Jens
faeb58ef6d
GeoIntel release gates / Compile, test, contracts and builds (push) Successful in 1m49s
GeoIntel release gates / Python and npm vulnerability policy (push) Successful in 21s
GeoIntel release gates / Production AI image, SBOM and container scan (push) Successful in 5m39s
GeoIntel release gates / Deploy exact gated revision to Unraid (push) Failing after 58m43s
54 lines
2.4 KiB
Python
54 lines
2.4 KiB
Python
from pathlib import Path
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.main import app
|
|
|
|
|
|
ROOT = Path(__file__).parents[2]
|
|
|
|
|
|
def test_valid_request_id_is_returned() -> None:
|
|
response = TestClient(app).get("/health/live", headers={"x-request-id": "rc3-check.123"})
|
|
|
|
assert response.status_code == 200
|
|
assert response.headers["x-request-id"] == "rc3-check.123"
|
|
|
|
|
|
def test_unsafe_request_id_is_replaced() -> None:
|
|
response = TestClient(app).get("/health/live", headers={"x-request-id": "unsafe request/id"})
|
|
|
|
assert response.status_code == 200
|
|
assert response.headers["x-request-id"] != "unsafe request/id"
|
|
assert " " not in response.headers["x-request-id"]
|
|
|
|
|
|
def test_runtime_report_is_read_only_by_default_and_requires_confirmation() -> None:
|
|
source = (ROOT / "scripts" / "runtime_state_report.py").read_text(encoding="utf-8")
|
|
dockerfile = (ROOT / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")
|
|
|
|
assert '"mode": "read_only"' in source
|
|
assert 'IMPORT_ROOT = ROOT if (ROOT / "app").is_dir() else BACKEND' in source
|
|
assert "if args.reconcile and args.confirm != RECONCILE_CONFIRMATION" in source
|
|
assert "RuntimeReconciliationService.reconcile(db)" in source
|
|
assert "COPY scripts/runtime_state_report.py /app/scripts/runtime_state_report.py" in dockerfile
|
|
|
|
|
|
def test_all_in_one_deploy_embeds_immutable_build_identity() -> None:
|
|
dockerfile = (ROOT / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")
|
|
release_script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
|
|
deploy_powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
|
|
deploy_shell = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")
|
|
|
|
assert "ARG GEOINTEL_BUILD_SHA=unknown" in dockerfile
|
|
assert 'GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}"' in dockerfile
|
|
assert 'GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}"' in dockerfile
|
|
assert 'org.opencontainers.image.revision="${GEOINTEL_BUILD_SHA}"' in dockerfile
|
|
# However it is factored, the build SHA must come from git HEAD.
|
|
assert "git rev-parse HEAD" in release_script
|
|
assert "GEOINTEL_BUILD_SHA" in release_script
|
|
assert "--build-arg GEOINTEL_BUILD_SHA=" in release_script
|
|
assert "--build-arg GEOINTEL_BUILD_TIME=" in release_script
|
|
for deploy_source in (deploy_powershell, deploy_shell):
|
|
assert "bash deploy/unraid/deploy-release.sh" in deploy_source
|