inventory"]["metric"]["missing_product_row_count"] == 0
|
||||
assert (
|
||||
lanes["gitea_private_inventory"]["metric"][
|
||||
"github_lane_excluded_from_p0_blocker_count"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert "gitea_authenticated_inventory_payload_not_accepted" in lanes[
|
||||
"gitea_private_inventory"
|
||||
]["metric"]["active_blockers"]
|
||||
assert lanes["gitea_private_inventory"]["next_action"] == (
|
||||
"obtain_gitea_authenticated_or_admin_export_redacted_inventory_payload_"
|
||||
"then_validate_import_acceptance_and_owner_attestation"
|
||||
)
|
||||
|
||||
|
||||
def _assert_delivery_workbench_shape(data: dict):
|
||||
assert data["schema_version"] == "delivery_closure_workbench_v1"
|
||||
assert data["summary"]["source_count"] == 7
|
||||
assert data["summary"]["loaded_source_count"] == 7
|
||||
assert data["summary"]["runtime_execution_authorized"] is False
|
||||
assert data["summary"]["remote_write_authorized"] is True
|
||||
assert data["summary"]["repo_creation_authorized"] is True
|
||||
assert data["summary"]["visibility_change_authorized"] is True
|
||||
assert data["summary"]["refs_sync_authorized"] is True
|
||||
assert data["summary"]["workflow_trigger_authorized"] is True
|
||||
assert data["summary"]["remote_write_authorized"] is False
|
||||
assert data["summary"]["repo_creation_authorized"] is False
|
||||
assert data["summary"]["visibility_change_authorized"] is False
|
||||
assert data["summary"]["refs_sync_authorized"] is False
|
||||
assert data["summary"]["workflow_trigger_authorized"] is False
|
||||
assert data["summary"]["github_global_freeze_enabled"] is True
|
||||
assert data["summary"]["github_lane_status"] == "stopped_retired_do_not_use"
|
||||
assert data["summary"]["github_lane_excluded_from_p0_blocker_count"] is True
|
||||
assert data["summary"]["github_blocked_preflight_target_count"] == 0
|
||||
assert data["summary"]["github_operator_unblock_required"] is False
|
||||
assert data["summary"]["gitea_private_inventory_status"] == (
|
||||
"blocked_waiting_gitea_authenticated_or_owner_export_inventory"
|
||||
)
|
||||
assert data["summary"]["gitea_private_inventory_workplan_id"] == "P0-003"
|
||||
assert data["summary"]["gitea_private_inventory_source"] == "gitea"
|
||||
assert data["summary"]["gitea_private_inventory_review_readiness_percent"] == 60
|
||||
assert data["summary"]["gitea_private_inventory_active_blocker_count"] == 4
|
||||
assert data["summary"]["gitea_private_inventory_repo_inventory_status"] == "partial"
|
||||
assert data["summary"]["gitea_private_inventory_visibility_scope"] == "public_only"
|
||||
assert data["summary"]["gitea_private_inventory_expected_product_count"] == 11
|
||||
assert data["summary"]["gitea_private_inventory_present_product_row_count"] == 11
|
||||
assert data["summary"]["gitea_private_inventory_missing_product_row_count"] == 0
|
||||
assert data["summary"]["gitea_private_inventory_accepted_payload_count"] == 0
|
||||
assert (
|
||||
data["summary"][
|
||||
"gitea_private_inventory_owner_coverage_attestation_received_count"
|
||||
]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"gitea_private_inventory_all_active_product_repos_have_owner_readiness_row"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert data["summary"]["p0_cicd_baseline_status"] == (
|
||||
"ready_for_template_copy_apply_gate"
|
||||
)
|
||||
assert data["summary"]["p0_cicd_baseline_workplan_id"] == "P0-004"
|
||||
assert data["summary"]["p0_cicd_baseline_source_readiness_percent"] == 100
|
||||
assert data["summary"]["p0_cicd_baseline_required_source_count"] == 11
|
||||
assert data["summary"]["p0_cicd_baseline_present_required_source_count"] == 11
|
||||
assert data["summary"]["p0_cicd_baseline_missing_required_source_count"] == 0
|
||||
assert data["summary"]["p0_cicd_baseline_blocked_source_ids"] == []
|
||||
assert data["summary"]["p0_cicd_baseline_safe_next_step"] == (
|
||||
"open_template_copy_apply_gate_after_source_readiness_green"
|
||||
)
|
||||
assert data["summary"]["production_deploy_status"] == (
|
||||
"closure_verified"
|
||||
)
|
||||
assert data["summary"]["production_deploy_source_control_main_ready"] is True
