mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
Maciej Lisiewski
79c1648300
scripts/releases/desktop_targets.py holds the (electron platform, arch) triple and derives the manifest spelling and the native handoff legs from it. channel_artifacts, channel_publish, channel_releases, stable and the builds table read it instead of five hand-written copies, and NATIVE_LEGS has one definition instead of two. read_native_receipts always reads every native leg, so its legs parameter and _leg_targets go. A claim with includeMacosIntel: true now says why it is refused. Tests iterate the targets directly instead of skipping a 2x2 case.
1386 lines
71 KiB
Python
1386 lines
71 KiB
Python
"""Release gates and package transitions bind the intended immutable artifacts."""
|
|
import copy
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
import zipfile
|
|
from datetime import datetime, timedelta, timezone, UTC
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from tests.scripts.test_release_r2 import r2_server as r2_server # noqa: PLC0414 -- the self-alias is load-bearing: it suppresses F811 for the pytest fixture parameter shadowing this import
|
|
from scripts.releases.draft_warning import (
|
|
WARNING_CLOSE, WARNING_OPEN, strip_draft_warning,
|
|
)
|
|
from scripts.releases import desktop_targets, lanes as lane_set
|
|
from scripts.releases.stable import (
|
|
check_claim, ensure_final_tag, gate_expectations, plan_receipt_transitions, plan_transitions, read_manifest,
|
|
require_stable_identity, require_success, validate_candidates, validate_receipt,
|
|
)
|
|
from scripts.releases.versioning import tag_record
|
|
|
|
BASE = "https://releases.example"
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def candidates(tag, commit, digest, archive=None):
|
|
"""A desktop candidate manifest. `archive` is the R2 prefix ref the
|
|
manifest itself names; the payload `tag` stays plain vX.Y.Z."""
|
|
packages = []
|
|
second = 100 + int(tag.rsplit('.', 1)[1])
|
|
release_epoch = int((datetime(2026, 8, 29, 1, 0, tzinfo=UTC)
|
|
+ timedelta(seconds=second)).timestamp())
|
|
native_version = f"2026.5761.{second}.0"
|
|
ref = archive or tag
|
|
for platform, arch in desktop_targets.MANIFEST_TARGETS:
|
|
packages.append({
|
|
"platform": platform, "arch": arch, "tag": tag, "commit": commit,
|
|
"identity": "test.application",
|
|
"version": native_version if platform == "windows" else tag[1:],
|
|
**({"executableVersion": native_version} if platform == "windows" else {}),
|
|
**({"publisher": "CN=Test", "applicationId": "App"} if platform == "windows" else {"teamId": "ABCDEFGHIJ"}),
|
|
"artifact": {"sha256": digest,
|
|
"url": f"{BASE}/releases/tag/{ref}/{arch}" + (".msixbundle" if platform == "windows" else ".zip")},
|
|
})
|
|
return {"schema": 2, "tag": tag, "commit": commit, "releaseEpoch": release_epoch,
|
|
"archive": ref,
|
|
"packages": packages,
|
|
"smoke_results": {name: {"result": "success"} for name in (
|
|
"smoke-darwin-arm64", "smoke-win32-arm64", "smoke-win32-x64")}}
|
|
|
|
|
|
def test_gate_requires_every_success_including_real_cli(tmp_path):
|
|
required = ["ci", "docker", "acceptance", "publication"]
|
|
success = {name: {"result": "success"} for name in required}
|
|
require_success(success, required)
|
|
with pytest.raises(ValueError, match="required-job list"):
|
|
require_success(success, [])
|
|
for name in required:
|
|
for result in ("failure", "cancelled", "skipped", None):
|
|
needs = copy.deepcopy(success)
|
|
if result:
|
|
needs[name]["result"] = result
|
|
else:
|
|
del needs[name]
|
|
with pytest.raises(ValueError, match=name):
|
|
require_success(needs, required)
|
|
summary = tmp_path / "summary.md"
|
|
env = {**os.environ, "RELEASE_NEEDS": json.dumps(success), "GITHUB_STEP_SUMMARY": str(summary), "PYTHONPATH": str(ROOT),
|
|
"LANES": json.dumps(lane_set.flags(lane_set.DEFAULT))}
|
|
argv = [sys.executable, "-m", "scripts.releases.stable", "gate", *required]
|
|
assert subprocess.run(argv, cwd=tmp_path, env=env, capture_output=True, check=False).returncode == 0
|
|
empty = subprocess.run(argv[:4], cwd=tmp_path, env=env, capture_output=True, text=True, encoding="utf-8", check=False)
|
|
assert empty.returncode != 0
|
|
assert "required-job list" in empty.stderr
|
|
env["RELEASE_NEEDS"] = json.dumps({**success, "publication": {"result": "cancelled"}})
|
|
result = subprocess.run(argv, cwd=tmp_path, env=env, capture_output=True, text=True, encoding="utf-8", check=False)
|
|
assert result.returncode != 0
|
|
assert "publication=cancelled" in result.stderr
|
|
|
|
|
|
@pytest.mark.parametrize("lanes", [
|
|
lane_set.select(without=lane_set.BUNDLES),
|
|
lane_set.select(without=lane_set.NAMES[5:]),
|
|
lane_set.select(only=["windows", "docker"]),
|
|
lane_set.select(only=[]),
|
|
])
|
|
def test_gate_requires_every_lane_removed_job_to_have_skipped(tmp_path, lanes):
|
|
required = ["admit", *lane_set.JOB_LANES]
|
|
expected = gate_expectations(required, lanes)
|
|
# Lanes never remove admission.
|
|
assert expected["admit"] == "success"
|
|
assert {name for name, result in expected.items() if result == "success"} - {"admit"} == \
|
|
{job for job, runs in lane_set.jobs_to_run(lanes).items() if runs}
|
|
needs = {name: {"result": result} for name, result in expected.items()}
|
|
env = {**os.environ, "RELEASE_NEEDS": json.dumps(needs), "PYTHONPATH": str(ROOT),
|
|
"GITHUB_STEP_SUMMARY": str(tmp_path / "summary.md"), "LANES": json.dumps(lane_set.flags(lanes))}
|
|
argv = [sys.executable, "-m", "scripts.releases.stable", "gate", *required]
|
|
assert subprocess.run(argv, cwd=tmp_path, env=env, capture_output=True, check=False).returncode == 0
|
|
# A removed job that ran anyway blocks the release, and so does a different lane set.
|
|
removed = next(name for name, result in expected.items() if result == "skipped")
|
|
env["RELEASE_NEEDS"] = json.dumps({**needs, removed: {"result": "success"}})
|
|
ran = subprocess.run(argv, cwd=tmp_path, env=env, capture_output=True, text=True, encoding="utf-8", check=False)
|
|
assert ran.returncode != 0 and f"{removed}=success (expected skipped)" in ran.stderr
|
|
env["RELEASE_NEEDS"] = json.dumps(needs)
|
|
env["LANES"] = json.dumps(lane_set.flags(lane_set.NAMES))
|
|
assert subprocess.run(argv, cwd=tmp_path, env=env, capture_output=True, check=False).returncode != 0
|
|
del env["LANES"]
|
|
missing = subprocess.run(argv, cwd=tmp_path, env=env, capture_output=True, text=True, encoding="utf-8", check=False)
|
|
assert missing.returncode != 0 and "lanes must be" in missing.stderr
|
|
|
|
|
|
def test_validate_candidates_keys_the_archive_by_the_attempt_ref():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
assert validate_candidates(manifest, manifest["tag"], commit, BASE, archive="rc.2-v1.2.4")
