Spaces:
Running
Running
File size: 3,595 Bytes
b727f11 5423dad b727f11 5423dad b727f11 5423dad b727f11 5423dad f1b51ae b727f11 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 | import json
import os
from pathlib import Path
import subprocess
import pytest
import bootstrap
def pinned(tmp_path, monkeypatch):
data = {"repository": bootstrap.REPOSITORY, "commit": "a" * 40, "version": "0.0.0"}
(tmp_path / "core-revision.json").write_text(json.dumps(data))
monkeypatch.setattr(bootstrap, "ROOT", tmp_path)
return data
def test_missing_token_stops_before_fetch(tmp_path, monkeypatch):
pinned(tmp_path, monkeypatch)
monkeypatch.delenv("CORE_GITHUB_TOKEN", raising=False)
with pytest.raises(RuntimeError, match="CORE_GITHUB_TOKEN"):
bootstrap.install_core()
def test_invalid_repository_is_rejected_before_credentials(tmp_path, monkeypatch):
data = pinned(tmp_path, monkeypatch)
data["repository"] = "https://example.com/private.git"
(tmp_path / "core-revision.json").write_text(json.dumps(data))
with pytest.raises(ValueError, match="invalid pinned"):
bootstrap.revision()
@pytest.mark.parametrize("matches", [True, False])
@pytest.mark.parametrize("existing_checkout", [False, True])
def test_pin_and_credential_lifetime(tmp_path, monkeypatch, matches, existing_checkout):
data = pinned(tmp_path, monkeypatch)
monkeypatch.setenv("CORE_GITHUB_TOKEN", "test-secret")
calls = []
if existing_checkout:
(tmp_path / "core").mkdir()
(tmp_path / "core/old-source").write_text("old checkout")
def run(args, *, env=None, **kwargs):
calls.append((args, dict(env)))
assert "test-secret" not in " ".join(args)
if args[:2] == ["git", "fetch"]:
assert args[-1] == data["commit"]
assert env["CORE_GITHUB_TOKEN"] == "test-secret"
assert Path(env["GIT_ASKPASS"]).exists()
else:
assert "CORE_GITHUB_TOKEN" not in env
if args[:2] == ["git", "init"]:
(Path(args[-1]) / ".git").mkdir()
if args[:2] == ["git", "rev-parse"]:
return data["commit"] if matches else "b" * 40
return ""
monkeypatch.setattr(bootstrap, "command", run)
monkeypatch.setattr("importlib.metadata.version", lambda _: data["version"])
if matches:
bootstrap.install_core()
assert (tmp_path / "core").is_dir()
assert not (tmp_path / "core/.git").exists()
assert not (tmp_path / "core/old-source").exists()
assert calls[-3][0][:3] == ["uv", "pip", "install"]
assert calls[-2][0][0] == "bash"
assert calls[-2][0][1].endswith("/source/native/build.sh")
assert calls[-1][0][1] == "--version"
assert Path(calls[-1][0][0]).name == "decompile-verify-declarations"
else:
with pytest.raises(RuntimeError, match="differs"):
bootstrap.install_core()
assert not any(args[0] == "uv" for args, _ in calls)
assert "CORE_GITHUB_TOKEN" not in os.environ
assert not Path(calls[2][1]["GIT_ASKPASS"]).exists()
def test_git_errors_never_expose_credentials(monkeypatch):
def fail(*args, **kwargs):
raise subprocess.CalledProcessError(1, args[0], stderr="test-secret")
monkeypatch.setattr(subprocess, "run", fail)
with pytest.raises(RuntimeError) as error:
bootstrap.command(["git", "fetch"])
assert "test-secret" not in str(error.value)
def test_recorded_revision_matches_gitlink():
root = Path(__file__).resolve().parents[1]
stage = subprocess.check_output(["git", "ls-files", "--stage", "core"], cwd=root, text=True)
mode, commit, rest = stage.split(maxsplit=2)
assert mode == "160000"
assert commit == bootstrap.revision()["commit"]
|