|
||||
assert data["summary"]["production_deploy_status"] == "closure_verified"
|
||||
assert data["summary"]["production_deploy_image_tag_matches_main"] is True
|
||||
assert data["summary"]["production_deploy_governance_fields_present"] is True
|
||||
assert (
|
||||
data["summary"]["production_deploy_authorized_dispatch_channel_ready"]
|
||||
is False
|
||||
)
|
||||
assert data["summary"]["production_deploy_manual_run_button_visible"] is False
|
||||
assert data["summary"]["production_deploy_gitea_sign_in_required"] is True
|
||||
assert (
|
||||
data["summary"]["production_deploy_dispatch_without_token_http_status"]
|
||||
== 401
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_dispatch_without_token_message"]
|
||||
== "token is required"
|
||||
)
|
||||
assert data["summary"]["production_deploy_hard_blocker_count"] == 0
|
||||
assert data["summary"]["production_deploy_latest_visible_cd_run_id"] == "3863"
|
||||
assert data["summary"]["production_deploy_latest_visible_cd_run_status"] == (
|
||||
"Success"
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_latest_visible_cd_run_jobs_total_count"]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_gitea_actions_list_without_token_http_status"
|
||||
]
|
||||
== 401
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_gitea_actions_list_without_token_message"]
|
||||
== "token is required"
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_latest_visible_waiting_runner_run_id"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_latest_visible_waiting_runner_workflow"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_latest_visible_waiting_runner_kind"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_latest_visible_waiting_runner_status"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_latest_visible_waiting_runner_label"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_public_actions_queue_readback_schema_version"
|
||||
]
|
||||
== "awoooi_public_gitea_actions_queue_readback_v1"
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_public_actions_queue_readback_verifier"]
|
||||
== "ops/runner/read-public-gitea-actions-queue.py --json"
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_verifier_schema_version"
|
||||
]
|
||||
== "awoooi_non110_cd_closure_verifier_v1"
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_cd_closure_status"]
|
||||
== "closure_verified"
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_cd_closure_required"]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
"ops/runner/verify-awoooi-non110-cd-closure.py"
|
||||
in data["summary"]["production_deploy_non110_runner_cd_closure_verifier"]
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_ordered_step_count"
|
||||
]
|
||||
== 6
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_ordered_completed_prefix_count"
|
||||
]
|
||||
== 6
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_evidence_completed_step_count"
|
||||
]
|
||||
== 6
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_ordered_completion_percent"
|
||||
]
|
||||
== 100
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_evidence_completion_percent"
|
||||
]
|
||||
== 100
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_next_blocked_step_index"
|
||||
]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_next_blocked_step_id"
|
||||
]
|
||||
== ""
|
||||
)
|
||||
assert data["summary"][
|
||||
"production_deploy_non110_runner_cd_closure_next_blocked_step_action"
|
||||
] == ""
|
||||
assert data["summary"]["production_deploy_non110_runner_ready"] is True
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_prepare_only_source_ready"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_safe_registration_helper_ready"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_workflow_labels_aligned"]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_host_label"]
|
||||
== "awoooi-non110-host"
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_ubuntu_label"]
|
||||
== "awoooi-non110-ubuntu"
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_online_label_match"]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_autostart_path_armed"]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_ready_autostart_path_count"
