Enforce private-by-default enablement templates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

tests/test_private_defaults.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "tools"))
+
+from check_private_defaults import violations  # noqa: E402
+
+
+class PrivateDefaultsTests(unittest.TestCase):
+    def check(self, text: str) -> list[str]:
+        with tempfile.TemporaryDirectory() as temp:
+            path = Path(temp) / "template.yaml"
+            path.write_text(text, encoding="utf-8")
+            return violations([path])
+
+    def test_build_workflow_is_allowed(self) -> None:
+        self.assertEqual([], self.check("jobs:\n  build:\n    runs-on: container-build\n"))
+
+    def test_ingress_is_rejected(self) -> None:
+        self.assertTrue(self.check("apiVersion: networking.k8s.io/v1\nkind: Ingress\n"))
+
+    def test_public_service_is_rejected(self) -> None:
+        self.assertTrue(self.check("kind: Service\nspec:\n  type: LoadBalancer\n"))
+
+    def test_direct_apply_is_rejected(self) -> None:
+        self.assertTrue(self.check("run: kubectl apply -f deployment.yaml\n"))
+
+
+if __name__ == "__main__":
+    unittest.main()