tegwick
f91cbca461
40 cluster workloads pull forge images without imagePullSecrets, 6 ArgoCD applications read forge Git; local clones are SSH. Live credential checks and per-entry review remain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
43 lines
2.1 KiB
Python
43 lines
2.1 KiB
Python
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools"))
|
|
from access_consumers import classify, runtime_consumers, target_repo # noqa: E402
|
|
|
|
|
|
class ClassifyTest(unittest.TestCase):
|
|
def test_kinds(self):
|
|
cases = [
|
|
("posts/x.yaml", "/coulomb/pr-hall-of-helix/raw/branch/main/a.png", "url: x", "raw-fetch"),
|
|
("src/client.py", "/api/v1/repos/coulomb/x", "u = ...", "api-client"),
|
|
(".forgejo/workflows/image.yaml", "/coulomb/x", "uses: x", "ci-action"),
|
|
("go.mod", "/coulomb/x", "require x", "package-consumer"),
|
|
("k8s/app.yaml", "/coulomb/x.git", " repoURL: https://...", "gitops-source"),
|
|
("chart/values.yaml", "/coulomb/x", " repository: forgejo...", "image-pull"),
|
|
("README.md", "/coulomb/x", "see", "doc-link"),
|
|
("docs/evidence/run.json", "/coulomb/x", "x", "record"),
|
|
("Makefile", "/coulomb/x", "push", "build-tooling"),
|
|
]
|
|
for f, p, line, want in cases:
|
|
self.assertEqual(classify(f, p, line), want, f)
|
|
|
|
def test_target_repo(self):
|
|
self.assertEqual(target_repo("/coulomb/key-cape.git"), "coulomb/key-cape")
|
|
self.assertEqual(target_repo("/api/v1/repos/coulomb/state-hub/issues"), "coulomb/state-hub")
|
|
self.assertEqual(target_repo("/v2/coulomb/flex-auth/manifests/x"), "coulomb/flex-auth")
|
|
self.assertEqual(target_repo("/coulomb/activity-core@sha256:ab"), "coulomb/activity-core")
|
|
self.assertIsNone(target_repo("/user/login"))
|
|
|
|
def test_runtime_anonymous_pull(self):
|
|
rt = {"applications": [], "workloads": [{
|
|
"namespace": "ns", "kind": "Deployment", "name": "api", "image_pull_secret_names": [],
|
|
"images": ["forgejo.coulomb.social/coulomb/x@sha256:00"]}]}
|
|
(c,) = runtime_consumers(rt)
|
|
self.assertEqual(c["class"], "cluster-image-pull")
|
|
self.assertTrue(c["credential"].startswith("anonymous"))
|
|
self.assertEqual(c["target"], "coulomb/x")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|