Christian Manivong
9232b54c6d
CI / Tests, lint (push) Successful in 11s
base-os's nightly asks netOrk's matcher whether a rebuild improves on the pin (image_tools/verify.py). As an action, a workflow needs nothing of this repository but the pinned commit: no install, no checkout. A verdict that could not be reached fails the step, as it does in base-os since the two nights with an empty NETORK_LICENSE_KEY.
49 lines
1.7 KiB
Python
49 lines
1.7 KiB
Python
"""The composite actions every image repository of NetOrk uses (NetOrk/netork#1390).
|
|
|
|
uses: https://git.netork.io/NetOrk/image-tools/actions/<name>@<commit>
|
|
|
|
They only call what this repository holds, so a pinned commit fixes what runs.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
ACTIONS = sorted((ROOT / "actions").glob("*/action.yml"))
|
|
|
|
|
|
def test_the_four_actions():
|
|
assert [a.parent.name for a in ACTIONS] == ["judge", "sign", "verdict", "verify-base"]
|
|
|
|
|
|
@pytest.mark.parametrize("action", ACTIONS, ids=lambda a: a.parent.name)
|
|
def test_an_action_runs_only_what_this_repository_holds(action):
|
|
spec = yaml.safe_load(action.read_text())
|
|
|
|
assert spec["runs"]["using"] == "composite"
|
|
for step in spec["runs"]["steps"]:
|
|
for script in re.findall(r"github\.action_path }}/\.\./\.\./(bin/[\w.-]+)", step["run"]):
|
|
assert (ROOT / script).is_file(), script
|
|
assert "${{ inputs." not in step["run"], "inputs reach a script through env"
|
|
|
|
|
|
def test_signing_needs_its_secrets_from_the_caller():
|
|
text = (ROOT / "actions/sign/action.yml").read_text()
|
|
|
|
assert "COSIGN_PRIVATE_KEY_B64" in text and "secrets." not in text
|
|
|
|
|
|
def test_a_verdict_that_could_not_be_reached_fails_the_step():
|
|
"""A silent "same" hid an empty NETORK_LICENSE_KEY for two nights (2026-10-21/22)."""
|
|
spec = yaml.safe_load((ROOT / "actions/verdict/action.yml").read_text())
|
|
[step] = spec["runs"]["steps"]
|
|
|
|
assert spec["outputs"]["improved"]["value"] == "${{ steps.verdict.outputs.improved }}"
|
|
assert "['error']" in step["run"] and "sys.exit(" in step["run"]
|
|
assert "cat report.md" in step["run"].splitlines()
|