Spaces:
Running
Running
| import json | |
| import os | |
| from pathlib import Path | |
| import subprocess | |
| import pytest | |
| import bootstrap | |
| def pinned(tmp_path, monkeypatch): | |
| data = {"repository": bootstrap.REPOSITORY, "commit": "a" * 40, "version": "0.0.0"} | |
| (tmp_path / "core-revision.json").write_text(json.dumps(data)) | |
| monkeypatch.setattr(bootstrap, "ROOT", tmp_path) | |
| return data | |
| def test_missing_token_stops_before_fetch(tmp_path, monkeypatch): | |
| pinned(tmp_path, monkeypatch) | |
| monkeypatch.delenv("CORE_GITHUB_TOKEN", raising=False) | |
| with pytest.raises(RuntimeError, match="CORE_GITHUB_TOKEN"): | |
| bootstrap.install_core() | |
| def test_invalid_repository_is_rejected_before_credentials(tmp_path, monkeypatch): | |
| data = pinned(tmp_path, monkeypatch) | |
| data["repository"] = "https://example.com/private.git" | |
| (tmp_path / "core-revision.json").write_text(json.dumps(data)) | |
| with pytest.raises(ValueError, match="invalid pinned"): | |
| bootstrap.revision() | |
| def test_pin_and_credential_lifetime(tmp_path, monkeypatch, matches, existing_checkout): | |
| data = pinned(tmp_path, monkeypatch) | |
| monkeypatch.setenv("CORE_GITHUB_TOKEN", "test-secret") | |
| calls = [] | |
| if existing_checkout: | |
| (tmp_path / "core").mkdir() | |
| (tmp_path / "core/old-source").write_text("old checkout") | |
| def run(args, *, env=None, **kwargs): | |
| calls.append((args, dict(env))) | |
| assert "test-secret" not in " ".join(args) | |
| if args[:2] == ["git", "fetch"]: | |
| assert args[-1] == data["commit"] | |
| assert env["CORE_GITHUB_TOKEN"] == "test-secret" | |
| assert Path(env["GIT_ASKPASS"]).exists() | |
| else: | |
| assert "CORE_GITHUB_TOKEN" not in env | |
| if args[:2] == ["git", "init"]: | |
| (Path(args[-1]) / ".git").mkdir() | |
| if args[:2] == ["git", "rev-parse"]: | |
| return data["commit"] if matches else "b" * 40 | |
| return "" | |
| monkeypatch.setattr(bootstrap, "command", run) | |
| monkeypatch.setattr("importlib.metadata.version", lambda _: data["version"]) | |
| if matches: | |
| bootstrap.install_core() | |
| assert (tmp_path / "core").is_dir() | |
| assert not (tmp_path / "core/.git").exists() | |
| assert not (tmp_path / "core/old-source").exists() | |
| assert calls[-3][0][:3] == ["uv", "pip", "install"] | |
| assert calls[-2][0][0] == "bash" | |
| assert calls[-2][0][1].endswith("/source/native/build.sh") | |
| assert calls[-1][0][1] == "--version" | |
| assert Path(calls[-1][0][0]).name == "decompile-verify-declarations" | |
| else: | |
| with pytest.raises(RuntimeError, match="differs"): | |
| bootstrap.install_core() | |
| assert not any(args[0] == "uv" for args, _ in calls) | |
| assert "CORE_GITHUB_TOKEN" not in os.environ | |
| assert not Path(calls[2][1]["GIT_ASKPASS"]).exists() | |
| def test_git_errors_never_expose_credentials(monkeypatch): | |
| def fail(*args, **kwargs): | |
| raise subprocess.CalledProcessError(1, args[0], stderr="test-secret") | |
| monkeypatch.setattr(subprocess, "run", fail) | |
| with pytest.raises(RuntimeError) as error: | |
| bootstrap.command(["git", "fetch"]) | |
| assert "test-secret" not in str(error.value) | |
| def test_recorded_revision_matches_gitlink(): | |
| root = Path(__file__).resolve().parents[1] | |
| stage = subprocess.check_output(["git", "ls-files", "--stage", "core"], cwd=root, text=True) | |
| mode, commit, rest = stage.split(maxsplit=2) | |
| assert mode == "160000" | |
| assert commit == bootstrap.revision()["commit"] | |