25 lines
1.1 KiB
Python
25 lines
1.1 KiB
Python
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
WORKFLOW = ROOT / ".gitea/workflows/cd.yaml"
|
|
|
|
|
|
def test_cd_known_hosts_gate_keeps_core_fail_closed_and_host111_isolated() -> None:
|
|
workflow = WORKFLOW.read_text(encoding="utf-8")
|
|
gate = workflow[workflow.index(": > /tmp/known_hosts_repair") :]
|
|
gate = gate[: gate.index('echo "✅ 所有 Secrets 注入完成"')]
|
|
|
|
assert "for scan_attempt in 1 2 3" in gate
|
|
assert 'sleep "\\$scan_attempt"' in gate
|
|
assert "CORE_EXPECTED_HOSTS=5" in gate
|
|
assert "TARGET_HOSTS=6" in gate
|
|
assert "fresh_6_of_6" in gate
|
|
assert "preserve_existing_6_of_6" in gate
|
|
assert "fresh_core_5_host111_trust_deferred" in gate
|
|
assert "preserve_existing_core_5_host111_trust_deferred" in gate
|
|
assert "host-key core trust incomplete" in gate
|
|
assert "host111_trust_deferred isolated_lane=ansible:111-ollama-fallback" in gate
|
|
assert 'rm -f "\\$EXISTING_KNOWN_HOSTS"' in gate
|
|
assert "cat /tmp/known_hosts_scan_err" not in gate
|
|
assert "KNOWN_HOSTS_B64=\\$(base64 -w 0 \"\\$TRUST_SOURCE\")" in gate
|