Initial public release

backend/tests/test_rc_release_evidence.py

@@ -0,0 +1,85 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = ROOT / "scripts" / "capture_release_evidence.py"
+
+
+def load_script():
+    spec = importlib.util.spec_from_file_location("capture_release_evidence", SCRIPT)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_release_evidence_manifest_is_secret_free_and_read_only(tmp_path: Path) -> None:
+    module = load_script()
+    args = module.parse_args(
+        [
+            "--output",
+            str(tmp_path / "evidence.json"),
+            "--release-id",
+            "test-rc",
+        ]
+    )
+
+    manifest = module.build_manifest(args)
+
+    assert manifest["schema_version"] == 1
+    assert manifest["release_id"] == "test-rc"
+    assert manifest["version"] == "1.0.0"
+    assert manifest["read_only"] is True
+    assert manifest["scope"] == "Belgium and the Belgian North Sea"
+    assert "DATABASE_URL" not in json.dumps(manifest).replace(
+        '"DATABASE_URL": false',
+        "",
+    ).replace(
+        '"DATABASE_URL": true',
+        "",
+    )
+    assert manifest["storage"] == {"requested": False}
+    assert manifest["live"] == {"requested": False}
+
+
+def test_release_evidence_cli_writes_single_head_manifest(tmp_path: Path) -> None:
+    output = tmp_path / "baseline.json"
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT),
+            "--output",
+            str(output),
+            "--release-id",
+            "test-cli",
+        ],
+        cwd=ROOT,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=60,
+    )
+
+    assert result.returncode == 0, result.stderr
+    payload = json.loads(output.read_text(encoding="utf-8"))
+    assert payload["git"]["commit"]
+    assert payload["migrations"]["single_head"] is True
+    assert payload["files"]["docs/RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md"]["sha256"]
+    assert payload["files"]["docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md"]["sha256"]
+    assert payload["files"]["docs/RELEASE_RUNBOOK.md"]["sha256"]
+    assert payload["files"]["docs/KNOWN_LIMITATIONS.md"]["sha256"]
+
+
+def test_readiness_gate_compiles_release_evidence_command() -> None:
+    readiness = (ROOT / "scripts" / "run_readiness_check.sh").read_text(
+        encoding="utf-8"
+    )
+
+    assert "py_compile scripts/capture_release_evidence.py" in readiness