|
|
# The archive ref is the URL prefix; the payload tag stays the identity.
|
|
assert manifest["packages"][0]["artifact"]["url"].startswith(f"{BASE}/releases/tag/rc.2-v1.2.4/")
|
|
with pytest.raises(ValueError, match="archive"):
|
|
validate_candidates(manifest, manifest["tag"], commit, BASE, archive="rc.1-v1.2.4")
|
|
misnamed = copy.deepcopy(manifest)
|
|
misnamed["archive"] = "rc.1-v1.2.4"
|
|
with pytest.raises(ValueError, match="archive"):
|
|
validate_candidates(misnamed, manifest["tag"], commit, BASE, archive="rc.2-v1.2.4")
|
|
missing = copy.deepcopy(manifest)
|
|
del missing["archive"]
|
|
with pytest.raises(ValueError, match="archive"):
|
|
validate_candidates(missing, manifest["tag"], commit, BASE, archive="rc.2-v1.2.4")
|
|
# A canary-shaped archive ref (the payload tag itself) still validates.
|
|
assert validate_candidates(candidates("v1.2.4", commit, "2" * 64),
|
|
"v1.2.4", commit, BASE, archive="v1.2.4")
|
|
|
|
|
|
RECEIPTS = (
|
|
("darwin-arm64", ("macos/arm64",)),
|
|
("win32-bundle", ("windows/x64", "windows/arm64")),
|
|
)
|
|
|
|
|
|
def _receipt_rows(manifest, targets):
|
|
out = copy.deepcopy(manifest)
|
|
out["packages"] = [row for row in manifest["packages"]
|
|
if f"{row['platform']}/{row['arch']}" in targets]
|
|
return out
|
|
|
|
|
|
def test_each_receipt_accepts_its_own_rows():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
for receipt, targets in RECEIPTS:
|
|
rows = validate_receipt(_receipt_rows(manifest, targets), receipt,
|
|
manifest["tag"], commit, BASE, manifest["releaseEpoch"],
|
|
archive="rc.2-v1.2.4")
|
|
assert set(rows) == set(targets)
|
|
|
|
|
|
def test_a_mac_receipt_with_an_intel_or_a_termux_row_is_refused():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
intel = _receipt_rows(manifest, {"macos/arm64"})
|
|
intel["packages"].append({**intel["packages"][0], "arch": "x64",
|
|
"artifact": {"sha256": "2" * 64, "url": f"{BASE}/releases/tag/rc.2-v1.2.4/x64.zip"}})
|
|
with pytest.raises(ValueError, match="candidate target: macos/x64"):
|
|
validate_receipt(intel, "darwin-arm64", manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
with pytest.raises(ValueError, match="Unknown receipt"):
|
|
validate_receipt(_receipt_rows(manifest, {"macos/arm64"}), "darwin-x64", manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
termux = _receipt_rows(manifest, {"macos/arm64"})
|
|
termux["packages"].append({"platform": "termux", "arch": "aarch64", "tag": manifest["tag"],
|
|
"commit": commit, "identity": "test.application",
|
|
"version": "1.2.4-1",
|
|
"artifact": {"sha256": "2" * 64,
|
|
"url": f"{BASE}/releases/tag/rc.2-v1.2.4/hermes.deb"}})
|
|
with pytest.raises(ValueError, match="eceipt"):
|
|
validate_receipt(termux, "darwin-arm64", manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
|
|
|
|
def test_a_win32_bundle_receipt_with_one_arch_is_refused():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
one = _receipt_rows(manifest, {"windows/x64"})
|
|
with pytest.raises(ValueError, match="eceipt"):
|
|
validate_receipt(one, "win32-bundle", manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
|
|
|
|
def test_a_receipt_is_accepted_without_smoke_results():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
for receipt, targets in RECEIPTS:
|
|
rows = _receipt_rows(manifest, targets)
|
|
# Receipts are staged before the smokes run; they carry no smoke results.
|
|
del rows["smoke_results"]
|
|
assert validate_receipt(rows, receipt, manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
|
|
|
|
def test_the_final_manifest_still_requires_every_smoke_result():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
del manifest["smoke_results"]
|
|
with pytest.raises(ValueError, match="smoke"):
|
|
validate_candidates(manifest, manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
failed = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
failed["smoke_results"]["smoke-win32-x64"] = {"result": "failure"}
|
|
with pytest.raises(ValueError, match="smoke-win32-x64=failure"):
|
|
validate_candidates(failed, failed["tag"], commit, BASE,
|
|
failed["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
|
|
|
|
def test_an_unknown_receipt_is_refused():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
with pytest.raises(ValueError, match="Unknown receipt"):
|
|
validate_receipt(manifest, "darwin", manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
|
|
|
|
def test_a_manifest_must_carry_exactly_the_targets_its_claims_lanes_build():
|
|
commit = "b" * 40
|
|
manifest = candidates("v1.2.4", commit, "2" * 64, archive="rc.2-v1.2.4")
|
|
# A release may build any subset of the lanes, so a partial manifest is a valid manifest.
|
|
windows_only = _receipt_rows(manifest, {"windows/x64", "windows/arm64"})
|
|
windows_only["smoke_results"] = {**manifest["smoke_results"], "smoke-darwin-arm64": {"result": "skipped"}}
|
|
assert validate_candidates(windows_only, manifest["tag"], commit, BASE, manifest["releaseEpoch"],
|
|
archive="rc.2-v1.2.4").keys() == {"windows/x64", "windows/arm64"}
|
|
from scripts.releases.stable import require_targets_match_claim
|
|
require_targets_match_claim(windows_only, ["windows"])
|
|
for wrong in (lane_set.DEFAULT, ["windows", "macos-arm64"], []):
|
|
with pytest.raises(ValueError, match="differ from the claim"):
|
|
require_targets_match_claim(windows_only, wrong)
|
|
with pytest.raises(ValueError, match="no packages"):
|
|
validate_candidates(_receipt_rows(manifest, set()), manifest["tag"], commit, BASE,
|
|
manifest["releaseEpoch"], archive="rc.2-v1.2.4")
|
|
|
|
|
|
def test_plan_receipt_transitions_yields_only_the_receipts_rows():
|
|
old = candidates("v1.2.3", "a" * 40, "1" * 64)
|
|
new = candidates("v1.2.4", "b" * 40, "2" * 64, archive="rc.2-v1.2.4")
|
|
for receipt, targets in RECEIPTS:
|
|
rows = plan_receipt_transitions(old, _receipt_rows(new, targets), receipt, BASE)
|
|
assert {row["target"] for row in rows} == {target.replace("/", "-") for target in targets}
|
|
assert all(row["transition"]["new"]["commit"] == new["commit"] for row in rows)
|
|
|
|
|
|
def test_transitions_bind_all_arches_identity_version_and_archive():
|
|
old = candidates("v1.2.3", "a" * 40, "1" * 64)
|
|
old["schema"] = 1
|
|
del old["smoke_results"]
|
|
with pytest.raises(ValueError, match="does not match release identity"):
|
|
validate_candidates(old, old["tag"], old["commit"], BASE, archive=old["archive"])
|
|
old = candidates("v1.2.3", "a" * 40, "1" * 64)
|
|
new = candidates("v1.2.4", "b" * 40, "2" * 64, archive="rc.1-v1.2.4")
|
|
require_stable_identity(new["tag"], new["commit"])
|
|
for tag in ("v1.2.4+canary.20260907T143420Z", "v1.2.4-rc", "rc.1-v1.2.4"):
|
|
with pytest.raises(ValueError):
|
|
require_stable_identity(tag, new["commit"])
|
|
transitions = plan_transitions(old, new, BASE)
|
|
assert {row["target"] for row in transitions} == {"windows-x64", "windows-arm64", "macos-arm64"}
|
|
assert all(row["transition"]["new"]["commit"] == new["commit"] for row in transitions)
|
|
assert all(row["transition"]["new"]["artifact"]["url"].startswith(f"{BASE}/releases/tag/{new['archive']}/")
|
|
for row in transitions)
