70 lines
2.6 KiB
Python
70 lines
2.6 KiB
Python
|
"""Mechanical checks on the deployment manifest's image pinning.
|
||
|
|
|
||
|
|
These exist because the manifest drifted in a way review did not catch: the
|
||
|
|
release was published and pinned, while three documents went on instructing an
|
||
|
|
operator to replace a placeholder that no longer existed. A pin is exactly the
|
||
|
|
kind of property a test can hold and prose cannot.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import re
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
ROOT = Path(__file__).resolve().parents[1]
|
||
|
|
MANIFEST = ROOT / "deploy" / "approval-engine.yaml"
|
||
|
|
|
||
|
|
IMAGE_LINE = re.compile(r"^\s*image:\s*(\S+)\s*$", re.MULTILINE)
|
||
|
|
DIGEST_PIN = re.compile(r"^[^\s@]+@sha256:[0-9a-f]{64}$")
|
||
|
|
|
||
|
|
|
||
|
|
def image_refs() -> list[str]:
|
||
|
|
return IMAGE_LINE.findall(MANIFEST.read_text(encoding="utf-8"))
|
||
|
|
|
||
|
|
|
||
|
|
def test_manifest_declares_both_images():
|
||
|
|
"""The init container and the server are two references, not one."""
|
||
|
|
refs = image_refs()
|
||
|
|
assert len(refs) == 2, f"expected 2 image references, found {len(refs)}: {refs}"
|
||
|
|
|
||
|
|
|
||
|
|
def test_images_are_digest_pinned_not_tagged():
|
||
|
|
"""A tag would let the migration and the server run different code.
|
||
|
|
|
||
|
|
They share one database: the init container migrates it and the server then
|
||
|
|
serves it. A floating tag makes 'the schema the migration wrote' and 'the
|
||
|
|
schema the server expects' independently resolvable, which is the failure
|
||
|
|
the digest pin exists to prevent.
|
||
|
|
"""
|
||
|
|
for ref in image_refs():
|
||
|
|
assert DIGEST_PIN.match(ref), f"image is not digest-pinned: {ref!r}"
|
||
|
|
|
||
|
|
|
||
|
|
def test_both_images_are_identical():
|
||
|
|
"""Two different digests here is a split-brain migration waiting to happen."""
|
||
|
|
refs = image_refs()
|
||
|
|
assert len(set(refs)) == 1, f"image references differ: {sorted(set(refs))}"
|
||
|
|
|
||
|
|
|
||
|
|
def test_no_release_placeholder_remains():
|
||
|
|
"""Catches the drift that motivated this file.
|
||
|
|
|
||
|
|
A placeholder left in the manifest is caught by the digest-pin check above;
|
||
|
|
this asserts the specific token is gone so a half-applied release cannot
|
||
|
|
reintroduce it silently.
|
||
|
|
"""
|
||
|
|
text = MANIFEST.read_text(encoding="utf-8")
|
||
|
|
assert "REPLACE_WITH_RELEASE_DIGEST" not in text
|
||
|
|
|
||
|
|
|
||
|
|
def test_deploy_readme_does_not_instruct_replacing_a_pinned_placeholder():
|
||
|
|
"""The runbook and the manifest must not disagree about what is left to do.
|
||
|
|
|
||
|
|
While the manifest carries a real digest, an operator instruction to replace
|
||
|
|
a placeholder is an instruction to undo the pin.
|
||
|
|
"""
|
||
|
|
manifest = MANIFEST.read_text(encoding="utf-8")
|
||
|
|
readme = (ROOT / "deploy" / "README.md").read_text(encoding="utf-8")
|
||
|
|
if "REPLACE_WITH_RELEASE_DIGEST" not in manifest:
|
||
|
|
assert "replace `REPLACE_WITH_RELEASE_DIGEST`" not in readme
|