ksv741
3eafad2657
Frontend security / security (push) Successful in 9s
Frontend verify / verify (push) Failing after 37m50s
Frontend security / security (pull_request) Successful in 9s
Frontend verify / verify (pull_request) Failing after 42m10s
Conventional commits / commits (pull_request) Successful in 29s
Enable every plugin recommended preset and replace Biome with ESLint formatting. Preserve API contracts and JSX whitespace; verify source, tests, builds and tooling.
80 lines
3.2 KiB
JavaScript
80 lines
3.2 KiB
JavaScript
const assert = require("node:assert/strict");
|
||
const {
|
||
chmodSync,
|
||
mkdtempSync,
|
||
readFileSync,
|
||
rmSync,
|
||
writeFileSync,
|
||
} = require("node:fs");
|
||
const { tmpdir } = require("node:os");
|
||
const nodePath = require("node:path");
|
||
const { test } = require("node:test");
|
||
const EXECUTABLE_MODE = 0o755;
|
||
const { spawnSync } = require("node:child_process");
|
||
|
||
test("immutable publication resumes exact digest checks after post-push failure", () => {
|
||
const directory = mkdtempSync(nodePath.join(tmpdir(), "wl-image-retry-"));
|
||
const workflow = readFileSync(
|
||
nodePath.resolve(__dirname, "../.gitea/workflows/image.yml"),
|
||
"utf8",
|
||
);
|
||
const block = workflow
|
||
.split(" - name: Publish immutable release tag\n run: |\n", 2)[1]
|
||
.split(" - name:", 1)[0]
|
||
.replaceAll(/^ {10}/gm, "");
|
||
const double = String.raw`#!${process.execPath}
|
||
const fs = require('node:fs');
|
||
const args = process.argv.slice(2).join(' ');
|
||
fs.appendFileSync('calls', args + '\n');
|
||
if (args.startsWith('manifest inspect')) {
|
||
if (!fs.existsSync('published')) { console.error('manifest unknown'); process.exit(1); }
|
||
} else if (args.startsWith('buildx imagetools inspect')) {
|
||
console.log('sha256:exact');
|
||
} else if (args.startsWith('buildx build')) {
|
||
fs.writeFileSync('published', 'yes');
|
||
fs.writeFileSync('image-metadata.json', JSON.stringify({'containerimage.digest': 'sha256:exact'}));
|
||
} else if (args.startsWith('pull')) {
|
||
if (!fs.existsSync('pull-failed')) { fs.writeFileSync('pull-failed', 'yes'); process.exit(1); }
|
||
} else if (args.startsWith('image inspect')) {
|
||
console.log(args.includes('image.version') ? '1.2.3' : process.env.BAD_REVISION ? 'other' : 'commit');
|
||
} else if (args.startsWith('run') && process.env.BAD_SMOKE) process.exit(1);
|
||
`;
|
||
try {
|
||
for (const name of ["docker", "npm"]) {
|
||
// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
|
||
writeFileSync(nodePath.join(directory, name), double);
|
||
// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
|
||
chmodSync(nodePath.join(directory, name), EXECUTABLE_MODE);
|
||
}
|
||
const run = (extra = {}) =>
|
||
spawnSync("/bin/sh", ["-ec", block], {
|
||
cwd: directory,
|
||
encoding: "utf8",
|
||
env: {
|
||
...process.env,
|
||
IMAGE: "synthetic/image",
|
||
PATH: `${directory}:${process.env.PATH}`,
|
||
RELEASE_TAG: "v1.2.3",
|
||
REVISION: "commit",
|
||
...extra,
|
||
},
|
||
});
|
||
assert.notEqual(run().status, 0);
|
||
const retry = run();
|
||
assert.equal(retry.status, 0, retry.stdout + retry.stderr);
|
||
assert.notEqual(run({ BAD_REVISION: "1" }).status, 0);
|
||
assert.notEqual(run({ BAD_SMOKE: "1" }).status, 0);
|
||
// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
|
||
const calls = readFileSync(nodePath.join(directory, "calls"), "utf8");
|
||
assert.equal(
|
||
calls.split("\n").filter(line => line.startsWith("buildx build"))
|
||
.length,
|
||
1,
|
||
);
|
||
assert.ok(calls.includes("synthetic/image@sha256:exact"));
|
||
}
|
||
finally {
|
||
rmSync(directory, { force: true, recursive: true });
|
||
}
|
||
});
|