211 lines
9.1 KiB
Python
211 lines
9.1 KiB
Python
"""US08-04: the deployment pipeline's contract, read from the workflow files.
|
|
|
|
A CI/CD pipeline is the one piece of this repository whose failure mode is silence.
|
|
A renamed workflow, a renamed job, a trigger that quietly stopped matching, and the
|
|
suite is no longer between `main` and the registry — with nothing red anywhere to say
|
|
so. So the link is asserted from both ends here: the deploy workflow waits for the
|
|
test workflow *by name*, and that name is read out of the test workflow itself.
|
|
|
|
The same applies to the commands: `work_item/.work-item.yml` is where the required
|
|
suites are configured, and the test workflow has to run those, not a copy of them that
|
|
was true once.
|
|
|
|
Nothing here talks to Gitea, the registry, or Portainer. What is checkable offline is
|
|
what the files promise; whether the runner honours them is the deployment's own
|
|
evidence (US08-05).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
REPO = Path(__file__).resolve().parents[2]
|
|
WORKFLOWS = REPO / ".gitea" / "workflows"
|
|
TEST_FILE = WORKFLOWS / "test.yml"
|
|
DEPLOY_FILE = WORKFLOWS / "deploy.yml"
|
|
|
|
TEST_WORKFLOW = yaml.safe_load(TEST_FILE.read_text())
|
|
DEPLOY_WORKFLOW = yaml.safe_load(DEPLOY_FILE.read_text())
|
|
WORK_ITEM = yaml.safe_load((REPO / "work_item" / ".work-item.yml").read_text())
|
|
|
|
REGISTRY = "git.domverse-berlin.eu"
|
|
|
|
|
|
def triggers(workflow: dict) -> dict:
|
|
"""The `on:` block. PyYAML resolves the bare key `on` to ``True``."""
|
|
return workflow[True] if True in workflow else workflow["on"]
|
|
|
|
|
|
def steps(workflow: dict, job: str) -> list[dict]:
|
|
return workflow["jobs"][job]["steps"]
|
|
|
|
|
|
def run_script(workflow: dict, job: str) -> str:
|
|
"""Every `run:` in a job, as one blob — what the runner would execute."""
|
|
return "\n".join(step["run"] for step in steps(workflow, job) if "run" in step)
|
|
|
|
|
|
# ── the gate ─────────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_the_test_workflow_runs_on_pull_requests_and_on_main():
|
|
on = triggers(TEST_WORKFLOW)
|
|
assert "pull_request" in on
|
|
assert on["push"]["branches"] == ["main"]
|
|
|
|
|
|
def test_the_test_workflow_runs_the_configured_required_suites():
|
|
required = WORK_ITEM["workflow"]["required_tests"]
|
|
assert required, "the helper's required tests are what CI exists to run"
|
|
script = run_script(TEST_WORKFLOW, "suites")
|
|
for command in required:
|
|
assert command in script, f"CI does not run the configured suite: {command}"
|
|
|
|
|
|
def test_the_deploy_workflow_waits_for_the_test_workflow_by_its_real_name():
|
|
# Renaming either side without the other breaks this, which is the point: an
|
|
# unmatched `workflow_run` filter does not fail, it simply never fires.
|
|
awaited = triggers(DEPLOY_WORKFLOW)["workflow_run"]
|
|
assert awaited["workflows"] == [TEST_WORKFLOW["name"]]
|
|
assert awaited["types"] == ["completed"]
|
|
assert awaited["branches"] == ["main"], "only main is deployable"
|
|
|
|
|
|
def test_publishing_requires_the_test_run_to_have_succeeded_and_not_merely_finished():
|
|
condition = DEPLOY_WORKFLOW["jobs"]["publish"]["if"]
|
|
assert "workflow_run.conclusion == 'success'" in condition
|
|
# `completed` includes failure and cancellation; the conclusion check is the gate.
|
|
assert "gitea.event_name == 'workflow_run'" in condition
|
|
|
|
|
|
def test_the_deploy_workflow_can_also_be_dispatched_by_hand():
|
|
assert "workflow_dispatch" in triggers(DEPLOY_WORKFLOW)
|
|
|
|
|
|
# ── what is published ────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_the_image_is_published_under_this_project_s_own_path():
|
|
slug = WORK_ITEM["repository"]["slug"]
|
|
assert DEPLOY_WORKFLOW["env"]["IMAGE"] == f"{REGISTRY}/{slug}"
|
|
|
|
|
|
def test_both_latest_and_the_commit_are_pushed_so_a_rollback_is_a_tag_change():
|
|
script = run_script(DEPLOY_WORKFLOW, "publish")