|
|
# A target the new release did not build has nothing to upgrade to.
|
|
missing = copy.deepcopy(new)
|
|
missing["packages"] = [row for row in missing["packages"] if row["platform"] != "macos"]
|
|
missing["smoke_results"]["smoke-darwin-arm64"] = {"result": "skipped"}
|
|
assert {row["target"] for row in plan_transitions(old, missing, BASE)} == \
|
|
{"windows-x64", "windows-arm64"}
|
|
with pytest.raises(ValueError, match="identity"):
|
|
validate_candidates(new, new["tag"], old["commit"], BASE, archive=new["archive"])
|
|
windows = next(i for i, row in enumerate(new["packages"]) if row["platform"] == "windows")
|
|
for key, value in [("commit", old["commit"]), ("identity", "different"), ("publisher", "CN=Other"), ("version", "9.9.9.0")]:
|
|
changed = copy.deepcopy(new)
|
|
changed["packages"][windows][key] = value
|
|
with pytest.raises(ValueError):
|
|
plan_transitions(old, changed, BASE)
|
|
mutable = copy.deepcopy(new)
|
|
mutable["packages"][windows]["artifact"]["url"] = f"{BASE}/releases/win32/stable/current.msixbundle"
|
|
with pytest.raises(ValueError, match="immutable"):
|
|
plan_transitions(old, mutable, BASE)
|
|
for suffix in ("../other.zip", "%2e%2e/other.zip", "%252e%252e/other.zip"):
|
|
traversal = copy.deepcopy(new)
|
|
traversal["packages"][windows]["artifact"]["url"] = f"{BASE}/releases/tag/{new['tag']}/{suffix}"
|
|
with pytest.raises(ValueError, match="path encoding"):
|
|
plan_transitions(old, traversal, BASE)
|
|
with pytest.raises(ValueError, match="increase"):
|
|
plan_transitions(new, candidates("v1.2.3", "a" * 40, "1" * 64), BASE)
|
|
|
|
|
|
@pytest.fixture
|
|
def https_origin(tmp_path, monkeypatch):
|
|
import datetime
|
|
import ipaddress
|
|
import ssl
|
|
import threading
|
|
import urllib.request
|
|
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
|
|
|
from cryptography import x509
|
|
from cryptography.hazmat.primitives import hashes, serialization
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
from cryptography.x509.oid import NameOID
|
|
|
|
key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
|
|
name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
|
|
cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name)
|
|
.public_key(key.public_key()).serial_number(x509.random_serial_number())
|
|
.not_valid_before(datetime.datetime(2020, 1, 1, tzinfo=datetime.UTC))
|
|
.not_valid_after(datetime.datetime(2099, 1, 1, tzinfo=datetime.UTC))
|
|
.add_extension(x509.SubjectAlternativeName([
|
|
x509.DNSName("localhost"), x509.IPAddress(ipaddress.ip_address("127.0.0.1")),
|
|
]), critical=False).sign(key, hashes.SHA256()))
|
|
cert_file, key_file = tmp_path / "cert.pem", tmp_path / "key.pem"
|
|
cert_file.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
|
|
key_file.write_bytes(key.private_bytes(serialization.Encoding.PEM,
|
|
serialization.PrivateFormat.PKCS8, serialization.NoEncryption()))
|
|
requests = []
|
|
|
|
class Handler(BaseHTTPRequestHandler):
|
|
def do_GET(self):
|
|
requests.append(self.path)
|
|
if self.path in ("/same", "/cross"):
|
|
self.send_response(302)
|
|
host = "127.0.0.1" if self.path == "/same" else "localhost"
|
|
self.send_header("Location", f"https://{host}:{self.server.server_port}/manifest")
|
|
self.end_headers()
|
|
else:
|
|
item = self.server.store.get(self.path.lstrip('/'))
|
|
data = item[0] if item else b'not found'
|
|
self.send_response(200 if item else 404)
|
|
self.send_header("Content-Length", str(len(data)))
|
|
self.end_headers()
|
|
self.wfile.write(data)
|
|
|
|
def log_message(self, *args):
|
|
pass
|
|
|
|
server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
|
|
server.store = {'manifest': (b'{"schema":1}', '"e"')}
|
|
server.requests = requests
|
|
server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
|
|
server_context.load_cert_chain(cert_file, key_file)
|
|
server.socket = server_context.wrap_socket(server.socket, server_side=True)
|
|
client_context = ssl.create_default_context(cafile=str(cert_file))
|
|
opener = urllib.request.build_opener(urllib.request.ProxyHandler({}),
|
|
urllib.request.HTTPSHandler(context=client_context)).open
|
|
base = f"https://127.0.0.1:{server.server_port}"
|
|
server.base, server.opener = base, opener
|
|
monkeypatch.setenv('SSL_CERT_FILE', str(cert_file))
|
|
# urlopen() caches its default opener, SSL context included, on first use; each
|
|
# origin has its own certificate, so a later test must not inherit an earlier CA.
|
|
monkeypatch.setattr(urllib.request, "_opener", None)
|
|
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
|
thread.start()
|
|
try:
|
|
yield server
|
|
finally:
|
|
server.shutdown()
|
|
server.server_close()
|
|
thread.join(timeout=5)
|
|
|
|
|
|
def test_manifest_origin_checks_with_real_https(https_origin):
|
|
server = https_origin
|
|
base, opener = server.base, server.opener
|
|
digest = hashlib.sha256(b'{"schema":1}').hexdigest()
|
|
assert read_manifest(f'{base}/same', digest, expected_origin=base, opener=opener) == {'schema': 1}
|
|
with pytest.raises(ValueError, match='digest'):
|
|
read_manifest(f'{base}/manifest', 'f' * 64, opener=opener)
|
|
with pytest.raises(ValueError, match='origin'):
|
|
read_manifest(f'{base}/cross', opener=opener)
|
|
server.requests.clear()
|
|
with pytest.raises(ValueError, match='origin'):
|
|
read_manifest(f'https://localhost:{server.server_port}/manifest', expected_origin=base, opener=opener)
|
|
assert server.requests == []
|
|
|
|
|
|
# Stable runs from the default branch. GITHUB_SHA is main's tip, never the claim commit.
|
|
CONTROLLER_ENV = {
|
|
"GITHUB_REPOSITORY": "example/hermes-agent",
|
|
"GITHUB_EVENT_NAME": "workflow_dispatch",
|
|
"GITHUB_REF": "refs/heads/main",
|
|
"GITHUB_WORKFLOW_REF": "example/hermes-agent/.github/workflows/stable-release.yml@refs/heads/main",
|
|
"GITHUB_SHA": "e" * 40,
|
|
}
|
|
|
|
|
|
def test_a_claim_run_is_found_by_its_run_name_on_main_or_by_its_tag_branch():
|
|
from scripts.releases.stable import claim_run_title, is_claim_run
|
|
|
|
tag, commit = "rc.1-v1.2.3", "a" * 40
|
|
assert claim_run_title(tag) == "Stable release rc.1-v1.2.3"
|
|
|
|
def match(**row):
|
|
return is_claim_run(**{"title": None, "head_branch": "main", "head_sha": "e" * 40, **row},
|
|
claim_tag=tag, commit=commit)
|
|
|
|
assert match(title="Stable release rc.1-v1.2.3")
