coulomb/policy-nexus
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Isolate publication fixtures and bind CI receipts to immutable image

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 02:28:04 +02:00
parent 7c51a7b185
commit bb193b2e87
4 changed files with 57 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

39
tests/test_fetch_sources.py
View file

@ -2,12 +2,17 @@ from __future__ import annotations
from pathlib import Path
import sys
import hashlib
import io
import json
import tempfile
from unittest import mock
import unittest
ROOT = Path(__file__).parents[1]
sys.path.insert(0, str(ROOT / "tools"))
from fetch_sources import _archive_url, _request
from fetch_sources import _archive_url, _request, fetch
class FetchSourcesAuthenticationTest(unittest.TestCase):
@ -53,5 +58,37 @@ class FetchSourcesAuthenticationTest(unittest.TestCase):
)
def test_fetch_locks_workflow_self_sha_and_exact_resolved_upstream_archive(self) -> None:
with tempfile.TemporaryDirectory() as directory:
root = Path(directory)
config = root / "config.json"
config.write_text(json.dumps({"schema_version": 1, "repositories": {
"policy-nexus": {"local": True},
"owner": {"remote": "https://forgejo.coulomb.social/coulomb/owner.git", "branch": "main"},
}}))
self_sha, owner_sha = "b" * 40, "a" * 40
with mock.patch("fetch_sources._revision", return_value=owner_sha) as resolve, \
mock.patch("fetch_sources.urllib.request.urlopen", return_value=io.BytesIO(b"archive")) as opened, \
mock.patch("fetch_sources._extract"):
lock = fetch(config, root / "sources", self_sha)
self.assertEqual(lock["repositories"]["policy-nexus"]["revision"], self_sha)
self.assertEqual(lock["repositories"]["owner"]["revision"], owner_sha)
self.assertEqual(resolve.call_count, 1)
self.assertEqual(opened.call_args.args[0].full_url,
"https://forgejo.coulomb.social/coulomb/owner/archive/" + owner_sha + ".tar.gz")
canonical = json.dumps({"owner": owner_sha, "policy-nexus": self_sha},
sort_keys=True, separators=(",", ":")).encode()
self.assertEqual(lock["source_set_digest"], hashlib.sha256(canonical).hexdigest())
self.assertEqual(json.loads((root / "sources/source-lock.json").read_text()), lock)
def test_mutable_self_reference_refused_before_fetch(self) -> None:
with tempfile.TemporaryDirectory() as directory:
root = Path(directory)
with self.assertRaisesRegex(ValueError, "clean 40-hex"), \
mock.patch("fetch_sources.urllib.request.urlopen") as opened:
fetch(root / "config.json", root / "sources", "main")
opened.assert_not_called()
if __name__ == "__main__":
unittest.main()