541a32a9cb
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Successful in 2m38s
CD Pipeline / build-and-deploy (push) Failing after 24m19s
CD Pipeline / post-deploy-checks (push) Has been skipped
106 lines
2.9 KiB
Python
106 lines
2.9 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[3]
|
|
RUNNER = REPO_ROOT / "scripts" / "ops" / "run-paid-provider-canary.py"
|
|
|
|
|
|
def test_runner_help_bootstraps_api_import_from_repo_root() -> None:
|
|
env = dict(os.environ)
|
|
env["PYTHONDONTWRITEBYTECODE"] = "1"
|
|
|
|
result = subprocess.run(
|
|
[sys.executable, str(RUNNER), "--help"],
|
|
cwd=REPO_ROOT,
|
|
env=env,
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=10,
|
|
check=False,
|
|
)
|
|
|
|
assert result.returncode == 0
|
|
assert "--run-ref" in result.stdout
|
|
assert "ModuleNotFoundError" not in result.stderr
|
|
|
|
|
|
def test_runner_redacts_unexpected_exception_text(
|
|
monkeypatch,
|
|
capsys,
|
|
) -> None:
|
|
spec = importlib.util.spec_from_file_location("paid_canary_runner", RUNNER)
|
|
assert spec is not None and spec.loader is not None
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
|
|
leak = "http://192.168.0.111:11434/?key=secret-like-value"
|
|
|
|
async def _failed(**_kwargs):
|
|
raise LookupError(leak)
|
|
|
|
monkeypatch.setattr(module, "_run_validation", _failed)
|
|
monkeypatch.setattr(
|
|
sys,
|
|
"argv",
|
|
[
|
|
str(RUNNER),
|
|
"--run-ref",
|
|
"source-sha",
|
|
"--authorization-ref",
|
|
"user-approved-20260716",
|
|
],
|
|
)
|
|
|
|
assert module.main() == 2
|
|
output = capsys.readouterr()
|
|
payload = json.loads(output.out)
|
|
assert payload["error_code"] == "canary_failed_LookupError"
|
|
assert leak not in output.out
|
|
assert leak not in output.err
|
|
|
|
|
|
def test_runner_returns_nonzero_for_partial_five_lane_validation(
|
|
monkeypatch,
|
|
capsys,
|
|
) -> None:
|
|
spec = importlib.util.spec_from_file_location("paid_canary_runner_partial", RUNNER)
|
|
assert spec is not None and spec.loader is not None
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
|
|
async def _partial(**_kwargs):
|
|
return {
|
|
"schema_version": "paid_provider_sre_canary_receipt_v3",
|
|
"independent_verifier": {
|
|
"passed": False,
|
|
"paid_activation_verifier_passed": True,
|
|
"five_lane_verifier_passed": False,
|
|
},
|
|
}
|
|
|
|
monkeypatch.setattr(module, "_run_validation", _partial)
|
|
monkeypatch.setattr(
|
|
sys,
|
|
"argv",
|
|
[
|
|
str(RUNNER),
|
|
"--run-ref",
|
|
"source-sha",
|
|
"--authorization-ref",
|
|
"user-approved-20260716",
|
|
],
|
|
)
|
|
|
|
assert module.main() == 1
|
|
payload = json.loads(capsys.readouterr().out)
|
|
assert payload["independent_verifier"][
|
|
"paid_activation_verifier_passed"
|
|
] is True
|
|
assert payload["independent_verifier"]["five_lane_verifier_passed"] is False
|