|
|
# Runs started before the controller moved sat on the tag at the claim commit.
|
|
assert match(head_branch=tag, head_sha=commit)
|
|
assert not match(title="Stable release rc.2-v1.2.3")
|
|
assert not match(head_branch=tag, head_sha="e" * 40)
|
|
assert not match()
|
|
|
|
|
|
def test_claim_must_run_from_the_default_branch_controller():
|
|
base = {**CONTROLLER_ENV, "RELEASE_CLAIM_TAG": "rc.1-v1.2.3"}
|
|
for wrong in (
|
|
{"GITHUB_REF": "refs/tags/rc.1-v1.2.3"},
|
|
{"GITHUB_REF": "refs/heads/feature"},
|
|
{"GITHUB_EVENT_NAME": "workflow_run"},
|
|
{"GITHUB_WORKFLOW_REF": "example/hermes-agent/.github/workflows/other.yml@refs/heads/main"},
|
|
{"GITHUB_WORKFLOW_REF": "example/hermes-agent/.github/workflows/stable-release.yml@refs/tags/rc.1-v1.2.3"},
|
|
):
|
|
with pytest.raises(ValueError, match="default-branch controller"):
|
|
check_claim({**base, **wrong}, lambda argv: pytest.fail("no git before the controller check"))
|
|
|
|
|
|
def test_claim_object_movement_and_lightweight_tags_fail_closed(tmp_path, monkeypatch):
|
|
commit = "a" * 40
|
|
claim_object = "b" * 40
|
|
ref = "refs/tags/rc.1-v1.2.3"
|
|
env = {**CONTROLLER_ENV, "RELEASE_CLAIM_TAG": "rc.1-v1.2.3", "RELEASE_CLAIM_OBJECT": claim_object}
|
|
message = {"schema": 1, "version": "1.2.3", "attempt": 1, "commit": commit,
|
|
"autopublish": False, "skipBundles": False, "skipTests": False,
|
|
"claimEpoch": 1_790_000_000}
|
|
|
|
def git(argv):
|
|
if argv[1] == "ls-remote":
|
|
return f"{claim_object}\t{ref}\n{commit}\t{ref}^{{}}"
|
|
if argv[1:3] == ["cat-file", "-t"]:
|
|
return "tag"
|
|
if argv[1:3] == ["cat-file", "-p"]:
|
|
return "tagger Fixture <fixture@example.test> 1790000000 +0000\n"
|
|
if argv[1] == "rev-parse":
|
|
return claim_object if argv[-1] == ref else commit
|
|
if argv[1] == "tag":
|
|
return json.dumps(message)
|
|
if argv[1] == "for-each-ref":
|
|
return "refs/remotes/origin/release/1.2.3"
|
|
return ""
|
|
|
|
assert check_claim(env, git) == {
|
|
"claim_tag": "rc.1-v1.2.3", "claim_object": claim_object,
|
|
"tag": "v1.2.3", "version": "1.2.3", "attempt": 1, "commit": commit,
|
|
# A claim cut before lanes existed reads as the lane set that gated the same jobs.
|
|
"autopublish": False, "lanes": lane_set.DEFAULT,
|
|
"claim_epoch": 1_790_000_000,
|
|
}
|
|
# The metadata binds the attempt its ref names.
|
|
for wrong in ({**message, "attempt": 2}, {k: v for k, v in message.items() if k != "attempt"}):
|
|
with pytest.raises(ValueError, match="metadata is invalid"):
|
|
check_claim(env, lambda argv, wrong=wrong: json.dumps(wrong) if argv[1] == "tag" else git(argv))
|
|
with pytest.raises(ValueError, match="tag moved"):
|
|
check_claim(env, lambda argv: f"{'c' * 40}\t{ref}\n{commit}\t{ref}^{{}}"
|
|
if argv[1] == "ls-remote" else git(argv))
|
|
with pytest.raises(ValueError, match="annotated"):
|
|
check_claim(env, lambda argv: "commit" if argv[1] == "cat-file" else git(argv))
|
|
|
|
repo = tmp_path / "repo"
|
|
remote = tmp_path / "remote.git"
|
|
repo.mkdir()
|
|
monkeypatch.chdir(repo)
|
|
subprocess.run(["git", "init", "-b", "main"], check=True, capture_output=True)
|
|
subprocess.run(["git", "init", "--bare", str(remote)], check=True, capture_output=True)
|
|
subprocess.run(["git", "config", "user.name", "fixture"], check=True)
|
|
subprocess.run(["git", "config", "user.email", "fixture@example.invalid"], check=True)
|
|
(repo / "input").write_text("first", encoding="utf-8")
|
|
subprocess.run(["git", "add", "input"], check=True)
|
|
subprocess.run(["git", "commit", "-m", "first"], check=True, capture_output=True)
|
|
actual = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True, encoding="utf-8").strip()
|
|
subprocess.run(["git", "remote", "add", "origin", str(remote)], check=True)
|
|
metadata = json.dumps({
|
|
"schema": 1, "version": "1.2.3", "attempt": 1, "commit": actual,
|
|
"autopublish": False, "lanes": sorted(lane_set.DEFAULT),
|
|
"claimEpoch": 1_790_000_000,
|
|
}, sort_keys=True, separators=(",", ":"))
|
|
subprocess.run(
|
|
["git", "tag", "-a", "rc.1-v1.2.3", "-m", metadata], check=True,
|
|
env={**os.environ, "GIT_COMMITTER_DATE": "@1790000000 +0000"},
|
|
)
|
|
subprocess.run(["git", "push", "origin", "main", "rc.1-v1.2.3"], check=True, capture_output=True)
|
|
env.update({"RELEASE_CLAIM_OBJECT": subprocess.check_output(
|
|
["git", "rev-parse", ref], text=True, encoding="utf-8").strip()})
|
|
claim = check_claim(env)
|
|
assert claim["commit"] == actual
|
|
final_object = ensure_final_tag(
|
|
"v1.2.3", actual, claim,
|
|
candidate_manifest_sha256="c" * 64,
|
|
docker_manifest_digest="sha256:" + "d" * 64,
|
|
release_id=123,
|
|
)
|
|
remote_final = subprocess.check_output(
|
|
["git", "ls-remote", "origin", "refs/tags/v1.2.3", "refs/tags/v1.2.3^{}"],
|
|
text=True, encoding="utf-8",
|
|
)
|
|
assert f"{final_object}\trefs/tags/v1.2.3" in remote_final
|
|
assert f"{actual}\trefs/tags/v1.2.3^{{}}" in remote_final
|
|
subprocess.run(["git", "--git-dir", str(remote), "update-ref", "-d", ref], check=True)
|
|
with pytest.raises(ValueError, match="moved"):
|
|
check_claim(env)
|
|
|
|
|
|
def test_a_claim_cut_before_lanes_existed_reads_as_the_lane_set_that_gated_the_same_jobs():
|
|
"""rc.1..rc.11 of v0.21.6/v0.21.7 carry skipBundles/skipTests and no include keys."""
|
|
from scripts.releases.stable import _claim_metadata, validate_claim
|
|
|
|
commit = "a" * 40
|
|
old = {"schema": 1, "version": "0.21.7", "attempt": 11, "commit": commit,
|
|
"autopublish": True, "skipBundles": False, "skipTests": False,
|
|
"claimEpoch": 1_790_000_000}
|
|
raw = json.dumps(old, sort_keys=True, separators=(",", ":"))
|
|
parsed = _claim_metadata(raw, version="0.21.7", attempt=11, commit=commit)
|
|
assert parsed == {**old, "lanes": lane_set.DEFAULT}
|
|
assert old == json.loads(raw) # the caller's record is not mutated
|
|
both = {**old, "includeMacosIntel": False, "includeTermux": True}
|
|
assert validate_claim(both, version="0.21.7", attempt=11, commit=commit)["lanes"] == frozenset(lane_set.NAMES)
|
|
# macOS Intel is no longer built: a claim that opted into it cannot be honoured.
|
|
with pytest.raises(ValueError, match="metadata is invalid: it opts into macOS Intel"):
|
|
validate_claim({**old, "includeMacosIntel": True}, version="0.21.7", attempt=11, commit=commit)
|
|
untested = {**old, "skipTests": True}
|
|
assert validate_claim(untested, version="0.21.7", attempt=11, commit=commit)["lanes"] == frozenset(
|
|
{"docker", "windows", "windows-store", "macos-arm64"})
|
|
# skipBundles built the image and nothing else a bundle touches, tests included.
|
|
bundleless = {**old, "skipBundles": True}
|
|
assert validate_claim(bundleless, version="0.21.7", attempt=11, commit=commit)["lanes"] == frozenset(
|
|
{"docker", "ci", "nix", "docker-tests", "windows-live", "install-e2e", "bootstrap-version", "termux-checks"})
