tegwick
bb14ec679c
- values/application-readback.yaml: serve-readback, enforce, readback caller user-engine, ingress from user-engine only - chart: readback.enabled renders --readback-caller instead of --caller-binding - lifecycle pin to e8c57c18 (main-b5da745, lifecycle v2); previous bdac62bc - TestReadbackPinMatchesParticipantPins: same image digest and package path Founder go 2026-10-10. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
72 lines
2.1 KiB
Go
72 lines
2.1 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
type pinValues struct {
|
|
Image struct {
|
|
Digest string `yaml:"digest"`
|
|
} `yaml:"image"`
|
|
Args []string `yaml:"args"`
|
|
}
|
|
|
|
func loadPinValues(t *testing.T, name string) pinValues {
|
|
t.Helper()
|
|
raw, err := os.ReadFile(filepath.Join("..", "..", "values", name))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var v pinValues
|
|
if err := yaml.Unmarshal(raw, &v); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return v
|
|
}
|
|
|
|
func argAfter(args []string, flag string) []string {
|
|
var out []string
|
|
for i := 0; i+1 < len(args); i++ {
|
|
if args[i] == flag {
|
|
out = append(out, args[i+1])
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
// FLEX-WP-0035-T04, contract §4: the readback pin runs each participant's
|
|
// package at the same digest its own pin runs. The package is baked into the
|
|
// image, so same image digest and same path is the same package digest.
|
|
func TestReadbackPinMatchesParticipantPins(t *testing.T) {
|
|
readback := loadPinValues(t, "application-readback.yaml")
|
|
if len(readback.Args) == 0 || readback.Args[0] != "serve-readback" {
|
|
t.Fatal("readback pin must run serve-readback, which mounts no /v1/check")
|
|
}
|
|
participants := map[string]string{"informed-decision": "informed-decision-lifecycle.yaml"}
|
|
packages := argAfter(readback.Args, "--package")
|
|
if len(packages) != len(participants) {
|
|
t.Fatalf("readback packages %v, want one per participant %v", packages, participants)
|
|
}
|
|
for _, pkg := range packages {
|
|
system, path, _ := strings.Cut(pkg, "=")
|
|
file, ok := participants[system]
|
|
if !ok {
|
|
t.Fatalf("readback package for %q has no participant pin", system)
|
|
}
|
|
own := loadPinValues(t, file)
|
|
if own.Image.Digest != readback.Image.Digest {
|
|
t.Errorf("%s: readback image %s, own pin %s", system, readback.Image.Digest, own.Image.Digest)
|
|
}
|
|
if policies := argAfter(own.Args, "--policy"); len(policies) != 1 || policies[0] != path {
|
|
t.Errorf("%s: readback package %s, own pin %v", system, path, policies)
|
|
}
|
|
if !strings.Contains(strings.Join(argAfter(readback.Args, "--registry"), " "), strings.Join(argAfter(own.Args, "--registry"), " ")) {
|
|
t.Errorf("%s: readback pin does not load its registry", system)
|
|
}
|
|
}
|
|
}
|