92 lines
2.9 KiB
Python
92 lines
2.9 KiB
Python
from __future__ import annotations
|
|
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
SCRIPTS = ROOT / "scripts"
|
|
|
|
|
|
def read(name: str) -> str:
|
|
return (SCRIPTS / name).read_text(encoding="utf-8")
|
|
|
|
|
|
def test_backup_is_atomic_read_only_and_checksum_bound() -> None:
|
|
script = read("backup_release_state.sh")
|
|
|
|
assert "pg_dump" in script
|
|
assert "-Fc" in script
|
|
assert "--no-owner" in script
|
|
assert "CHECKSUMS.sha256" in script
|
|
assert "database-password" not in script.lower()
|
|
assert 'git -C "$ROOT" rev-parse HEAD' in script
|
|
assert 'git -C "$ROOT" status --porcelain=v1' in script
|
|
assert "mv \"$PARTIAL\" \"$FINAL\"" in script
|
|
assert "rm -rf -- \"$PARTIAL\"" in script
|
|
assert "DROP DATABASE" not in script
|
|
assert "pg_restore --clean" not in script
|
|
|
|
|
|
def test_backup_verification_is_read_only() -> None:
|
|
script = read("verify_release_backup.sh")
|
|
|
|
assert "sha256sum -c CHECKSUMS.sha256" in script
|
|
assert "pg_restore --list" in script
|
|
assert "createdb" not in script
|
|
assert "dropdb" not in script
|
|
assert "pg_restore --clean" not in script
|
|
|
|
|
|
def test_restore_smoke_is_forced_to_generated_isolated_database() -> None:
|
|
script = read("restore_release_backup_smoke.sh")
|
|
|
|
assert "--confirm-isolated-restore" in script
|
|
assert "geointel_restore_verify_" in script
|
|
assert 'if [ "$TARGET_DB" = "$DB_NAME" ]' in script
|
|
assert "createdb" in script
|
|
assert "dropdb --if-exists" in script
|
|
assert "pg_restore \\\n --clean" not in script
|
|
assert '"production_database_untouched": True' in script
|
|
|
|
|
|
def test_release_safety_scripts_have_valid_bash_syntax() -> None:
|
|
for name in (
|
|
"backup_release_state.sh",
|
|
"verify_release_backup.sh",
|
|
"restore_release_backup_smoke.sh",
|
|
):
|
|
result = subprocess.run(
|
|
["bash", "-n", f"scripts/{name}"],
|
|
cwd=ROOT,
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
assert result.returncode == 0, f"{name}: {result.stderr}"
|
|
|
|
|
|
def test_readiness_gate_checks_release_safety_scripts() -> None:
|
|
readiness = read("run_readiness_check.sh")
|
|
|
|
for name in (
|
|
"backup_release_state.sh",
|
|
"verify_release_backup.sh",
|
|
"restore_release_backup_smoke.sh",
|
|
):
|
|
assert f"bash -n scripts/{name}" in readiness
|
|
|
|
|
|
def test_password_rotation_never_prints_or_persists_generated_secret() -> None:
|
|
script = read("rotate_postgres_password.sh")
|
|
|
|
assert "openssl rand -hex 32" in script
|
|
assert 'echo "$NEW_PASSWORD"' not in script
|
|
assert 'printf "%s" "$NEW_PASSWORD"' not in script
|
|
assert "GEOINTEL_ROTATED_DATABASE_PASSWORD" in script
|
|
assert "NamedTemporaryFile" in script
|
|
assert "temporary.replace(path)" in script
|
|
assert "ALTER ROLE %s PASSWORD" in script
|
|
assert "run-dockerman-container.sh" in script
|
|
assert "/health/ready" not in script
|