|
|
# The keys stay exact, never loose: a non-boolean, an unknown key or a mix of shapes is refused.
|
|
new = {k: v for k, v in old.items() if not k.startswith("skip")}
|
|
# A lanes claim without a revision was cut when `windows` also meant the Store bundle (rc.2-v0.22.1).
|
|
assert validate_claim({**new, "lanes": ["docker", "windows"]}, version="0.21.7", attempt=11,
|
|
commit=commit)["lanes"] == frozenset({"docker", "windows", "windows-store"})
|
|
assert validate_claim({**new, "lanes": ["docker", "windows"], "lanesRevision": lane_set.LANES_REVISION},
|
|
version="0.21.7", attempt=11, commit=commit)["lanes"] == frozenset({"docker", "windows"})
|
|
for wrong in ({**old, "includeTermux": "yes"}, {**old, "includeLinux": True},
|
|
{**new, "lanes": ["windows", "docker"]}, {**new, "lanes": ["linux"]},
|
|
{**new, "lanes": "windows"}, {**old, "lanes": ["docker"]}):
|
|
with pytest.raises(ValueError, match="metadata is invalid"):
|
|
validate_claim(wrong, version="0.21.7", attempt=11, commit=commit)
|
|
|
|
|
|
def test_a_default_claim_builds_no_termux_and_lanes_restore_it(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
off = {"candidates-termux", "termux-checks"}
|
|
required = ["admit", *lane_set.JOB_LANES]
|
|
default = stable.gate_expectations(required, lane_set.DEFAULT)
|
|
assert {name for name, result in default.items() if result == "skipped"} == off
|
|
assert set(stable.gate_expectations(required, lane_set.NAMES).values()) == {"success"}
|
|
# A lane that is off removes its jobs even when its test lane is on.
|
|
assert stable.gate_expectations(["candidates-termux", "termux-checks"],
|
|
lane_set.select(without=["termux"])) == \
|
|
{"candidates-termux": "skipped", "termux-checks": "skipped"}
|
|
|
|
# Only the default groups stage handoffs; the manifest is complete without
|
|
# the Termux row.
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_darwin_handoff(built, "arm64")
|
|
_stage_windows_handoff(built, "x64")
|
|
_stage_windows_handoff(built, "arm64")
|
|
_stage_universal_bundle(built)
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=lane_set.DEFAULT))
|
|
calls = _calls(lane_set.DEFAULT)
|
|
env = {**_receipt_env(tmp_path, https_origin.base), "RELEASE_NEEDS": json.dumps(calls)}
|
|
stable.main(["candidate-manifest"], env)
|
|
stored, _ = r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"]
|
|
manifest = json.loads(stored)
|
|
assert {f"{row['platform']}/{row['arch']}" for row in manifest["packages"]} == {
|
|
"macos/arm64", "windows/x64", "windows/arm64"}
|
|
stable.validate_candidates(manifest, "v1.2.3", RECEIPT_COMMIT, https_origin.base,
|
|
RELEASE_EPOCH, archive=ATTEMPT)
|
|
stable.require_targets_match_claim(manifest, lane_set.DEFAULT)
|
|
with pytest.raises(ValueError, match="differ from the claim"):
|
|
stable.require_targets_match_claim(manifest, lane_set.select(with_=["termux"]))
|
|
# A smoke that claims to have passed for a target nobody built is refused.
|
|
lean = {**manifest, "packages": [row for row in manifest["packages"] if row["platform"] != "macos"]}
|
|
with pytest.raises(ValueError, match="did not build"):
|
|
stable.validate_candidates(lean, "v1.2.3", RECEIPT_COMMIT, https_origin.base,
|
|
RELEASE_EPOCH, archive=ATTEMPT)
|
|
# A claim that built Termux needs its handoff: a missing one leaves no manifest.
|
|
del r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"]
|
|
termux = lane_set.select(with_=["termux"])
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=termux))
|
|
with pytest.raises(Exception, match="handoff-termux"):
|
|
stable.main(["candidate-manifest"], {**env, "RELEASE_NEEDS": json.dumps(_calls(termux))})
|
|
assert f"releases/tag/{ATTEMPT}/release-candidates.json" not in r2_server.store
|
|
|
|
|
|
def test_a_termux_only_claim_assembles_a_termux_only_manifest(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
"""--only termux: no desktop call exists, so there is no smoke to judge, only the Termux call."""
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_termux_handoff(built)
|
|
lanes = lane_set.select(only=["termux", "docker"])
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=lanes))
|
|
env = {**_receipt_env(tmp_path, https_origin.base), "RELEASE_NEEDS": json.dumps(_calls(lanes))}
|
|
stable.main(["candidate-manifest"], env)
|
|
manifest = json.loads(r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"][0])
|
|
assert {f"{row['platform']}/{row['arch']}" for row in manifest["packages"]} == {"termux/aarch64"}
|
|
stable.require_targets_match_claim(manifest, lanes)
|
|
# The Termux call is judged like any other: a failed one leaves no manifest.
|
|
del r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"]
|
|
failed = {**env, "RELEASE_NEEDS": json.dumps({"candidates-termux": {"result": "failure"}})}
|
|
with pytest.raises(ValueError, match="candidates-termux=failure"):
|
|
stable.main(["candidate-manifest"], failed)
|
|
assert f"releases/tag/{ATTEMPT}/release-candidates.json" not in r2_server.store
|
|
|
|
|
|
def test_a_windows_only_claim_assembles_a_windows_only_manifest(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
"""--only windows,docker: no macOS handoff exists, so none is read and no macOS row appears."""
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_windows_handoff(built, "x64")
|
|
_stage_windows_handoff(built, "arm64")
|
|
_stage_universal_bundle(built, store=False)
|
|
lanes = lane_set.select(only=["windows", "docker"])
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=lanes))
|
|
calls = _calls(lanes)
|
|
env = {**_receipt_env(tmp_path, https_origin.base), "RELEASE_NEEDS": json.dumps(calls)}
|
|
stable.main(["candidate-manifest"], env)
|
|
manifest = json.loads(r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"][0])
|
|
assert {f"{row['platform']}/{row['arch']}" for row in manifest["packages"]} == {"windows/x64", "windows/arm64"}
|
|
# Nothing smoked: the claim has no smoke lane, so every smoke is recorded skipped.
|
|
assert manifest["smoke_results"] == {job: {"result": "skipped"} for job in stable.SMOKE_JOBS}
|
|
stable.require_smokes_match_claim(manifest, lanes)
|
|
stable.require_targets_match_claim(manifest, lanes)
|
|
|
|
|
|
def test_a_store_only_claim_assembles_a_manifest_with_the_store_bundle_and_no_packages(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
"""--only windows-store: the per-arch handoffs carry unsigned Store MSIX and no metadata."""
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
for arch in ("x64", "arm64"):
|
|
(built / f"Store-Product-1.2.3-win-{arch}.msix").write_bytes(f"store msix: {arch}".encode())
|
|
from scripts.releases import handoff
|
|
handoff.stage(ATTEMPT, RECEIPT_COMMIT, f"win32-{arch}", built, [f"Store-Product-1.2.3-win-{arch}.msix"])
|
|
_stage_universal_bundle(built, signed=False)
|
|
lanes = lane_set.select(only=["windows-store"])
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=lanes))
|
|
env = {**_receipt_env(tmp_path, https_origin.base), "RELEASE_NEEDS": json.dumps(_calls(lanes))}
|
|
stable.main(["candidate-manifest"], env)
|
|
manifest = json.loads(r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"][0])
|
|
assert manifest["packages"] == []
|
|
assert [file["path"] for file in manifest["files"] if file["path"].endswith(".msixbundle")] == [
|
|
"Store-Product-1.2.3-win.msixbundle"]
|
|
stable.validate_candidates(manifest, "v1.2.3", RECEIPT_COMMIT, https_origin.base, RELEASE_EPOCH, archive=ATTEMPT)
|
|
stable.require_smokes_match_claim(manifest, lanes)
|
|
stable.require_targets_match_claim(manifest, lanes)
|
|
|
|
|
|
def test_a_store_plus_macos_claim_records_only_the_macos_smoke(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
"""--without windows: the Windows candidate calls run for the Store bundle and succeed, but no
|
|
Windows package is smoked, so their success is not a smoke result."""
