Christian Manivong
ae39af4665
CI / Tests, lint (push) Successful in 12s
- image_tools/bump.py from base-os, with an action. base-python used it from
a pinned checkout of base-os, with the bot's token; one place serves both.
A dependent whose workflow does not exist (netork's ui-nightly.yml, on
2026-10-22) is named and the others go on; the run fails at the end, as
for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
${BASE_OS}, which its nightly sets, and copies CPython from Docker's
python:3.12-slim, which is not signed with netOrk's key.
69 lines
2.5 KiB
Python
69 lines
2.5 KiB
Python
"""The composite actions every image repository of NetOrk uses (NetOrk/netork#1390).
|
|
|
|
uses: https://git.netork.io/NetOrk/image-tools/actions/<name>@<commit>
|
|
|
|
They only call what this repository holds, so a pinned commit fixes what runs.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
ACTIONS = sorted((ROOT / "actions").glob("*/action.yml"))
|
|
|
|
|
|
def test_the_actions():
|
|
names = [a.parent.name for a in ACTIONS]
|
|
|
|
assert names == ["bump", "judge", "sign", "verdict", "verify-base"]
|
|
|
|
|
|
@pytest.mark.parametrize("action", ACTIONS, ids=lambda a: a.parent.name)
|
|
def test_an_action_runs_only_what_this_repository_holds(action):
|
|
spec = yaml.safe_load(action.read_text())
|
|
|
|
assert spec["runs"]["using"] == "composite"
|
|
for step in spec["runs"]["steps"]:
|
|
for script in re.findall(r"github\.action_path }}/\.\./\.\./(bin/[\w.-]+)", step["run"]):
|
|
assert (ROOT / script).is_file(), script
|
|
assert "${{ inputs." not in step["run"], "inputs reach a script through env"
|
|
|
|
|
|
def test_signing_needs_its_secrets_from_the_caller():
|
|
text = (ROOT / "actions/sign/action.yml").read_text()
|
|
|
|
assert "COSIGN_PRIVATE_KEY_B64" in text and "secrets." not in text
|
|
|
|
|
|
def test_a_verdict_that_could_not_be_reached_fails_the_step():
|
|
"""A silent "same" hid an empty NETORK_LICENSE_KEY for two nights (2026-10-21/22)."""
|
|
spec = yaml.safe_load((ROOT / "actions/verdict/action.yml").read_text())
|
|
[step] = spec["runs"]["steps"]
|
|
|
|
assert spec["outputs"]["improved"]["value"] == "${{ steps.verdict.outputs.improved }}"
|
|
assert "['error']" in step["run"] and "sys.exit(" in step["run"]
|
|
assert "cat report.md" in step["run"].splitlines()
|
|
|
|
|
|
def test_bumping_needs_its_token_from_the_caller():
|
|
text = (ROOT / "actions/bump/action.yml").read_text()
|
|
|
|
assert "BUMP_TOKEN" in text and "secrets." not in text
|
|
|
|
|
|
def test_a_base_can_be_named_where_the_dockerfile_cannot():
|
|
"""base-python builds FROM ${BASE_OS}, an argument the nightly sets, and copies
|
|
CPython from Docker's python:3.12-slim, which is not signed with netOrk's key.
|
|
It names the one image to verify instead."""
|
|
spec = yaml.safe_load((ROOT / "actions/verify-base/action.yml").read_text())
|
|
runs = "\n".join(step["run"] for step in spec["runs"]["steps"])
|
|
|
|
assert not spec["inputs"]["dockerfiles"].get("required")
|
|
assert "refs" in spec["inputs"]
|
|
assert "bin/verify-signature.sh" in runs and "bin/verify-base.sh" in runs
|