|
|
assert 'docker push "$IMAGE:$SHA"' in script
|
|
assert 'docker push "$IMAGE:latest"' in script
|
|
# A `latest` without its commit tag would be a version that cannot be rolled back to.
|
|
assert script.index('docker push "$IMAGE:$SHA"') < script.index('docker push "$IMAGE:latest"')
|
|
|
|
|
|
def test_the_published_commit_is_the_one_that_was_tested():
|
|
assert DEPLOY_WORKFLOW["env"]["SHA"].startswith("${{ gitea.event.workflow_run.head_sha")
|
|
checkout = steps(DEPLOY_WORKFLOW, "publish")[0]
|
|
assert checkout["with"]["ref"] == "${{ env.SHA }}"
|
|
|
|
|
|
# ── secrets ──────────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_registry_credentials_and_the_webhook_come_from_repository_secrets():
|
|
script = run_script(DEPLOY_WORKFLOW, "publish")
|
|
for secret in ("REGISTRY_USER", "REGISTRY_TOKEN", "PORTAINER_WEBHOOK_URL"):
|
|
assert f"secrets.{secret}" in script
|
|
|
|
|
|
def test_no_runtime_secret_is_named_by_the_pipeline_at_all():
|
|
# The vision key, the Immich key, and the access secret belong to the Portainer
|
|
# stack. A workflow that mentions one is a workflow that could carry one.
|
|
text = TEST_FILE.read_text() + DEPLOY_FILE.read_text()
|
|
for runtime_secret in (
|
|
"PHOTO_PIPELINE_VISION_API_KEY",
|
|
"PHOTO_PIPELINE_IMMICH_API_KEY",
|
|
"PHOTO_PIPELINE_ACCESS_SECRET",
|
|
):
|
|
assert runtime_secret not in text
|
|
|
|
|
|
def test_the_workflows_carry_no_credential_values():
|
|
text = TEST_FILE.read_text() + DEPLOY_FILE.read_text()
|
|
for line in text.splitlines():
|
|
if re.search(r"(?i)(token|secret|password|api[_-]?key)\s*[:=]", line):
|
|
assert "${{ secrets." in line or line.lstrip().startswith("#"), line
|
|
|
|
|
|
def test_the_registry_password_is_never_an_argument():
|
|
# An argument is visible in the runner's process list and in `docker login`'s own
|
|
# warning; stdin is not.
|
|
script = run_script(DEPLOY_WORKFLOW, "publish") + run_script(DEPLOY_WORKFLOW, "dry-run")
|
|
assert "--password-stdin" in script
|
|
assert "--password " not in script
|
|
|
|
|
|
# ── redeploy, pruning, and overlap ───────────────────────────────────────────
|
|
|
|
|
|
def test_a_failed_webhook_call_fails_the_workflow():
|
|
webhook = next(
|
|
step
|
|
for step in steps(DEPLOY_WORKFLOW, "publish")
|
|
if "PORTAINER_WEBHOOK_URL" in step.get("run", "")
|
|
)
|
|
assert "--fail" in webhook["run"], "curl exits 0 on an HTTP 500 without it"
|
|
assert "-k" not in webhook["run"].split(), "the redeploy call verifies TLS"
|
|
|
|
|
|
def test_pruning_removes_dangling_layers_and_never_published_tags():
|
|
for job in ("publish", "dry-run"):
|
|
script = run_script(DEPLOY_WORKFLOW, job)
|
|
assert "docker image prune -f" in script
|
|
assert "prune -a" not in script and "--all" not in script
|
|
|
|
|
|
def test_two_deploys_of_different_commits_cannot_overlap():
|
|
guard = DEPLOY_WORKFLOW["concurrency"]
|
|
assert "sha" not in guard["group"].lower(), "a per-commit group guards nothing"
|
|
assert guard["cancel-in-progress"] is False, "a cancelled push leaves half a tag set"
|
|
|
|
|
|
# ── the dry run ──────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_the_dry_run_is_manual_only_and_defaults_to_on():
|
|
condition = DEPLOY_WORKFLOW["jobs"]["dry-run"]["if"]
|
|
assert condition == "gitea.event_name == 'workflow_dispatch' && inputs.dry_run"
|
|
dispatch = triggers(DEPLOY_WORKFLOW)["workflow_dispatch"]
|
|
assert dispatch["inputs"]["dry_run"]["default"] is True
|
|
assert dispatch["inputs"]["dry_run"]["type"] == "boolean"
|
|
|
|
|
|
def test_the_dry_run_publishes_a_scratch_tag_and_nothing_else():
|
|
script = run_script(DEPLOY_WORKFLOW, "dry-run")
|
|
assert 'docker push "$IMAGE:scratch-$SHA"' in script
|
|
assert ":latest" not in script, "a dry run that moves latest is a deploy"
|
|
assert "PORTAINER_WEBHOOK_URL" not in script, "a dry run never redeploys the stack"
|
|
|
|
|
|
def test_a_manual_deploy_is_the_deliberate_choice_not_the_default():
|
|
publish = DEPLOY_WORKFLOW["jobs"]["publish"]["if"]
|
|
assert "inputs.dry_run == false" in publish
|
|
|
|
|
|
# ── the files themselves ─────────────────────────────────────────────────────
|
|
|
|
|
|
def test_every_workflow_file_parses_and_declares_a_name_a_trigger_and_a_job():
|
|
files = sorted(WORKFLOWS.glob("*.yml")) + sorted(WORKFLOWS.glob("*.yaml"))
|
|
assert {path.name for path in files} == {"test.yml", "deploy.yml"}
|
|
for path in files:
|
|
workflow = yaml.safe_load(path.read_text())
|
|
assert workflow["name"], path
|
|
assert triggers(workflow), path
|
|
assert workflow["jobs"], path
|
|
for job_name, job in workflow["jobs"].items():
|
|
assert job["runs-on"], f"{path}:{job_name}"
|
|
assert job["steps"], f"{path}:{job_name}"
|
|
for step in job["steps"]:
|
|
assert step.get("name"), f"{path}:{job_name} has an unnamed step"
|