|
|
from scripts.releases import handoff, stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_darwin_handoff(built, "arm64")
|
|
for arch in ("x64", "arm64"):
|
|
(built / f"Store-Product-1.2.3-win-{arch}.msix").write_bytes(f"store msix: {arch}".encode())
|
|
handoff.stage(ATTEMPT, RECEIPT_COMMIT, f"win32-{arch}", built, [f"Store-Product-1.2.3-win-{arch}.msix"])
|
|
_stage_universal_bundle(built, signed=False)
|
|
lanes = lane_set.select(without=["windows"])
|
|
assert lane_set.runs_smokes(lanes) and "windows-store" in lanes
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=lanes))
|
|
calls = _calls(lanes)
|
|
assert calls["candidates-win32-x64"] == {"result": "success"}
|
|
env = {**_receipt_env(tmp_path, https_origin.base), "RELEASE_NEEDS": json.dumps(calls)}
|
|
stable.main(["candidate-manifest"], env)
|
|
manifest = json.loads(r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"][0])
|
|
assert {f"{row['platform']}/{row['arch']}" for row in manifest["packages"]} == {"macos/arm64"}
|
|
assert manifest["smoke_results"]["smoke-darwin-arm64"] == {"result": "success"}
|
|
assert manifest["smoke_results"]["smoke-win32-x64"] == {"result": "skipped"}
|
|
stable.require_smokes_match_claim(manifest, lanes)
|
|
stable.require_targets_match_claim(manifest, lanes)
|
|
|
|
|
|
def test_the_manifest_refuses_a_windows_bundle_the_claims_lanes_did_not_build(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
"""A signed bundle under a Store-only claim, or a missing Store bundle under `windows` + `windows-store`."""
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_windows_handoff(built, "x64")
|
|
_stage_windows_handoff(built, "arm64")
|
|
_stage_universal_bundle(built, store=False)
|
|
for lanes, message in ((["windows", "windows-store"], "Store bundle"), (["windows-store"], "signed Windows bundle")):
|
|
lanes = lane_set.select(only=lanes)
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=lanes))
|
|
env = {**_receipt_env(tmp_path, https_origin.base), "RELEASE_NEEDS": json.dumps(_calls(lanes))}
|
|
with pytest.raises(ValueError, match=message):
|
|
stable.main(["candidate-manifest"], env)
|
|
assert f"releases/tag/{ATTEMPT}/release-candidates.json" not in r2_server.store
|
|
|
|
|
|
def _claim_fixture(tmp_path, *, tag, version, lanes=lane_set.DEFAULT):
|
|
"""A real checkout + bare remote carrying one annotated attempt claim."""
|
|
from scripts.releases.versioning import parse_attempt_ref
|
|
|
|
epoch = candidates("v" + version, "0" * 40, "0" * 64)["releaseEpoch"]
|
|
repo, remote = tmp_path / "repo", tmp_path / "remote.git"
|
|
repo.mkdir()
|
|
subprocess.run(["git", "init", "-b", "main"], cwd=repo, check=True, capture_output=True)
|
|
subprocess.run(["git", "init", "--bare", str(remote)], check=True, capture_output=True)
|
|
subprocess.run(["git", "config", "user.name", "fixture"], cwd=repo, check=True)
|
|
subprocess.run(["git", "config", "user.email", "fixture@example.invalid"], cwd=repo, check=True)
|
|
(repo / "input").write_text("first", encoding="utf-8")
|
|
subprocess.run(["git", "add", "input"], cwd=repo, check=True)
|
|
subprocess.run(["git", "commit", "-m", "first"], cwd=repo, check=True, capture_output=True)
|
|
commit = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=repo, text=True, encoding="utf-8").strip()
|
|
attempt = parse_attempt_ref(tag)[1]
|
|
metadata = json.dumps({
|
|
"schema": 1, "version": version, "attempt": attempt, "commit": commit,
|
|
"autopublish": False, "lanes": sorted(lanes),
|
|
"claimEpoch": epoch,
|
|
}, sort_keys=True, separators=(",", ":"))
|
|
subprocess.run(
|
|
["git", "tag", "-a", tag, "-m", metadata], cwd=repo, check=True,
|
|
env={**os.environ, "GIT_COMMITTER_DATE": f"@{epoch} +0000"},
|
|
)
|
|
subprocess.run(["git", "remote", "add", "origin", str(remote)], cwd=repo, check=True)
|
|
subprocess.run(["git", "push", "origin", "main", tag], cwd=repo, check=True, capture_output=True)
|
|
tag_object = subprocess.check_output(["git", "rev-parse", tag], cwd=repo, text=True, encoding="utf-8").strip()
|
|
return commit, tag_object
|
|
|
|
|
|
def test_complete_writes_no_final_tag_and_leaves_the_draft_on_the_attempt_ref(tmp_path, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
commit, tag_object = _claim_fixture(tmp_path, tag="rc.1-v1.2.3", version="1.2.3")
|
|
candidate = candidates("v1.2.3", commit, "c" * 64, archive="rc.1-v1.2.3")
|
|
calls = []
|
|
|
|
def record(argv):
|
|
calls.append(argv)
|
|
if argv[0] == "gh":
|
|
raise AssertionError("complete must not touch GitHub")
|
|
return subprocess.check_output(argv, text=True, encoding="utf-8").strip()
|
|
|
|
monkeypatch.setattr(stable, "output", record)
|
|
monkeypatch.setattr(stable, "read_candidate", lambda env: candidate)
|
|
monkeypatch.chdir(tmp_path / "repo")
|
|
stable.complete({
|
|
"RELEASE_CLAIM_TAG": "rc.1-v1.2.3", "RELEASE_CLAIM_OBJECT": tag_object,
|
|
**CONTROLLER_ENV,
|
|
"RELEASE_TAG": "v1.2.3", "CANDIDATE_MANIFEST_SHA256": "c" * 64,
|
|
"CLOUDFLARE_R2_PUBLIC_URL": BASE,
|
|
})
|
|
remote = subprocess.check_output(
|
|
["git", "ls-remote", "origin", "refs/tags/*"], text=True, encoding="utf-8")
|
|
assert "refs/tags/v1.2.3" not in remote
|
|
assert not [argv for argv in calls if argv[0] == "gh"]
|
|
|
|
|
|
def _fenced_body(notes="## What's changed\n- x"):
|
|
"""A draft body the way the entrypoint builds it: warning block, notes, warning block."""
|
|
block = WARNING_OPEN + "\nDO NOT PUBLISH THIS BY HAND\n" + WARNING_CLOSE
|
|
return block + "\n" + notes + "\n" + block
|
|
|
|
|
|
def test_strip_removes_both_blocks_and_keeps_the_notes():
|
|
assert strip_draft_warning(_fenced_body()).strip() == "## What's changed\n- x"
