awoooi/ops/runner/test_check_awoooi_non110_runner_readiness.py

#!/usr/bin/env python3
from __future__ import annotations

import os
import subprocess
from pathlib import Path


ROOT = Path(__file__).resolve().parents[2]
VERIFIER = ROOT / "ops/runner/check-awoooi-non110-runner-readiness.sh"


def _write_fake_bin(path: Path, name: str, body: str) -> None:
    target = path / name
    target.write_text(body, encoding="utf-8")
    target.chmod(0o755)


def _write_runner_config(path: Path) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(
        """
runner:
  capacity: 1
  labels:
    - "awoooi-host:host"
    - "awoooi-ubuntu:docker://192.168.0.110:5000/awoooi/ci-runner:act-22.04"
""".strip()
        + "\n",
        encoding="utf-8",
    )


def _write_unit(
    path: Path,
    binary_path: Path,
    config_path: Path,
    registration_path: Path,
) -> None:
    path.write_text(
        f"""
[Unit]
ConditionPathExists={registration_path}

[Service]
ExecStart={binary_path} daemon --config {config_path}
Restart=always
CPUQuota=200%
MemoryMax=8G
TasksMax=512
NoNewPrivileges=true
""".strip()
        + "\n",
        encoding="utf-8",
    )


def _run_verifier(
    tmp_path: Path,
    registration_path: Path,
    *,
    active_service: bool = True,
    unit_target_matches: bool = True,
) -> subprocess.CompletedProcess[str]:
    fake_bin = tmp_path / "bin"
    unit_dir = tmp_path / "units"
    fake_bin.mkdir()
    unit_dir.mkdir()
    _write_fake_bin(
        fake_bin,
        "systemctl",
        f"""#!/usr/bin/env bash
set -euo pipefail
if [ "${{1:-}}" = "--user" ]; then shift; fi
cmd="${{1:-}}"; unit="${{2:-}}"
case "$cmd" in
  show)
    if [ "${{2:-}}" = "-p" ]; then
      unit="${{1:-}}"
    fi
    if [ -f "{unit_dir}/$unit" ]; then
      printf 'LoadState=loaded\\nActiveState={"active" if active_service else "inactive"}\\nUnitFileState=disabled\\nMainPID={"1234" if active_service else "0"}\\n'
      exit 0
    fi
    if [ "${{2:-}}" = "-p" ] && [ "${{3:-}}" = "LoadState" ]; then
      printf 'not-found\\n'
      exit 0
    fi
    printf 'LoadState=not-found\\nActiveState=inactive\\nUnitFileState=\\nMainPID=0\\n'
    exit 0
    ;;
  cat)
    if [ -f "{unit_dir}/$unit" ]; then cat "{unit_dir}/$unit"; exit 0; fi
    exit 1
    ;;
esac
exit 1
""",
    )
    _write_fake_bin(
        fake_bin,
        "docker",
        """#!/usr/bin/env bash
if [ "${1:-}" = "ps" ]; then exit 0; fi
exit 0
""",
    )
    _write_fake_bin(
        fake_bin,
        "pgrep",
        """#!/usr/bin/env bash
exit 1
""",
    )
    _write_fake_bin(
        fake_bin,
        "ip",
        """#!/usr/bin/env bash
if [ "${1:-}" = "-o" ] && [ "${2:-}" = "-4" ] && [ "${3:-}" = "addr" ]; then
  printf '1: lo    inet 127.0.0.1/8 scope host lo\\n'
  printf '2: eth0  inet 192.168.0.188/24 brd 192.168.0.255 scope global eth0\\n'
  exit 0
fi
exit 1
""",
    )

    config_path = tmp_path / "config.yaml"
    binary_path = tmp_path / "act_runner"
    _write_runner_config(config_path)
    binary_path.write_text("#!/usr/bin/env bash\nexit 0\n", encoding="utf-8")
    binary_path.chmod(0o755)
    unit_binary_path = binary_path if unit_target_matches else tmp_path / "other_act_runner"
    unit_config_path = config_path if unit_target_matches else tmp_path / "other_config.yaml"
    _write_unit(
        unit_dir / "awoooi-non110-runner.service",
        unit_binary_path,
        unit_config_path,
        registration_path,
    )
    _write_unit(
        unit_dir / "awoooi-non110-runner-rollback.service",
        unit_binary_path,
        unit_config_path,
        registration_path,
    )

    env = {
        **os.environ,
        "PATH": f"{fake_bin}:{os.environ['PATH']}",
        "TARGET_HOST_IP": "",
        "FORBIDDEN_HOST_IPS": "",
        "RUNNER_CONFIG_PATHS": str(config_path),
        "RUNNER_BINARY_PATHS": str(binary_path),
        "RUNNER_SERVICE_NAMES": "awoooi-non110-runner.service",
        "ROLLBACK_UNIT_NAMES": "awoooi-non110-runner-rollback.service",
        "RUNNER_REGISTRATION_PATHS": str(registration_path),
        "MAX_HEAVY_PROCESS_COUNT": "0",
    }
    return subprocess.run(
        ["bash", str(VERIFIER)],
        check=False,
        env=env,
        text=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
    )


def test_non110_readiness_blocks_without_registration_state(tmp_path: Path) -> None:
    result = _run_verifier(tmp_path, tmp_path / ".runner")
    assert result.returncode == 1
    assert "BLOCKER runner_registration_missing" in result.stdout
    assert "AWOOOI_NON110_RUNNER_READY=0" in result.stdout
    assert "raw_runner_registration_read=false" in result.stdout
    assert (
        "safe_next_step=run_register_awoooi_non110_runner_script_without_printing_token_then_enable_service_and_rerun_this_verifier"
        in result.stdout
    )


def test_non110_readiness_accepts_registration_state_presence_without_reading_it(
    tmp_path: Path,
) -> None:
    registration_path = tmp_path / ".runner"
    registration_path.write_text("secret-token-like-content-not-printed\n", encoding="utf-8")
    result = _run_verifier(tmp_path, registration_path)
    assert result.returncode == 0, result.stdout + result.stderr
    assert "RUNNER_REGISTRATION" in result.stdout
    assert "present=1" in result.stdout
    assert "content_read=false" in result.stdout
    assert "registration_condition=1" in result.stdout
    assert "secret-token-like-content" not in result.stdout
    assert "AWOOOI_NON110_RUNNER_READY=1" in result.stdout


def test_non110_readiness_blocks_service_target_mismatch(tmp_path: Path) -> None:
    registration_path = tmp_path / ".runner"
    registration_path.write_text("secret-token-like-content-not-printed\n", encoding="utf-8")
    result = _run_verifier(tmp_path, registration_path, unit_target_matches=False)
    assert result.returncode == 1
    assert "BLOCKER runner_service_target_mismatch:awoooi-non110-runner.service" in result.stdout
    assert "RUNNER_SERVICE_TARGETS unit=awoooi-non110-runner.service" in result.stdout
    assert "AWOOOI_NON110_RUNNER_READY=0" in result.stdout