Private
Public Access
67 lines
2.8 KiB
Python
67 lines
2.8 KiB
Python
#!/usr/bin/env python3
|
|
import pathlib
|
|
import subprocess
|
|
import tempfile
|
|
|
|
UPDATER = pathlib.Path(__file__).resolve().parents[1] / "deploy/capy-bearer-update"
|
|
|
|
|
|
def run(*args, cwd=None):
|
|
return subprocess.run(args, cwd=cwd, text=True, capture_output=True, timeout=10)
|
|
|
|
|
|
with tempfile.TemporaryDirectory(prefix="capy-deploy-approval-") as directory:
|
|
repo = pathlib.Path(directory)
|
|
work = repo / "docs/work"
|
|
work.mkdir(parents=True)
|
|
assert run("git", "init", "-q", directory).returncode == 0
|
|
assert run("git", "config", "user.name", "Approval gate test", cwd=repo).returncode == 0
|
|
assert run("git", "config", "user.email", "gate@example.invalid", cwd=repo).returncode == 0
|
|
record = work / "approval.md"
|
|
|
|
def commit(text):
|
|
record.write_text(text)
|
|
assert run("git", "add", "--", "docs/work/approval.md", cwd=repo).returncode == 0
|
|
staged = run("git", "diff", "--cached", "--name-only", cwd=repo)
|
|
assert staged.stdout.strip() == "docs/work/approval.md", staged.stdout
|
|
print(run("git", "status", "--short", cwd=repo).stdout, end="")
|
|
result = run("git", "-c", "core.hooksPath=/dev/null", "commit", "-qm", "Update approval fixture", cwd=repo)
|
|
assert result.returncode == 0, result.stderr
|
|
return run("git", "rev-parse", "HEAD", cwd=repo).stdout.strip()
|
|
|
|
def check(revision):
|
|
return run("bash", str(UPDATER), "--check-approval", str(repo), revision)
|
|
|
|
ordinary = commit("# Ordinary tasks\n- [ ] Finish a routine task.\n")
|
|
result = check(ordinary)
|
|
assert result.returncode == 0, result.stderr
|
|
assert "Approval scan passed" in result.stdout
|
|
print("PASS: ordinary unchecked task and no marker")
|
|
|
|
held = commit("# Approval\n- [ ] DEPLOY_APPROVAL: Await the human decision.\n")
|
|
result = check(held)
|
|
assert result.returncode == 1, result
|
|
assert f"{held}:docs/work/approval.md:2:" in result.stdout, result.stdout
|
|
assert "Approval held:" in result.stdout
|
|
print(result.stdout, end="")
|
|
|
|
record.write_text("# Approval\n- [x] DEPLOY_APPROVAL: Test-only release.\n")
|
|
assert check(held).returncode == 1
|
|
print("PASS: an uncommitted release does not clear a committed hold")
|
|
|
|
released = commit(record.read_text())
|
|
result = check(released)
|
|
assert result.returncode == 0, result.stderr
|
|
assert f"{released}:docs/work/approval.md:2:" in result.stdout, result.stdout
|
|
assert "Approval released:" in result.stdout
|
|
print(result.stdout, end="")
|
|
assert check(held).returncode == 1
|
|
print("PASS: the old held revision remains blocked after release")
|
|
|
|
result = check("missing-revision")
|
|
assert result.returncode != 0
|
|
assert "Approval scan failed" in result.stderr
|
|
print("PASS: a revision lookup error fails closed")
|
|
|
|
print("Deployment approval gate tests passed")
|