|
|
# A body without fences passes through untouched.
|
|
assert strip_draft_warning("just notes") == "just notes"
|
|
|
|
|
|
@pytest.mark.parametrize("body", [
|
|
WARNING_OPEN + "\nunbalanced",
|
|
"text\n" + WARNING_CLOSE,
|
|
WARNING_OPEN + "\n" + WARNING_OPEN + "\n" + WARNING_CLOSE,
|
|
WARNING_OPEN + "text",
|
|
])
|
|
def test_strip_refuses_an_unbalanced_fence(body):
|
|
with pytest.raises(ValueError, match="unbalanced"):
|
|
strip_draft_warning(body)
|
|
|
|
|
|
def _publish_record(commit, tag_object, *, epoch, release_id=42, lanes=lane_set.DEFAULT):
|
|
return {"claim_tag": "rc.2-v1.2.3", "claim_object": tag_object, "tag": "v1.2.3",
|
|
"commit": commit, "version": "1.2.3", "attempt": 2, "release_id": release_id,
|
|
"autopublish": False, "lanes": frozenset(lanes), "claim_epoch": epoch}
|
|
|
|
|
|
def test_publish_attempt_writes_the_receipt_retargets_and_copies_no_bytes(tmp_path, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
commit, tag_object = _claim_fixture(tmp_path, tag="rc.2-v1.2.3", version="1.2.3")
|
|
monkeypatch.chdir(tmp_path / "repo")
|
|
epoch = tag_record(subprocess.check_output(
|
|
["git", "tag", "-l", "rc.2-v1.2.3", "--format=%(contents)"],
|
|
text=True, encoding="utf-8"))["claimEpoch"]
|
|
manifest_bytes = b'{"schema":2}\n'
|
|
manifest_digest = hashlib.sha256(manifest_bytes).hexdigest()
|
|
docker_digest = "sha256:" + "d" * 64
|
|
docker_desktop_digest = "sha256:" + "e" * 64
|
|
release = {"id": 42, "tag_name": "rc.2-v1.2.3", "draft": True, "prerelease": False,
|
|
"body": _fenced_body(), "published_at": None}
|
|
patches = []
|
|
requested_keys = []
|
|
inspected_images = []
|
|
|
|
def run(argv):
|
|
if argv[0] == "git":
|
|
return subprocess.check_output(argv, text=True, encoding="utf-8").strip()
|
|
if argv[:3] == ["docker", "buildx", "imagetools"]:
|
|
inspected_images.append(argv[4])
|
|
assert argv[4] in {
|
|
"nousresearch/hermes-agent:rc.2-v1.2.3",
|
|
"nousresearch/hermes-agent:rc.2-v1.2.3-desktop",
|
|
}
|
|
return json.dumps(docker_desktop_digest if argv[4].endswith("-desktop") else docker_digest)
|
|
if argv[:3] == ["gh", "api", "--method"]:
|
|
fields = {}
|
|
for _flag, value in zip(argv[5::2], argv[6::2]):
|
|
name, _, raw = value.partition("=")
|
|
fields[name] = raw
|
|
patches.append((fields.get("tag_name"), fields.get("draft")))
|
|
release.update({key: (raw == "true") if key in {"draft", "prerelease"} else raw
|
|
for key, raw in fields.items()
|
|
if key in {"tag_name", "draft", "prerelease", "body"}})
|
|
if release["draft"] is False:
|
|
release["published_at"] = "2026-09-22T00:00:00Z"
|
|
return "{}"
|
|
if argv[:2] == ["gh", "api"]:
|
|
assert argv[2].endswith("/releases/42")
|
|
return json.dumps(release)
|
|
raise AssertionError(argv)
|
|
|
|
def read_archive(key):
|
|
requested_keys.append(key)
|
|
return manifest_bytes
|
|
|
|
digests = stable.publish_attempt(
|
|
_publish_record(commit, tag_object, epoch=epoch),
|
|
repository="example/project", run=run, read_archive=read_archive,
|
|
)
|
|
|
|
assert digests == {"candidate_manifest_sha256": manifest_digest,
|
|
"docker_manifest_digest": docker_digest}
|
|
receipt = tag_record(subprocess.check_output(
|
|
["git", "tag", "-l", "v1.2.3", "--format=%(contents)"],
|
|
text=True, encoding="utf-8"))
|
|
assert receipt["claimTag"] == "rc.2-v1.2.3"
|
|
assert receipt["archive"] == "releases/tag/rc.2-v1.2.3/"
|
|
assert receipt["candidateManifestSha256"] == manifest_digest
|
|
assert receipt["dockerManifestDigest"] == docker_digest
|
|
assert inspected_images == [
|
|
"nousresearch/hermes-agent:rc.2-v1.2.3",
|
|
"nousresearch/hermes-agent:rc.2-v1.2.3-desktop",
|
|
]
|
|
assert receipt["releaseId"] == 42
|
|
remote = subprocess.check_output(
|
|
["git", "ls-remote", "origin", "refs/tags/v1.2.3", "refs/tags/v1.2.3^{}"],
|
|
text=True, encoding="utf-8")
|
|
assert commit in remote
|
|
# The digest is hashed from the attempt archive, and no v-tag path is read.
|
|
assert requested_keys == ["releases/tag/rc.2-v1.2.3/release-candidates.json"]
|
|
# The retarget and the strip happen while the release is still a draft;
|
|
# draft=false is its own final call, after both read back.
|
|
assert [draft for _tag, draft in patches] == ["true", "false"]
|
|
assert [tag for tag, _draft in patches] == ["v1.2.3", None]
|
|
assert release["tag_name"] == "v1.2.3" and release["draft"] is False
|
|
assert release["body"] == "## What's changed\n- x"
|
|
|
|
|
|
@pytest.mark.parametrize("lanes,binds_manifest,binds_docker", [
|
|
(["windows"], True, False), (["docker"], False, True), ([], False, False)])
|
|
def test_the_final_receipt_binds_only_what_the_claims_lanes_built(
|
|
tmp_path, monkeypatch, lanes, binds_manifest, binds_docker):
|
|
from scripts.releases import stable
|
|
|
|
commit, tag_object = _claim_fixture(tmp_path, tag="rc.2-v1.2.3", version="1.2.3", lanes=lanes)
|
|
monkeypatch.chdir(tmp_path / "repo")
|
|
epoch = tag_record(subprocess.check_output(
|
|
["git", "tag", "-l", "rc.2-v1.2.3", "--format=%(contents)"],
|
|
text=True, encoding="utf-8"))["claimEpoch"]
|
|
release = {"id": 42, "tag_name": "rc.2-v1.2.3", "draft": True, "prerelease": False,
|
|
"body": "notes", "published_at": None}
|
|
archive_reads = []
|
|
|
|
def run(argv):
|
|
if argv[0] == "git":
|
|
return subprocess.check_output(argv, text=True, encoding="utf-8").strip()
|
|
if argv[:3] == ["docker", "buildx", "imagetools"]:
|
|
assert binds_docker, "a claim without the docker lane reads no image"
|
|
return json.dumps("sha256:" + "d" * 64)
|
|
if argv[:3] == ["gh", "api", "--method"]:
|
|
fields = dict(value.partition("=")[::2] for value in argv[6::2])
|
|
release.update({key: (raw == "true") if key in {"draft", "prerelease"} else raw
|
|
for key, raw in fields.items() if key in {"tag_name", "draft", "prerelease", "body"}})
|
|
if release["draft"] is False:
|
|
release["published_at"] = "2026-09-22T00:00:00Z"
|
|
return "{}"
|
|
if argv[:2] == ["gh", "api"]:
|
|
return json.dumps(release)
|
|
raise AssertionError(argv)
|
|
|
|
digests = stable.publish_attempt(
|
|
_publish_record(commit, tag_object, epoch=epoch, lanes=lanes), repository="example/project",
|
|
run=run, read_archive=lambda key: archive_reads.append(key) or b"{}")
|
|
assert (digests["candidate_manifest_sha256"] is not None) == binds_manifest == bool(archive_reads)
|
|
assert (digests["docker_manifest_digest"] is not None) == binds_docker
|
|
final = tag_record(subprocess.check_output(["git", "tag", "-l", "v1.2.3", "--format=%(contents)"],
|
|
text=True, encoding="utf-8"))
|
|
claim = {"autopublish": False, "claimEpoch": epoch, "lanes": frozenset(lanes)}
|
|
stable.validate_final(final, version="1.2.3", commit=commit, claim_tag="rc.2-v1.2.3",
|
|
claim_object=tag_object, claim=claim)
