Start autonomous Belgium and North Sea RC

backend/tests/test_rc_backup_restore_scripts.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+SCRIPTS = ROOT / "scripts"
+
+
+def read(name: str) -> str:
+    return (SCRIPTS / name).read_text(encoding="utf-8")
+
+
+def test_backup_is_atomic_read_only_and_checksum_bound() -> None:
+    script = read("backup_release_state.sh")
+
+    assert "pg_dump" in script
+    assert "-Fc" in script
+    assert "--no-owner" in script
+    assert "CHECKSUMS.sha256" in script
+    assert "database-password" not in script.lower()
+    assert "mv \"$PARTIAL\" \"$FINAL\"" in script
+    assert "rm -rf -- \"$PARTIAL\"" in script
+    assert "DROP DATABASE" not in script
+    assert "pg_restore --clean" not in script
+
+
+def test_backup_verification_is_read_only() -> None:
+    script = read("verify_release_backup.sh")
+
+    assert "sha256sum -c CHECKSUMS.sha256" in script
+    assert "pg_restore --list" in script
+    assert "createdb" not in script
+    assert "dropdb" not in script
+    assert "pg_restore --clean" not in script
+
+
+def test_restore_smoke_is_forced_to_generated_isolated_database() -> None:
+    script = read("restore_release_backup_smoke.sh")
+
+    assert "--confirm-isolated-restore" in script
+    assert "geointel_restore_verify_" in script
+    assert 'if [ "$TARGET_DB" = "$DB_NAME" ]' in script
+    assert "createdb" in script
+    assert "dropdb --if-exists" in script
+    assert "pg_restore \\\n  --clean" not in script
+    assert '"production_database_untouched": True' in script
+
+
+def test_release_safety_scripts_have_valid_bash_syntax() -> None:
+    for name in (
+        "backup_release_state.sh",
+        "verify_release_backup.sh",
+        "restore_release_backup_smoke.sh",
+    ):
+        result = subprocess.run(
+            ["bash", "-n", f"scripts/{name}"],
+            cwd=ROOT,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        assert result.returncode == 0, f"{name}: {result.stderr}"
+
+
+def test_readiness_gate_checks_release_safety_scripts() -> None:
+    readiness = read("run_readiness_check.sh")
+
+    for name in (
+        "backup_release_state.sh",
+        "verify_release_backup.sh",
+        "restore_release_backup_smoke.sh",
+    ):
+        assert f"bash -n scripts/{name}" in readiness