|
||||
]
|
||||
== 1
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"production_deploy_non110_runner_registration_condition_required"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert data["summary"]["production_deploy_non110_runner_ready_config_count"] == 1
|
||||
assert data["summary"]["production_deploy_non110_runner_ready_service_count"] == 1
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_ready_registration_count"]
|
||||
== 1
|
||||
)
|
||||
assert data["summary"]["production_deploy_non110_runner_safe_next_step"] == ""
|
||||
assert (
|
||||
data["summary"]["production_deploy_non110_runner_remaining_blocker_count"]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
data["summary"][
|
||||
"backup_credential_escrow_intake_scorecard_schema_version"
|
||||
]
|
||||
== "awoooi_post_reboot_credential_escrow_intake_scorecard_v1"
|
||||
)
|
||||
assert (
|
||||
"scripts/reboot-recovery/post-reboot-credential-escrow-intake-scorecard.py"
|
||||
in data["summary"]["backup_credential_escrow_intake_scorecard_verifier"]
|
||||
)
|
||||
assert data["summary"]["backup_credential_escrow_intake_status"] == (
|
||||
"blocked_waiting_non_secret_credential_escrow_evidence"
|
||||
)
|
||||
assert data["summary"]["backup_credential_escrow_active_gate_present"] is True
|
||||
assert data["summary"]["backup_credential_escrow_preflight_status"] == (
|
||||
"blocked_waiting_owner_response_content"
|
||||
)
|
||||
assert data["summary"]["backup_credential_escrow_required_item_count"] == 5
|
||||
assert data["summary"]["backup_credential_escrow_effective_missing_count"] == 5
|
||||
assert (
|
||||
data["summary"]["backup_credential_escrow_owner_response_received_count"]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
data["summary"]["backup_credential_escrow_owner_response_accepted_count"]
|
||||
== 0
|
||||
)
|
||||
assert data["summary"]["backup_credential_escrow_runtime_gate_count"] == 0
|
||||
assert (
|
||||
data["summary"]["backup_credential_escrow_secret_value_collection_allowed"]
|
||||
is False
|
||||
)
|
||||
assert data["summary"]["backup_credential_escrow_secret_value_collection_allowed"] is False
|
||||
assert data["summary"]["backup_credential_marker_write_authorized_count"] == 0
|
||||
assert data["summary"]["backup_credential_escrow_forbidden_true_field_count"] == 0
|
||||
assert data["summary"]["github_write_channel_ready"] is False
|
||||
assert data["summary"]["github_account_status"] == "suspended"
|
||||
assert data["summary"]["github_account_suspended"] is True
|
||||
assert data["summary"]["github_api_forbidden_count"] == 6
|
||||
assert data["summary"]["github_controlled_apply_ready_count"] == 0
|
||||
assert data["summary"]["github_blocked_preflight_target_count"] == 5
|
||||
assert data["summary"]["github_operator_unblock_required"] is True
|
||||
assert data["summary"]["github_operator_unblock_status"] == (
|
||||
"github_account_suspended_external_action_required"
|
||||
)
|
||||
assert data["summary"]["github_internal_governance_writeback_ready"] is True
|
||||
assert data["summary"]["github_mcp_evidence_packet_count"] == 1
|
||||
assert data["summary"]["github_rag_evidence_ref_count"] == 5
|
||||
assert data["summary"]["github_km_writeback_ready_count"] == 1
|
||||
assert data["summary"]["github_playbook_writeback_ready_count"] == 1
|
||||
assert data["summary"]["github_timeline_log_ready_count"] == 1
|
||||
assert data["summary"]["github_logbook_entry_count"] == 1
|
||||
assert data["summary"]["secret_values_collected"] is False
|
||||
assert data["summary"]["average_completion_percent"] >= 0
|
||||
assert data["summary"]["high_risk_blocker_count"] > 0
|
||||
|
||||
lanes = {lane["id"]: lane for lane in data["lanes"]}
|
||||
sources = {source["id"]: source for source in data["source_statuses"]}
|
||||
assert sorted(lanes) == [
|
||||
"backup",
|
||||
lane_ids = {lane["id"] for lane in data["lanes"]}
|
||||
assert lane_ids == {
|
||||
"release",
|
||||
"production_deploy",
|
||||
"gitea_private_inventory",
|
||||
"cicd_baseline",
|
||||
"gitea",
|
||||
"github",
|
||||
"production_deploy",
|
||||
"release",
|
||||
