| """Guards on the locked test dependency set (``constraints-test.txt``). |
| |
| The bootstrap scripts install the test extras against this pinned lock, so |
| every fresh ``.venv`` is reproducible and ``pip-audit``-verifiable. These |
| tests fail loudly if the lock drifts out of sync with the ``[test]`` extras |
| declared in ``pyproject.toml`` (e.g. an extra was added without re-locking). |
| """ |
| from __future__ import annotations |
|
|
| import re |
| import sys |
| from pathlib import Path |
|
|
| if sys.version_info >= (3, 11): |
| import tomllib |
| else: |
| import tomli as tomllib |
|
|
| REPO_ROOT = Path(__file__).resolve().parents[2] |
| CONSTRAINTS = REPO_ROOT / "constraints-test.txt" |
| PYPROJECT = REPO_ROOT / "pyproject.toml" |
|
|
|
|
| def _canonical(name: str) -> str: |
| """PEP 503 normalised distribution name.""" |
| return re.sub(r"[-_.]+", "-", name).strip().lower() |
|
|
|
|
| def _pinned_names() -> dict[str, str]: |
| """Map canonical distribution name -> exact version from the lock.""" |
| pins: dict[str, str] = {} |
| for raw in CONSTRAINTS.read_text(encoding="utf-8").splitlines(): |
| line = raw.strip() |
| if not line or line.startswith("#"): |
| continue |
| assert "==" in line, f"constraint not pinned with '==': {line!r}" |
| name, version = line.split("==", 1) |
| pins[_canonical(name)] = version.strip() |
| return pins |
|
|
|
|
| def _test_extra_names() -> list[str]: |
| data = tomllib.loads(PYPROJECT.read_text(encoding="utf-8")) |
| extras = data["project"]["optional-dependencies"]["test"] |
| return [_canonical(re.split(r"[<>=!~;\[ ]", spec, maxsplit=1)[0]) for spec in extras] |
|
|
|
|
| def test_constraints_file_exists_and_nonempty(): |
| assert CONSTRAINTS.is_file(), "constraints-test.txt is missing" |
| assert _pinned_names(), "constraints-test.txt has no pinned entries" |
|
|
|
|
| def test_no_editable_or_self_package_leaked(): |
| text = CONSTRAINTS.read_text(encoding="utf-8") |
| assert "-e " not in text, "an editable install leaked into the lock" |
| assert "koolook" not in _pinned_names(), "the self package leaked into the lock" |
|
|
|
|
| def test_every_top_level_test_extra_is_pinned(): |
| pins = _pinned_names() |
| missing = [name for name in _test_extra_names() if name not in pins] |
| assert not missing, ( |
| f"these [test] extras are not pinned in constraints-test.txt: {missing}. " |
| "Regenerate the lock: bash scripts/bootstrap_test_env.sh --force --relock" |
| ) |
|
|
|
|
| def test_no_duplicate_pins(): |
| names: list[str] = [] |
| for raw in CONSTRAINTS.read_text(encoding="utf-8").splitlines(): |
| line = raw.strip() |
| if line and not line.startswith("#"): |
| names.append(_canonical(line.split("==", 1)[0])) |
| dupes = sorted({name for name in names if names.count(name) > 1}) |
| assert not dupes, f"duplicate pins in constraints-test.txt: {dupes}" |
|
|
|
|
| def test_bootstrap_upgrades_setuptools_before_audit(): |
| """Fresh venvs should not fail audit on the ensurepip setuptools seed.""" |
| ps1 = (REPO_ROOT / "scripts" / "bootstrap_test_env.ps1").read_text(encoding="utf-8") |
| sh = (REPO_ROOT / "scripts" / "bootstrap_test_env.sh").read_text(encoding="utf-8") |
|
|
| assert "--upgrade pip setuptools" in ps1 |
| assert "--upgrade pip setuptools" in sh |
|
|
|
|
| def test_bootstrap_relock_does_not_inspect_editable_git_metadata(): |
| """Relock should work from cross-drive git worktrees on Windows.""" |
| ps1 = (REPO_ROOT / "scripts" / "bootstrap_test_env.ps1").read_text(encoding="utf-8") |
| sh = (REPO_ROOT / "scripts" / "bootstrap_test_env.sh").read_text(encoding="utf-8") |
|
|
| assert "pip list --format=freeze" in ps1 |
| assert "pip list --format=freeze" in sh |
| assert "pip freeze --exclude-editable" not in ps1 |
| assert "pip freeze --exclude-editable" not in sh |
|
|
|
|
| def test_ci_audits_committed_lock_on_prs_and_schedule(): |
| ci = (REPO_ROOT / ".github" / "workflows" / "ci.yml").read_text(encoding="utf-8") |
|
|
| assert "schedule:" in ci |
| assert "pip-audit -r constraints-test.txt" in ci |
|
|
|
|
| def test_ci_pytest_installs_from_committed_lock(): |
| ci = (REPO_ROOT / ".github" / "workflows" / "ci.yml").read_text(encoding="utf-8") |
|
|
| assert '-e ".[test]" -c constraints-test.txt' in ci |
|
|
