mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Myasnikov DaniilandClaude Opus 4.8
056ff92e16
Add hack/common-envs_test.bats (runs under make bats-unit-tests). For a representative slice of the root build: matrix — including the two recipes that previously slipped through, capi-providers-cpprovider and core/talos — it asserts that under OCI_EXPORT_DIR each built image emits exactly one --output type=oci and no ungated docker:// push, and that capi emits a single --tag. This would have caught the talos-push and capi-two-tag regressions. Refs: #3257 Assisted-By: Claude <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
63 lines
4.1 KiB
Bash
63 lines
4.1 KiB
Bash
#!/usr/bin/env bats
|
|
# Unit tests for the OCI_EXPORT_DIR export mode wired through hack/common-envs.mk
|
|
# (#3257). A fork PR's unprivileged `pull_request` build carries no registry
|
|
# credentials, so it must export every image to a per-image OCI archive instead
|
|
# of pushing; a privileged workflow_run (e2e-fork.yaml) later pushes those
|
|
# archives to OCIR by digest. A build unit that pushes anyway dies on a fork with
|
|
# an anonymous-push `denied`, so these tests dry-run (`make -n`) a representative
|
|
# set of the root `build:` units with OCI_EXPORT_DIR set and assert that every
|
|
# image is exported as an archive and no (ungated) `docker://` push survives.
|
|
#
|
|
# Coverage includes the two units the fork split originally broke — talos (a
|
|
# skopeo copy that bypasses the image-tags macro) and capi-providers-cpprovider
|
|
# (a two-`--tag` buildx call that put two manifests in one OCI archive) — plus a
|
|
# plain image-tags package (cozystack-controller) as the happy path.
|
|
#
|
|
# Run via hack/cozytest.sh from the repo root (make bats-unit-tests): the
|
|
# relative `make -C packages/...` calls resolve against that cwd. This is NOT
|
|
# real bats — no run/$status/$output/setup(); use plain $(...) capture + grep,
|
|
# and the build-matrix_test.bats `if grep -q …; then echo FAIL; false; fi`
|
|
# negation idiom (cozytest runs each @test under `set -e`, which suppresses a
|
|
# bare `!`-negated pipeline, so a regression would silently pass a `! grep`).
|
|
|
|
@test "cozystack-controller exports one OCI archive and never pushes under OCI_EXPORT_DIR" {
|
|
out=$(make -n -C packages/system/cozystack-controller image OCI_EXPORT_DIR=/tmp/ocitest IMAGE_TAG=pr-1-abc BUILDER=b)
|
|
# Exactly one per-image OCI archive export for the single built image.
|
|
n=$(echo "$out" | grep -c -- '--output type=oci,dest=' || true)
|
|
[ "$n" -eq 1 ]
|
|
echo "$out" | grep -q -- '--output type=oci,dest=/tmp/ocitest/cozystack-controller.oci.tar'
|
|
# A plain image-tags package routes every tag through the macro, so under
|
|
# export there is no docker:// ref at all.
|
|
if echo "$out" | grep -q 'docker://'; then echo "FAIL: cozystack-controller must not push under OCI_EXPORT_DIR"; false; fi
|
|
}
|
|
|
|
@test "capi-providers-cpprovider exports one OCI archive with a single tag under OCI_EXPORT_DIR" {
|
|
out=$(make -n -C packages/system/capi-providers-cpprovider image OCI_EXPORT_DIR=/tmp/ocitest IMAGE_TAG=pr-1-abc BUILDER=b)
|
|
# Exactly one per-image OCI archive export.
|
|
n=$(echo "$out" | grep -c -- '--output type=oci,dest=' || true)
|
|
[ "$n" -eq 1 ]
|
|
echo "$out" | grep -q -- '--output type=oci,dest=/tmp/ocitest/cluster-api-control-plane-provider-kamaji.oci.tar'
|
|
# The two-tag regression: under `--output type=oci` both --tag refs land in
|
|
# index.json → two manifests → `skopeo copy oci-archive:…` fails with "more
|
|
# than one image in oci". Exactly one --tag must survive under export.
|
|
tags=$(echo "$out" | grep -c -- '--tag' || true)
|
|
[ "$tags" -eq 1 ]
|
|
if echo "$out" | grep -q 'docker://'; then echo "FAIL: capi-providers-cpprovider must not push under OCI_EXPORT_DIR"; false; fi
|
|
}
|
|
|
|
@test "talos exports matchbox + talos archives and never pushes an ungated image under OCI_EXPORT_DIR" {
|
|
out=$(make -n -C packages/core/talos image OCI_EXPORT_DIR=/tmp/ocitest IMAGE_TAG=pr-1-abc BUILDER=b)
|
|
# matchbox is a buildx call through image-tags → one --output type=oci archive.
|
|
echo "$out" | grep -q -- '--output type=oci,dest=/tmp/ocitest/matchbox.oci.tar'
|
|
# talos is a skopeo copy that bypasses image-tags; under export it must target
|
|
# an oci-archive whose basename is `talos` (the OCIR repo e2e-fork.yaml pushes
|
|
# to by basename), NOT a docker:// registry (an anonymous push on a fork dies
|
|
# with `denied` — #3257).
|
|
echo "$out" | grep -q 'oci-archive:/tmp/ocitest/talos.oci.tar'
|
|
# No push survives export except the PUBLISH_*=1-gated release copies, which
|
|
# are inert here: a fork build never sets PUBLISH_*, so the shell gate expands
|
|
# to `[ "0" = "1" ]`. Anything else pushing to docker:// is the regression.
|
|
pushes=$(echo "$out" | grep 'docker://' | grep -v '"0" = "1"' || true)
|
|
if [ -n "$pushes" ]; then echo "FAIL: talos pushes an ungated image under OCI_EXPORT_DIR: $pushes"; false; fi
|
|
}
|