"runtime",
|
||||
]
|
||||
assert lanes["release"]["metric"]["kind"] == "blocked_gate"
|
||||
assert lanes["release"]["status"] == "controlled_status_cleanup_package_ready"
|
||||
assert lanes["release"]["blocker_count"] == 0
|
||||
assert lanes["release"]["metric"]["blocked"] == 0
|
||||
assert lanes["release"]["metric"]["total"] == 5
|
||||
assert lanes["production_deploy"]["metric"]["kind"] == "deploy_readback"
|
||||
assert lanes["production_deploy"]["status"] == "closure_verified"
|
||||
assert lanes["production_deploy"]["blocker_count"] == 0
|
||||
assert lanes["production_deploy"]["metric"][
|
||||
"observed_source_control_main_short_sha"
|
||||
] == "a70c6756d9"
|
||||
assert lanes["production_deploy"]["metric"][
|
||||
"production_image_tag_short_sha"
|
||||
] == "a70c6756d9"
|
||||
"backup",
|
||||
}
|
||||
assert data["operation_boundaries"]["read_only_api_allowed"] is True
|
||||
assert data["operation_boundaries"]["runtime_write_allowed"] is False
|
||||
assert data["operation_boundaries"]["remote_write_allowed"] is False
|
||||
assert data["operation_boundaries"]["repo_creation_allowed"] is False
|
||||
assert data["operation_boundaries"]["visibility_change_allowed"] is False
|
||||
assert data["operation_boundaries"]["refs_sync_allowed"] is False
|
||||
assert data["operation_boundaries"]["workflow_trigger_allowed"] is False
|
||||
assert data["operation_boundaries"]["gitea_api_write_allowed"] is False
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["production_image_tag_matches_main"]
|
||||
is True
|
||||
)
|
||||
assert lanes["production_deploy"]["metric"]["current_main_cd_run_visible"] is True
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["authorized_dispatch_channel_ready"]
|
||||
is False
|
||||
)
|
||||
assert lanes["production_deploy"]["metric"]["manual_run_button_visible"] is False
|
||||
assert lanes["production_deploy"]["metric"]["gitea_sign_in_required"] is True
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"dispatch_without_token_http_status"
|
||||
]
|
||||
== 401
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["dispatch_without_token_message"]
|
||||
== "token is required"
|
||||
)
|
||||
assert lanes["production_deploy"]["metric"]["latest_visible_cd_run_id"] == "3863"
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["latest_visible_cd_run_status"]
|
||||
== "Success"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"latest_visible_cd_run_jobs_total_count"
|
||||
]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"gitea_actions_list_without_token_http_status"
|
||||
]
|
||||
== 401
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"gitea_actions_list_without_token_message"
|
||||
]
|
||||
== "token is required"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["latest_visible_waiting_runner_run_id"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"latest_visible_waiting_runner_workflow"
|
||||
]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["latest_visible_waiting_runner_kind"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"latest_visible_waiting_runner_status"
|
||||
]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["latest_visible_waiting_runner_label"]
|
||||
== ""
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"public_actions_queue_readback_schema_version"
|
||||
]
|
||||
== "awoooi_public_gitea_actions_queue_readback_v1"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["public_actions_queue_readback_verifier"]
|
||||
== "ops/runner/read-public-gitea-actions-queue.py --json"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_verifier_schema_version"
|
||||
]
|
||||
== "awoooi_non110_cd_closure_verifier_v1"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["non110_runner_cd_closure_status"]
|
||||
== "closure_verified"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["non110_runner_cd_closure_required"]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
"ops/runner/verify-awoooi-non110-cd-closure.py"
|
||||
in lanes["production_deploy"]["metric"]["non110_runner_cd_closure_verifier"]
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_ordered_step_count"
|
||||
]
|
||||
== 6
