133 lines
4.0 KiB
Python
133 lines
4.0 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[3]
|
|
SCRIPT = REPO_ROOT / "scripts" / "ci" / "generate-cicd-artifact-receipts.py"
|
|
|
|
|
|
def _write(path: Path, text: str) -> None:
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(text, encoding="utf-8")
|
|
|
|
|
|
def test_generate_cicd_artifact_receipts_writes_metadata_only_outputs(
|
|
tmp_path: Path,
|
|
) -> None:
|
|
repo = tmp_path / "repo"
|
|
out_dir = tmp_path / "artifacts"
|
|
_write(
|
|
repo / "apps/api/pyproject.toml",
|
|
"""
|
|
[project]
|
|
name = "awoooi-api"
|
|
version = "1.2.3"
|
|
dependencies = ["fastapi>=0.1", "asyncpg>=0.29"]
|
|
|
|
[project.optional-dependencies]
|
|
dev = ["pytest>=8"]
|
|
""".strip(),
|
|
)
|
|
_write(
|
|
repo / "package.json",
|
|
json.dumps(
|
|
{
|
|
"name": "@awoooi/root",
|
|
"version": "4.5.6",
|
|
"dependencies": {"typescript": "^5.0.0"},
|
|
"devDependencies": {"eslint": "^9.0.0"},
|
|
}
|
|
),
|
|
)
|
|
_write(repo / "pnpm-lock.yaml", "lockfileVersion: '9.0'\n")
|
|
_write(repo / ".gitea/workflows/cd.yaml", "name: CD\n")
|
|
_write(repo / "apps/api/Dockerfile", "FROM python:3.11-slim\n")
|
|
|
|
result = subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(SCRIPT),
|
|
"--repo-root",
|
|
str(repo),
|
|
"--out-dir",
|
|
str(out_dir),
|
|
],
|
|
check=True,
|
|
text=True,
|
|
capture_output=True,
|
|
)
|
|
|
|
assert "cicd_artifact_receipt_manifest_sha256=" in result.stdout
|
|
manifest = json.loads(
|
|
(out_dir / "awoooi-ci-artifact-receipts.manifest.json").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
)
|
|
sbom = json.loads((out_dir / "awoooi-ci-sbom.json").read_text(encoding="utf-8"))
|
|
provenance = json.loads(
|
|
(out_dir / "awoooi-ci-provenance.json").read_text(encoding="utf-8")
|
|
)
|
|
retention = json.loads(
|
|
(out_dir / "awoooi-ci-artifact-retention-manifest.json").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
)
|
|
package_release = json.loads(
|
|
(out_dir / "awoooi-ci-package-release-promotion.json").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
)
|
|
|
|
assert manifest["schema_version"] == "awoooi_cicd_artifact_receipts_v1"
|
|
assert manifest["ready"] is True
|
|
assert manifest["receipt_count"] == 4
|
|
assert [receipt["id"] for receipt in manifest["receipts"]] == [
|
|
"sbom",
|
|
"provenance",
|
|
"artifact_retention",
|
|
"package_release_promotion",
|
|
]
|
|
assert manifest["operation_boundaries"] == {
|
|
"secret_values_collected": False,
|
|
"github_api_used": False,
|
|
"gitea_api_write_performed": False,
|
|
"host_write_performed": False,
|
|
}
|
|
assert sbom["schema_version"] == "awoooi_cicd_sbom_v1"
|
|
assert sbom["component_count"] >= 5
|
|
assert sbom["operation_boundaries"]["secret_value_read_allowed"] is False
|
|
assert provenance["schema_version"] == "awoooi_cicd_provenance_v1"
|
|
assert provenance["slsa_source_contract"]["provenance_receipt_generated"] is True
|
|
assert retention["schema_version"] == "awoooi_cicd_artifact_retention_v1"
|
|
assert retention["cache_key_contract"]["python_deps_hash_input"] == (
|
|
"apps/api/pyproject.toml"
|
|
)
|
|
assert (
|
|
retention["operation_boundaries"]["package_registry_write_attempted"] is False
|
|
)
|
|
assert (
|
|
package_release["schema_version"] == "awoooi_cicd_package_release_promotion_v1"
|
|
)
|
|
assert (
|
|
package_release["release_channel_contract"]["primary_package_registry"]
|
|
== "gitea_packages"
|
|
)
|
|
assert (
|
|
package_release["rollback_receipt_contract"][
|
|
"rollback_requires_post_apply_readback"
|
|
]
|
|
is True
|
|
)
|
|
assert (
|
|
package_release["operation_boundaries"]["package_registry_write_attempted"]
|
|
is False
|
|
)
|
|
assert (
|
|
package_release["operation_boundaries"]["gitea_release_write_attempted"]
|
|
is False
|
|
)
|