Reject unfinished or truncated Forgejo backup archives before encryption

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

tests/test_forgejo_archive_integrity.py

@@ -0,0 +1,24 @@
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from zipfile import ZipFile, BadZipFile
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'scripts'))
+from capture_forgejo_archive import validate_archive
+
+class ArchiveIntegrity(unittest.TestCase):
+    def test_complete_archive(self):
+        with tempfile.TemporaryDirectory() as d:
+            p=Path(d)/'backup.zip'
+            with ZipFile(p,'w') as z:
+                z.writestr('forgejo-db.sql','SELECT 1;')
+                z.writestr('repos/example.git/HEAD','ref: refs/heads/main')
+            validate_archive(p)
+            p.write_bytes(p.read_bytes()[:-22])
+            with self.assertRaises(BadZipFile): validate_archive(p)
+
+    def test_missing_database_rejected(self):
+        with tempfile.TemporaryDirectory() as d:
+            p=Path(d)/'backup.zip'
+            with ZipFile(p,'w') as z: z.writestr('repos/example.git/HEAD','x')
+            with self.assertRaises(ValueError): validate_archive(p)