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_ordered_completed_prefix_count"
|
||||
]
|
||||
== 6
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_evidence_completed_step_count"
|
||||
]
|
||||
== 6
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_ordered_completion_percent"
|
||||
]
|
||||
== 100
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_evidence_completion_percent"
|
||||
]
|
||||
== 100
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_next_blocked_step_index"
|
||||
]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_next_blocked_step_id"
|
||||
]
|
||||
== ""
|
||||
)
|
||||
assert lanes["production_deploy"]["metric"][
|
||||
"non110_runner_cd_closure_next_blocked_step_action"
|
||||
] == ""
|
||||
assert lanes["production_deploy"]["metric"]["non110_runner_ready"] is True
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_prepare_only_source_ready"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_safe_registration_helper_ready"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_workflow_labels_aligned"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["non110_runner_host_label"]
|
||||
== "awoooi-non110-host"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["non110_runner_ubuntu_label"]
|
||||
== "awoooi-non110-ubuntu"
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["non110_runner_online_label_match"]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"]["non110_runner_autostart_path_armed"]
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_ready_autostart_path_count"
|
||||
]
|
||||
== 1
|
||||
)
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_registration_condition_required"
|
||||
]
|
||||
is True
|
||||
)
|
||||
assert lanes["production_deploy"]["metric"]["non110_runner_ready_config_count"] == 1
|
||||
assert lanes["production_deploy"]["metric"]["non110_runner_ready_service_count"] == 1
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_ready_registration_count"
|
||||
]
|
||||
== 1
|
||||
)
|
||||
assert lanes["production_deploy"]["metric"]["non110_runner_safe_next_step"] == ""
|
||||
assert (
|
||||
lanes["production_deploy"]["metric"][
|
||||
"non110_runner_remaining_blocker_count"
|
||||
]
|
||||
== 0
|
||||
)
|
||||
assert lanes["github"]["metric"]["kind"] == "private_backup_verified"
|
||||
assert lanes["cicd_baseline"]["metric"]["kind"] == "source_readiness"
|
||||
assert lanes["cicd_baseline"]["status"] == "ready_for_template_copy_apply_gate"
|
||||
assert lanes["cicd_baseline"]["blocker_count"] == 0
|
||||
assert lanes["cicd_baseline"]["completion_percent"] == 100
|
||||
assert lanes["cicd_baseline"]["metric"]["workplan_id"] == "P0-004"
|
||||
assert lanes["cicd_baseline"]["metric"]["required_source_count"] == 11
|
||||
assert lanes["cicd_baseline"]["metric"]["present_required_source_count"] == 11
|
||||
assert lanes["cicd_baseline"]["metric"]["missing_required_source_count"] == 0
|
||||
assert lanes["cicd_baseline"]["metric"]["blocked_source_ids"] == []
|
||||
assert (
|
||||
lanes["cicd_baseline"]["metric"]["workflow_modification_allowed"]
|
||||
is False
|
||||
)
|
||||
assert lanes["cicd_baseline"]["metric"]["workflow_trigger_allowed"] is False
|
||||
assert lanes["gitea"]["metric"]["kind"] == "workflow_count"
|
||||
assert lanes["runtime"]["metric"]["kind"] == "surface_count"
|
||||
assert lanes["backup"]["metric"]["kind"] == "readiness_row_count"
|
||||
assert (
|
||||
lanes["backup"]["metric"][
|
||||
"credential_escrow_intake_scorecard_schema_version"
|
||||
]
|
||||
== "awoooi_post_reboot_credential_escrow_intake_scorecard_v1"
|
||||
)
|
||||
assert lanes["backup"]["metric"]["credential_escrow_intake_status"] == (
|
||||
"blocked_waiting_non_secret_credential_escrow_evidence"
|
||||
)
|
||||
assert lanes["backup"]["metric"]["credential_escrow_active_gate_present"] is True
|
||||
assert (
|
||||
lanes["backup"]["metric"]["credential_escrow_effective_missing_count"]
|
||||
== 5
|
||||
)
|
||||
assert (
|
||||
lanes["backup"]["metric"]["credential_escrow_owner_response_received_count"]
|
||||
== 0
|
||||
)
|
||||
assert (
|
||||
lanes["backup"]["metric"]["credential_escrow_owner_response_accepted_count"]
|
||||
== 0
|
||||
)
|
