test_q3_release_desktop_e2e.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """End-to-end tests for Q3-release desktop installers (§QR.13).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import json |
| 6 | from pathlib import Path |
| 7 | |
| 8 | import pytest |
| 9 | |
| 10 | from tests.fixtures.desktop_release import ( |
| 11 | GIT_SHA_FIXTURE, |
| 12 | PUBLIC_KEY, |
| 13 | RUNBOOK, |
| 14 | sample_signed_artifacts, |
| 15 | write_artifact_files, |
| 16 | ) |
| 17 | from tests.support import KIT_ROOT |
| 18 | from tools.desktop_release.checksums import parse_sha256sums |
| 19 | from tools.desktop_release.constants import MANIFEST_FILENAME_TEMPLATE, SHA256SUMS_FILENAME |
| 20 | from tools.desktop_release.finalize import ArtifactInput, FinalizeError, finalize_release_artifacts |
| 21 | from tools.desktop_release.manifest import validate_manifest |
| 22 | |
| 23 | |
| 24 | FULL_SECRETS = { |
| 25 | "APPLE_CERTIFICATE": True, |
| 26 | "APPLE_CERTIFICATE_PASSWORD": True, |
| 27 | "APPLE_ID": True, |
| 28 | "APPLE_TEAM_ID": True, |
| 29 | "APPLE_APP_SPECIFIC_PASSWORD": True, |
| 30 | "APPLE_SIGNING_IDENTITY": True, |
| 31 | "WINDOWS_CERTIFICATE": True, |
| 32 | "WINDOWS_CERTIFICATE_PASSWORD": True, |
| 33 | "LINUX_SIGNING_KEY": True, |
| 34 | } |
| 35 | |
| 36 | |
| 37 | def test_finalize_round_trip(tmp_path: Path) -> None: |
| 38 | arts = sample_signed_artifacts() |
| 39 | paths = write_artifact_files(tmp_path / "bins", arts) |
| 40 | inputs = [ |
| 41 | ArtifactInput( |
| 42 | platform=a["platform"], |
| 43 | path=p, |
| 44 | signing_status="signed", |
| 45 | signing_method=a["signing"]["method"], |
| 46 | arch=a.get("arch"), |
| 47 | ) |
| 48 | for a, p in zip(arts, paths, strict=True) |
| 49 | ] |
| 50 | out = tmp_path / "dist" |
| 51 | manifest = finalize_release_artifacts( |
| 52 | version="0.1.0", |
| 53 | git_sha=GIT_SHA_FIXTURE, |
| 54 | artifacts=inputs, |
| 55 | output_dir=out, |
| 56 | publish=True, |
| 57 | secrets_present=FULL_SECRETS, |
| 58 | ) |
| 59 | validate_manifest(manifest) |
| 60 | manifest_path = out / MANIFEST_FILENAME_TEMPLATE.format(version="0.1.0") |
| 61 | assert manifest_path.is_file() |
| 62 | sums_path = out / SHA256SUMS_FILENAME |
| 63 | parsed = parse_sha256sums(sums_path.read_text(encoding="utf-8")) |
| 64 | for entry in manifest["artifacts"]: |
| 65 | assert parsed[entry["filename"]] == entry["sha256"] |
| 66 | # Round-trip JSON |
| 67 | reload = json.loads(manifest_path.read_text(encoding="utf-8")) |
| 68 | validate_manifest(reload) |
| 69 | |
| 70 | |
| 71 | def test_finalize_refuses_missing_apple_secret(tmp_path: Path) -> None: |
| 72 | arts = sample_signed_artifacts()[:1] |
| 73 | paths = write_artifact_files(tmp_path / "bins", arts) |
| 74 | secrets = dict(FULL_SECRETS) |
| 75 | secrets["APPLE_CERTIFICATE"] = False |
| 76 | secrets["APPLE_API_KEY"] = False |
| 77 | with pytest.raises(FinalizeError, match="Apple"): |
| 78 | finalize_release_artifacts( |
| 79 | version="0.1.0", |
| 80 | git_sha=GIT_SHA_FIXTURE, |
| 81 | artifacts=[ |
| 82 | ArtifactInput( |
| 83 | platform="macos", |
| 84 | path=paths[0], |
| 85 | signing_status="signed", |
| 86 | signing_method="developer_id_notarized", |
| 87 | ) |
| 88 | ], |
| 89 | output_dir=tmp_path / "dist", |
| 90 | publish=True, |
| 91 | secrets_present=secrets, |
| 92 | ) |
| 93 | |
| 94 | |
| 95 | def test_runbook_honesty_and_python_prerequisite() -> None: |
| 96 | text = RUNBOOK.read_text(encoding="utf-8") |
| 97 | assert "Python 3.11+" in text |
| 98 | assert "Signed installers" in text or "signed installers" in text.lower() |
| 99 | assert "detached" in text.lower() |
| 100 | assert "AppImage" in text |
| 101 | # Win/Linux still unavailable as primary CTAs; Mac signed .dmg may already be live. |
| 102 | assert ( |
| 103 | "Not available" in text |
| 104 | or "not available" in text.lower() |
| 105 | or "unavailable" in text.lower() |
| 106 | or "until a GitHub Release" in text |
| 107 | ) |
| 108 | assert PUBLIC_KEY.is_file() |
| 109 | |
| 110 | |
| 111 | def test_track_q_api_allowlist_untouched() -> None: |
| 112 | """Q3-release must not mutate Track Q closed api/* surfaces.""" |
| 113 | server = KIT_ROOT / "tools" / "app" / "server.py" |
| 114 | assert server.is_file() |
| 115 | text = server.read_text(encoding="utf-8") |
| 116 | assert '("/api/health")' in text or "/api/health" in text |
| 117 | assert "/api/status" in text |
| 118 | # desktop_release must not import or rewrite tools.app |
| 119 | release_pkg = KIT_ROOT / "tools" / "desktop_release" |
| 120 | for path in release_pkg.rglob("*.py"): |
| 121 | src = path.read_text(encoding="utf-8") |
| 122 | assert "tools.app" not in src |
| 123 | assert "from tools.app" not in src |
| 124 | assert "import tools.app" not in src |
| 125 | |
| 126 | |
| 127 | def test_bundle_refuses_env_outside_allowlist(tmp_path: Path) -> None: |
| 128 | """Fresh destination after a dry closed-allowlist copy omits .env.""" |
| 129 | dest = tmp_path / "kit" |
| 130 | dest.mkdir() |
| 131 | # Simulate closed allowlist: only copy VERSION (never .env). |
| 132 | (KIT_ROOT / "VERSION").read_text(encoding="utf-8") |
| 133 | (dest / "VERSION").write_text("0.1.0\n", encoding="utf-8") |
| 134 | planted = tmp_path / ".env" |
| 135 | planted.write_text("SECRET=1\n", encoding="utf-8") |
| 136 | assert not (dest / ".env").exists() |
| 137 | assert "SECRET" not in "\n".join(p.read_text(encoding="utf-8") for p in dest.rglob("*") if p.is_file()) |