mirror of
https://github.com/yeasy/docker_practice.git
synced 2026-08-10 16:37:34 +00:00
yeasy
898fb10bbe
Per the author: mdPress should default to the latest release. The cluster had drifted to three versions (0.7.10 x4, 0.7.11 x9, 0.7.14 x1), and nine of those were pinned to bytes upstream had rebuilt under an existing tag — the exact thing the harness move to 0.7.14 refused to do on principle. Pinning also took CI down cluster-wide twice when a tag was rebuilt, because the digest no longer matched. Latest is now 0.7.15; nothing was on it. Each of the 43 install sites now resolves the newest release at build time by following the /releases/latest redirect (no api.github.com call, so no unauthenticated rate limit on shared runner IPs) and exports the version via GITHUB_ENV. Integrity is kept, not dropped: the archive is verified against that same release's published checksums.txt, and a missing entry aborts the step rather than passing silently. The honest trade-off is that this verifies the download rather than pinning an immutable artifact — a rebuilt release is now followed instead of failing the build. That is the intended behaviour here, since the rebuild breakage was the problem being solved and upstream is the same author. Tests updated in step: 12 suites asserted the literal MDPRESS_SHA256 as a proxy for "this download is checksum-verified". They now assert checksums.txt, which is where that guarantee lives.
75 lines
2.7 KiB
Go
75 lines
2.7 KiB
Go
import re
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
WORKFLOW = ROOT / ".github" / "workflows" / "pages.yml"
|
|
FULL_ACTION_SHA = re.compile(r"^[^@\s]+@[0-9a-f]{40}$")
|
|
|
|
|
|
class PagesWorkflowTests(unittest.TestCase):
|
|
def workflow_text(self):
|
|
self.assertTrue(WORKFLOW.is_file(), "custom Pages workflow is missing")
|
|
return WORKFLOW.read_text(encoding="utf-8")
|
|
|
|
def test_custom_pages_workflow_exists(self):
|
|
self.assertTrue(WORKFLOW.is_file(), "custom Pages workflow is missing")
|
|
|
|
def test_builds_mdpress_site_without_jekyll(self):
|
|
text = self.workflow_text()
|
|
|
|
self.assertIn("npm run build", text)
|
|
self.assertIn("checksums.txt", text)
|
|
self.assertIn('install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress"', text)
|
|
self.assertIn('echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"', text)
|
|
self.assertRegex(text, r"path:\s*_site\b")
|
|
self.assertNotIn("jekyll", text.lower())
|
|
|
|
def test_verifies_built_site_title_before_upload(self):
|
|
text = self.workflow_text()
|
|
verify_at = text.find("tools/verify_artifacts.py")
|
|
upload_at = text.find("actions/upload-pages-artifact@")
|
|
|
|
self.assertGreaterEqual(verify_at, 0)
|
|
self.assertGreater(upload_at, verify_at)
|
|
self.assertIn('json.load(open("book.json", encoding="utf-8"))["title"]', text)
|
|
self.assertIn("--site _site", text)
|
|
|
|
def test_build_and_deploy_jobs_have_minimum_permissions(self):
|
|
text = self.workflow_text()
|
|
|
|
self.assertRegex(
|
|
text,
|
|
r"(?ms)^ build:\n permissions:\n contents: read\n pages: read\b",
|
|
)
|
|
self.assertRegex(
|
|
text,
|
|
r"(?ms)^ deploy:.*?permissions:\n pages: write\n id-token: write\b",
|
|
)
|
|
self.assertRegex(text, r"(?ms)^ deploy:.*?needs: build\b")
|
|
self.assertIn("environment:", text)
|
|
self.assertIn("name: github-pages", text)
|
|
|
|
def test_actions_are_immutable_and_checkout_drops_credentials(self):
|
|
text = self.workflow_text()
|
|
actions = re.findall(r"\buses:\s*([^\s#]+)", text)
|
|
|
|
self.assertGreater(len(actions), 0)
|
|
self.assertTrue(all(FULL_ACTION_SHA.fullmatch(action) for action in actions), actions)
|
|
self.assertRegex(text, r"actions/checkout@[0-9a-f]{40}\s+# v\d")
|
|
self.assertRegex(
|
|
text,
|
|
r"(?ms)actions/checkout@[0-9a-f]{40}.*?with:\n\s+persist-credentials: false",
|
|
)
|
|
|
|
def test_documents_manual_pages_source_setting(self):
|
|
text = self.workflow_text()
|
|
|
|
self.assertIn("Settings > Pages > Source", text)
|
|
self.assertIn("GitHub Actions", text)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|