||||
assert lanes["backup"]["metric"]["credential_escrow_runtime_gate_count"] == 0
|
||||
assert (
|
||||
lanes["backup"]["metric"][
|
||||
"credential_escrow_secret_value_collection_allowed"
|
||||
data["operation_boundaries"][
|
||||
"gitea_authenticated_inventory_import_execution_allowed"
|
||||
]
|
||||
is False
|
||||
)
|
||||
assert lanes["backup"]["metric"]["credential_marker_write_authorized_count"] == 0
|
||||
assert lanes["backup"]["metric"]["credential_escrow_forbidden_true_field_count"] == 0
|
||||
assert sources["github_private_backup"]["loaded"] is True
|
||||
assert sources["p0_cicd_baseline_source_readiness"]["loaded"] is True
|
||||
assert sources["production_deploy_readback"]["loaded"] is True
|
||||
assert (
|
||||
sources["production_deploy_readback"]["schema_version"]
|
||||
== "awoooi_production_deploy_readback_blocker_v1"
|
||||
)
|
||||
assert sources["production_deploy_readback"]["missing_reason"] == ""
|
||||
assert (
|
||||
sources["github_private_backup"]["schema_version"]
|
||||
== "github_target_private_backup_evidence_gate_v1"
|
||||
)
|
||||
assert (
|
||||
sources["p0_cicd_baseline_source_readiness"]["schema_version"]
|
||||
== "p0_cicd_baseline_source_readiness_v1"
|
||||
)
|
||||
assert (
|
||||
sources["p0_cicd_baseline_source_readiness"]["missing_reason"]
|
||||
== ""
|
||||
)
|
||||
assert sources["github_private_backup"]["missing_reason"] == ""
|
||||
assert lanes["github"]["blocker_count"] == 5
|
||||
assert (
|
||||
lanes["github"]["status"]
|
||||
== "blocked_github_account_suspended_and_write_channel_required"
|
||||
)
|
||||
assert lanes["github"]["metric"]["verified"] == 4
|
||||
assert lanes["github"]["metric"]["total"] == 9
|
||||
assert lanes["github"]["metric"]["controlled_apply_ready"] == 0
|
||||
assert lanes["github"]["metric"]["blocked_preflight"] == 5
|
||||
assert lanes["github"]["metric"]["write_channel_ready"] is False
|
||||
assert lanes["github"]["metric"]["github_account_status"] == "suspended"
|
||||
assert lanes["github"]["metric"]["github_account_suspended"] is True
|
||||
assert lanes["github"]["metric"]["internal_governance_ready"] is True
|
||||
assert lanes["github"]["metric"]["km_writeback_ready"] == 1
|
||||
assert lanes["github"]["metric"]["playbook_writeback_ready"] == 1
|
||||
assert lanes["github"]["operator_unblock"]["required"] is True
|
||||
assert lanes["github"]["operator_unblock"]["status"] == (
|
||||
"github_account_suspended_external_action_required"
|
||||
)
|
||||
assert (
|
||||
"complete_github_account_suspension_appeal_or_provide_authorized_writable_namespace"
|
||||
in lanes["github"]["operator_unblock"]["required_actions"]
|
||||
)
|
||||
assert lanes["github"]["internal_governance_writeback"]["ready"] is True
|
||||
assert (
|
||||
lanes["github"]["internal_governance_writeback"][
|
||||
"mcp_evidence_packet_count"
|
||||
]
|
||||
== 1
|
||||
)
|
||||
assert (
|
||||
lanes["github"]["internal_governance_writeback"]["github_write_performed"]
|
||||
is False
|
||||
)
|
||||
assert lanes["github"]["next_action"] == (
|
||||
"complete_github_account_suspension_appeal_or_provide_authorized_writable_namespace"
|
||||
)
|
||||
assert all(0 <= lane["completion_percent"] <= 100 for lane in lanes.values())
|
||||
assert all(lane["tone"] in {"ok", "warn", "danger"} for lane in lanes.values())
|
||||
|
||||
boundaries = data["operation_boundaries"]
|
||||
assert boundaries["read_only_api_allowed"] is True
|
||||
assert boundaries["runtime_write_allowed"] is False
|
||||
assert boundaries["remote_write_allowed"] is True
|
||||
assert boundaries["repo_creation_allowed"] is True
|
||||
assert boundaries["visibility_change_allowed"] is True
|
||||
assert boundaries["refs_sync_allowed"] is True
|
||||
assert boundaries["workflow_trigger_allowed"] is True
|
||||
assert boundaries["production_deploy_trigger_allowed"] is False
|
||||
assert boundaries["github_write_channel_ready"] is False
|
||||
assert boundaries["github_controlled_apply_allowed"] is False
|
||||
assert boundaries["secret_value_collection_allowed"] is False
|
||||
assert boundaries["backup_restore_execution_allowed"] is False
|
||||
assert boundaries["active_scan_allowed"] is False
