test_q3_release_desktop_integration.py
python
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83
chore(governance): sync handover+roadmap to 84db8c8 (drift:…
Human
9 hours ago
| 1 | """Integration tests for Q3-release desktop installers (§QR.13).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from tests.fixtures.desktop_release import ( |
| 6 | BUNDLE_SCRIPT, |
| 7 | GIT_SHA_FIXTURE, |
| 8 | RELEASE_TEMPLATE, |
| 9 | RELEASE_WORKFLOW, |
| 10 | SMOKE_WORKFLOW, |
| 11 | sample_signed_artifacts, |
| 12 | ) |
| 13 | from tools.desktop_release.allowlist import refuse_disallowed_asset |
| 14 | from tools.desktop_release.constants import BUNDLE_ALLOWLIST_DIRS, BUNDLE_ALLOWLIST_FILES |
| 15 | from tools.desktop_release.manifest import build_manifest |
| 16 | from tools.desktop_release.workflow_lint import ( |
| 17 | assert_release_workflow_contract, |
| 18 | assert_smoke_workflow_contract, |
| 19 | assert_workflow_text_clean, |
| 20 | load_workflow, |
| 21 | workflow_references_secret_names, |
| 22 | ) |
| 23 | |
| 24 | |
| 25 | def test_release_workflow_parses_and_contracts() -> None: |
| 26 | data = load_workflow(RELEASE_WORKFLOW) |
| 27 | assert_release_workflow_contract(data) |
| 28 | assert_workflow_text_clean(RELEASE_WORKFLOW) |
| 29 | text = RELEASE_WORKFLOW.read_text(encoding="utf-8") |
| 30 | assert "macos-latest" not in text |
| 31 | assert "softprops/action-gh-release" in text |
| 32 | found = workflow_references_secret_names(text) |
| 33 | assert "APPLE_CERTIFICATE" in found |
| 34 | assert "WINDOWS_CERTIFICATE" in found |
| 35 | assert "LINUX_SIGNING_KEY" in found |
| 36 | assert "APPLE_API_KEY" in found |
| 37 | assert "APPLE_API_KEY_ID" in found |
| 38 | assert "APPLE_API_ISSUER" in found |
| 39 | |
| 40 | |
| 41 | def test_smoke_workflow_no_release_publish() -> None: |
| 42 | data = load_workflow(SMOKE_WORKFLOW) |
| 43 | assert_smoke_workflow_contract(data) |
| 44 | assert_workflow_text_clean(SMOKE_WORKFLOW) |
| 45 | |
| 46 | |
| 47 | def test_template_exists_and_references_secrets() -> None: |
| 48 | assert RELEASE_TEMPLATE.is_file() |
| 49 | text = RELEASE_TEMPLATE.read_text(encoding="utf-8") |
| 50 | assert "APPLE_CERTIFICATE" in text |
| 51 | assert "APPLE_API_KEY" in text |
| 52 | assert "WINDOWS_CERTIFICATE" in text |
| 53 | assert "LINUX_SIGNING_KEY" in text |
| 54 | assert_workflow_text_clean(RELEASE_TEMPLATE) |
| 55 | |
| 56 | |
| 57 | def test_bundle_script_closed_allowlist() -> None: |
| 58 | text = BUNDLE_SCRIPT.read_text(encoding="utf-8") |
| 59 | assert "bundle-desktop-kit" in BUNDLE_SCRIPT.name or BUNDLE_SCRIPT.name.endswith(".sh") |
| 60 | for dirname in BUNDLE_ALLOWLIST_DIRS: |
| 61 | assert dirname in text |
| 62 | for filename in BUNDLE_ALLOWLIST_FILES: |
| 63 | assert filename in text |
| 64 | assert ".env" not in text |
| 65 | assert "*.p12" not in text |
| 66 | assert "resources/kit" in text |
| 67 | |
| 68 | |
| 69 | def test_manifest_from_fixture_names() -> None: |
| 70 | doc = build_manifest( |
| 71 | version="0.1.0", |
| 72 | git_sha=GIT_SHA_FIXTURE, |
| 73 | artifacts=sample_signed_artifacts(), |
| 74 | ) |
| 75 | names = {a["filename"] for a in doc["artifacts"]} |
| 76 | assert any(n.endswith(".dmg") for n in names) |
| 77 | assert any(n.endswith(".msi") for n in names) |
| 78 | assert any(n.endswith(".AppImage") for n in names) |
| 79 | |
| 80 | |
| 81 | def test_publish_allowlist_rejects_deb_rpm() -> None: |
| 82 | for bad in ("pkg.deb", "pkg.rpm", "setup-unsigned.exe", "App.app.zip"): |
| 83 | try: |
| 84 | refuse_disallowed_asset(bad, version="0.1.0") |
| 85 | raise AssertionError(f"expected refuse for {bad}") |
| 86 | except Exception as exc: # AllowlistError |
| 87 | assert "allowlist" in str(exc).lower() or "not on allowlist" in str(exc) |
File History
1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199
fix(ISR): default require_independent_second_reviewer to require
Human
minor
⚠
9 hours ago