59 lines
2.8 KiB
Python
59 lines
2.8 KiB
Python
"""ORCH-058 TC-07/08: static guarantees of the Strategy-B provenance plumbing.
|
|
|
|
These assert the *shape* of the deploy artefacts that can't be unit-tested by
|
|
running them (they shell out to docker/ssh on the host):
|
|
|
|
* TC-07 — the deploy hook fail-closes BEFORE `docker tag` when the staging
|
|
image's git-revision label != EXPECTED_REVISION (exit 1), and the
|
|
new `--build-staging` rebuild mode stamps GIT_SHA into the image.
|
|
* TC-08 — the Dockerfile declares `ARG GIT_SHA` and stamps it into the
|
|
`org.opencontainers.image.revision` OCI label (the anchor B reads).
|
|
"""
|
|
|
|
import pathlib
|
|
|
|
_ROOT = pathlib.Path(__file__).resolve().parents[1]
|
|
_HOOK = _ROOT / "scripts" / "orchestrator-deploy-hook.sh"
|
|
_DOCKERFILE = _ROOT / "Dockerfile"
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# TC-07: hook fail-closed provenance guard + --build-staging rebuild mode
|
|
# ---------------------------------------------------------------------------
|
|
def test_tc07_hook_has_fail_closed_provenance_guard():
|
|
text = _HOOK.read_text(encoding="utf-8")
|
|
# The label key the hook inspects must be the OCI revision label.
|
|
assert 'REVISION_LABEL="org.opencontainers.image.revision"' in text
|
|
# EXPECTED_REVISION is read (default unset -> backward compatible).
|
|
assert 'EXPECTED_REVISION="${EXPECTED_REVISION:-}"' in text
|
|
# The guard must inspect the source image's label and normalise <no value>.
|
|
assert "docker image inspect --format" in text
|
|
assert '"<no value>"' in text
|
|
# Fail-closed: empty OR mismatch -> abort with exit 1.
|
|
assert '-z "$IMG_REV" || "$IMG_REV" != "$EXPECTED_REVISION"' in text
|
|
|
|
|
|
def test_tc07_provenance_guard_precedes_docker_tag():
|
|
"""The fail-closed `exit 1` must sit BEFORE the `docker tag` retag line."""
|
|
text = _HOOK.read_text(encoding="utf-8")
|
|
guard = text.index("$EXPECTED_REVISION")
|
|
retag = text.index('docker tag "$SOURCE_IMAGE" "$TARGET_IMAGE"')
|
|
assert guard < retag, "provenance guard must run before the prod retag"
|
|
|
|
|
|
def test_tc07_build_staging_mode_stamps_git_sha():
|
|
text = _HOOK.read_text(encoding="utf-8")
|
|
# The new Strategy-A rebuild mode exists and is keyed on --build-staging.
|
|
assert '"${1:-}" == "--build-staging"' in text
|
|
# It rebuilds the staging image stamping the validated commit as a build-arg.
|
|
assert 'docker build --build-arg GIT_SHA="$GIT_SHA"' in text
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# TC-08: Dockerfile stamps the OCI revision label from a build-arg
|
|
# ---------------------------------------------------------------------------
|
|
def test_tc08_dockerfile_stamps_revision_label():
|
|
text = _DOCKERFILE.read_text(encoding="utf-8")
|
|
assert "ARG GIT_SHA" in text
|
|
assert "LABEL org.opencontainers.image.revision=$GIT_SHA" in text
|