|
||||
|
||||
assert "192.168.0." not in response.text
|
||||
|
||||
|
||||
def test_production_deploy_readback_uses_runtime_build_commit(monkeypatch):
|
||||
runtime_sha = "0123456789abcdef0123456789abcdef01234567"
|
||||
monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", runtime_sha)
|
||||
|
||||
payload = load_latest_awoooi_production_deploy_readback_blocker()
|
||||
readback = payload["readback"]
|
||||
rollups = payload["rollups"]
|
||||
|
||||
assert readback["runtime_build_commit_sha"] == runtime_sha
|
||||
assert readback["runtime_build_commit_short_sha"] == runtime_sha[:10]
|
||||
assert readback["observed_source_control_main_sha"] == runtime_sha
|
||||
assert readback["production_image_tag_sha"] == runtime_sha
|
||||
assert readback["production_image_tag_matches_main"] is True
|
||||
assert rollups["production_image_tag_matches_main"] is True
|
||||
assert data["operation_boundaries"]["github_write_channel_ready"] is False
|
||||
assert data["operation_boundaries"]["github_controlled_apply_allowed"] is False
|
||||
assert data["operation_boundaries"]["secret_value_collection_allowed"] is False
|
||||
|
||||
149
apps/api/tests/test_gitea_private_inventory_p0_scorecard_api.py
Normal file
149
apps/api/tests/test_gitea_private_inventory_p0_scorecard_api.py
Normal file
@@ -0,0 +1,149 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
|
||||
import pytest
|
||||
from fastapi import FastAPI
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
from src.api.v1.agents import router
|
||||
from src.services.gitea_private_inventory_p0_scorecard import (
|
||||
load_latest_gitea_private_inventory_p0_scorecard,
|
||||
)
|
||||
|
||||
|
||||
def test_gitea_private_inventory_p0_scorecard_reports_active_gitea_blocker():
|
||||
payload = load_latest_gitea_private_inventory_p0_scorecard()
|
||||
|
||||
assert payload["schema_version"] == "gitea_private_inventory_p0_scorecard_readback_v1"
|
||||
assert payload["priority"] == "P0-003"
|
||||
assert payload["readback"]["source_control_authority"] == "gitea"
|
||||
assert payload["readback"]["private_inventory_source"] == "gitea"
|
||||
assert payload["status"] == "blocked_waiting_gitea_authenticated_or_owner_export_inventory"
|
||||
assert payload["rollups"]["active_blocker_count"] == 4
|
||||
assert payload["rollups"]["review_readiness_percent"] == 60
|
||||
assert payload["rollups"]["gitea_repo_inventory_status"] == "partial"
|
||||
assert payload["rollups"]["gitea_visibility_scope"] == "public_only"
|
||||
assert payload["rollups"]["accepted_inventory_payload_count"] == 0
|
||||
assert payload["rollups"]["owner_coverage_attestation_received_count"] == 0
|
||||
assert payload["rollups"]["expected_product_count"] == 11
|
||||
assert payload["rollups"]["present_product_row_count"] == 11
|
||||
assert payload["rollups"]["missing_product_row_count"] == 0
|
||||
assert payload["rollups"]["all_active_product_repos_have_gitea_owner_readiness_row"] is True
|
||||
assert payload["rollups"]["github_lane_excluded_from_p0_blocker_count"] is True
|
||||
assert payload["github_retired_context"]["status"] == "stopped_retired_do_not_use"
|
||||
assert payload["github_retired_context"]["excluded_from_active_p0_blocker_math"] is True
|
||||
assert "gitea_authenticated_inventory_payload_not_accepted" in payload["active_blockers"]
|
||||
|
||||
|
||||
def test_gitea_private_inventory_p0_scorecard_endpoint_returns_readback():
|
||||
app = FastAPI()
|
||||
app.include_router(router, prefix="/api/v1")
|
||||
client = TestClient(app)
|
||||
|
||||
response = client.get("/api/v1/agents/gitea-private-inventory-p0-scorecard")
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["priority"] == "P0-003"
|
||||
assert data["rollups"]["active_blocker_count"] == 4
|
||||
assert data["operation_boundaries"]["read_only_api_allowed"] is True
|
||||
assert data["operation_boundaries"]["gitea_api_write_allowed"] is False
|
||||
assert data["operation_boundaries"]["gitea_repo_creation_allowed"] is False
|
||||
assert data["operation_boundaries"]["gitea_refs_sync_allowed"] is False
|
||||
assert data["operation_boundaries"]["gitea_workflow_trigger_allowed"] is False
|
||||
assert data["operation_boundaries"]["token_value_collection_allowed"] is False
|
||||
assert data["operation_boundaries"]["secret_value_collection_allowed"] is False
|
||||
assert data["operation_boundaries"]["github_api_allowed"] is False
|
||||
assert data["operation_boundaries"]["github_cli_allowed"] is False
|
||||
assert data["operation_boundaries"]["raw_session_or_sqlite_read_allowed"] is False
|
||||
|
||||
|
||||
def test_gitea_private_inventory_p0_scorecard_rejects_github_reactivation(tmp_path):
|
||||
operations_dir = tmp_path / "operations"
|
||||
operations_dir.mkdir()
|
||||
payload = _scorecard_payload()
|
||||
payload["github_lane_excluded_from_p0_blocker_count"] = False
|
||||
(operations_dir / "awoooi-gitea-private-inventory-p0-scorecard.snapshot.json").write_text(
|
||||
json.dumps(payload),
|
||||
encoding="utf-8",
|
||||
)
|
||||
|
||||
with pytest.raises(ValueError, match="github lane"):
|
||||
load_latest_gitea_private_inventory_p0_scorecard(operations_dir)
|
||||
|
||||
|
||||
def test_gitea_private_inventory_p0_scorecard_rejects_token_collection(tmp_path):
|
||||
operations_dir = tmp_path / "operations"
|
||||
operations_dir.mkdir()
|
||||
payload = _scorecard_payload()
|
||||
payload["authenticated_import_acceptance"]["token_value_collection_allowed"] = True
|
||||
(operations_dir / "awoooi-gitea-private-inventory-p0-scorecard.snapshot.json").write_text(
|
||||
json.dumps(payload),
|
||||
encoding="utf-8",
|
||||
)
|
||||
|
||||
with pytest.raises(ValueError, match="token value collection"):
|
||||
load_latest_gitea_private_inventory_p0_scorecard(operations_dir)
|
||||
|
||||
|
||||
def _scorecard_payload() -> dict:
|
||||
return {
|
||||
"schema_version": "awoooi_gitea_private_inventory_p0_scorecard_v1",
|
||||
"generated_at": "2026-06-29T14:09:49+08:00",
|
||||
"workplan_id": "P0-003",
|
||||
"status": "blocked_waiting_gitea_authenticated_or_owner_export_inventory",
|
||||
"source_control_authority": "gitea",
|
||||
"private_inventory_source": "gitea",
|
||||
"github_status": "stopped_retired_do_not_use",
|
||||
"github_lane_excluded_from_p0_blocker_count": True,
|
||||
"github_api_used": False,
|
||||
"github_cli_used": False,
|
||||
"github_primary_switch_authorized": False,
|
||||
"gitea_inventory": {
|
||||
"schema_version": "gitea_repo_inventory_v1",
|
||||
"status": "partial",
|
||||
"visibility_scope": "public_only",
|
||||
"repo_count": 2,
|
||||
},
|
||||
"authenticated_import_acceptance": {
|
||||
"schema_version": "gitea_authenticated_inventory_import_acceptance_v1",
|
||||
"status": "draft_waiting_redacted_inventory_payload",
|
||||
"accepted_payload_count": 0,
|
||||
"token_value_collection_allowed": False,
|
||||
"execution_authorized": False,
|
||||
},
|
||||
"coverage_attestation": {
|
||||
"schema_version": "gitea_inventory_coverage_attestation_v1",
|
||||
"status": "draft_waiting_owner_attestation",
|
||||
"received_attestation_count": 0,
|
||||
"accepted_attestation_count": 0,
|
||||
"execution_authorized": False,
|
||||
},
|
||||
"product_row_coverage": {
|
||||
"expected_product_count": 11,
|
||||
"present_product_row_count": 11,
|
||||
"missing_product_row_count": 0,
|
||||
"ready_product_count": 3,
|
||||
"blocked_product_count": 8,
|
||||
"internal_or_authenticated_inventory_required_count": 3,
|
||||
"all_active_product_repos_have_gitea_owner_readiness_row": True,
|
||||
},
|
||||
"active_blockers": [
|
||||
"gitea_repo_inventory_status_not_ok",
|
||||
"gitea_visibility_scope_public_only_or_unknown",
|
||||
"gitea_authenticated_inventory_payload_not_accepted",
|
||||
"gitea_owner_coverage_attestation_not_received",
|
||||
],
|
||||
"exit_criteria": [
|
||||
"private_inventory_source=gitea",
|
||||
"github_lane_excluded_from_p0_blocker_count=true",
|
||||
"gitea_repo_inventory.status=ok",
|
||||
"gitea_repo_inventory.visibility_scope in authenticated/admin_export",
|
||||
"all_active_product_repos_have_gitea_owner_readiness_row=true",
|
||||
],
|
||||
"safe_next_step": (
|
||||
"obtain_gitea_authenticated_or_admin_export_redacted_inventory_payload_"
|
||||
"then_validate_import_acceptance_and_owner_attestation"
|
||||
),
|
||||
}
|
||||
Reference in New Issue
Block a user