|
|
# The receipt of a different lane set is refused: a Docker digest the claim never built.
|
|
with pytest.raises(ValueError, match="differs from its claim"):
|
|
stable.validate_final(final, version="1.2.3", commit=commit, claim_tag="rc.2-v1.2.3",
|
|
claim_object=tag_object,
|
|
claim={**claim, "lanes": frozenset({"windows", "docker"} - set(lanes)) or frozenset({"docker"})})
|
|
|
|
|
|
def test_publish_attempt_refuses_a_release_that_is_no_longer_a_draft(tmp_path, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
commit, tag_object = _claim_fixture(tmp_path, tag="rc.2-v1.2.3", version="1.2.3")
|
|
monkeypatch.chdir(tmp_path / "repo")
|
|
epoch = tag_record(subprocess.check_output(
|
|
["git", "tag", "-l", "rc.2-v1.2.3", "--format=%(contents)"],
|
|
text=True, encoding="utf-8"))["claimEpoch"]
|
|
release = {"id": 42, "tag_name": "rc.2-v1.2.3", "draft": False, "prerelease": False,
|
|
"body": "notes", "published_at": "2026-09-22T00:00:00Z"}
|
|
|
|
def run(argv):
|
|
if argv[0] == "git":
|
|
return subprocess.check_output(argv, text=True, encoding="utf-8").strip()
|
|
if argv[:3] == ["docker", "buildx", "imagetools"]:
|
|
return json.dumps("sha256:" + "d" * 64)
|
|
if argv[:2] == ["gh", "api"]:
|
|
return json.dumps(release)
|
|
raise AssertionError(argv)
|
|
|
|
with pytest.raises(ValueError, match="no longer a draft"):
|
|
stable.publish_attempt(
|
|
_publish_record(commit, tag_object, epoch=epoch),
|
|
repository="example/project", run=run, read_archive=lambda _key: b"m",
|
|
)
|
|
# The custody receipt still exists: a public release cannot be repaired,
|
|
# but the tag must not be skipped either.
|
|
assert "refs/tags/v1.2.3" in subprocess.check_output(
|
|
["git", "ls-remote", "origin", "refs/tags/v1.2.3"], text=True, encoding="utf-8")
|
|
|
|
|
|
def test_edit_draft_release_refuses_a_body_that_still_carries_a_fence(tmp_path, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
commit, _tag_object = _claim_fixture(tmp_path, tag="rc.2-v1.2.3", version="1.2.3")
|
|
monkeypatch.chdir(tmp_path / "repo")
|
|
release = {"id": 42, "tag_name": "rc.2-v1.2.3", "draft": True, "prerelease": False,
|
|
"body": _fenced_body(), "published_at": None}
|
|
# The PATCH is dropped on the floor: the read-back still shows the fence.
|
|
def run(argv):
|
|
if argv[0] == "git":
|
|
return subprocess.check_output(argv, text=True, encoding="utf-8").strip()
|
|
if argv[:3] == ["gh", "api", "--method"]:
|
|
return "{}"
|
|
if argv[:2] == ["gh", "api"]:
|
|
return json.dumps(release)
|
|
raise AssertionError(argv)
|
|
|
|
with pytest.raises(ValueError):
|
|
stable.edit_draft_release("example/project", 42, "v1.2.3", commit, run=run)
|
|
|
|
|
|
def test_edit_draft_release_sends_the_notes_byte_for_byte(tmp_path, monkeypatch):
|
|
"""Notes that open with a mention must not be read as a file by ``gh api``."""
|
|
from scripts.releases import stable
|
|
from scripts.releases.draft_warning import draft_body
|
|
|
|
commit, _tag_object = _claim_fixture(tmp_path, tag="rc.2-v1.2.3", version="1.2.3")
|
|
monkeypatch.chdir(tmp_path / "repo")
|
|
notes = "@alice fixed the updater\n\n42\ntrue"
|
|
release = {"id": 42, "tag_name": "rc.2-v1.2.3", "draft": True, "prerelease": False,
|
|
"body": draft_body(version="1.2.3", attempt_ref="rc.2-v1.2.3", notes=notes),
|
|
"published_at": None}
|
|
|
|
def gh_value(flag, value):
|
|
# gh api: -f/--raw-field is a literal string; -F/--field reads @file and
|
|
# converts true/false/null/integers.
|
|
if flag == "--raw-field":
|
|
return value
|
|
if value.startswith("@"):
|
|
raise FileNotFoundError(value[1:])
|
|
return {"true": True, "false": False, "null": None}.get(
|
|
value, int(value) if value.isdigit() else value)
|
|
|
|
def run(argv):
|
|
if argv[0] == "git":
|
|
return subprocess.check_output(argv, text=True, encoding="utf-8").strip()
|
|
if argv[:3] == ["gh", "api", "--method"]:
|
|
pairs = zip(argv[5::2], argv[6::2])
|
|
for flag, field in pairs:
|
|
key, _, value = field.partition("=")
|
|
release[key] = gh_value(flag, value)
|
|
return "{}"
|
|
if argv[:2] == ["gh", "api"]:
|
|
return json.dumps(release)
|
|
raise AssertionError(argv)
|
|
|
|
stable.edit_draft_release("example/project", 42, "v1.2.3", commit, run=run)
|
|
|
|
assert release["body"].strip() == notes
|
|
assert release["tag_name"] == "v1.2.3" and release["draft"] is True
|
|
|
|
|
|
# ── B3: stage-receipt ──────────────────────────────────────────────────────
|
|
|
|
ATTEMPT = "rc.1-v1.2.3"
|
|
RECEIPT_COMMIT = "a" * 40
|
|
WINDOWS_VERSION = "2026.5761.123.0"
|
|
RELEASE_EPOCH = 1_787_965_323
|
|
|
|
|
|
def _calls(lanes=lane_set.NAMES):
|
|
"""The candidate calls' results: success for each the claim built, skipped for the rest."""
|
|
runs = lane_set.jobs_to_run(lanes)
|
|
return {call: {"result": "success" if runs[call] else "skipped"} for call in lane_set.CANDIDATE_CALLS}
|
|
|
|
|
|
def _fake_stable_context(*, lanes=lane_set.NAMES):
|
|
def context(env):
|
|
return "v1.2.3", RECEIPT_COMMIT, {"claim_tag": ATTEMPT, "claim_object": "0" * 40,
|
|
"claim_epoch": RELEASE_EPOCH, "lanes": frozenset(lanes)}
|
|
return context
|
|
|
|
|
|
def _stage_darwin_handoff(built, arch):
|
|
from scripts.releases import handoff
|
|
|
|
package = f"HermesBundled-1.2.3-mac-{arch}.zip"
|
|
(built / package).write_bytes(f"signed mac zip: {arch}".encode())
|
|
metadata = built / f"metadata-macos-{arch}.json"
|
|
metadata.write_text(json.dumps({
|
|
"platform": "macos", "arch": arch, "tag": "v1.2.3", "commit": RECEIPT_COMMIT,
|
|
"baseVersion": "1.2.3", "identity": "test.application", "version": "1.2.3",
|
|
"teamId": "ABCDEFGHIJ", "filename": package,
|
|
}), encoding="utf-8")
|
|
handoff.stage(ATTEMPT, RECEIPT_COMMIT, f"darwin-{arch}", built, [package, metadata.name])
|
|
|
|
|
|
def _stage_windows_handoff(built, arch, *, with_metadata=True):
|
|
from scripts.releases import handoff
|
|
|
|
package = f"HermesBundled-1.2.3-win-{arch}.msix"
|
|
(built / package).write_bytes(f"signed msix: {arch}".encode())
|
|
includes = [package]
|
|
if with_metadata:
|
|
metadata = built / f"metadata-windows-{arch}.json"
|
|
metadata.write_text(json.dumps({
|
|
"platform": "windows", "arch": arch, "tag": "v1.2.3", "commit": RECEIPT_COMMIT,
|
|
"baseVersion": "1.2.3", "identity": "test.application",
|
|
"version": WINDOWS_VERSION, "executableVersion": WINDOWS_VERSION,
|
|
"publisher": "CN=Test", "applicationId": "App",
|
|
}), encoding="utf-8")
|
|
includes.append(metadata.name)
|
|
handoff.stage(ATTEMPT, RECEIPT_COMMIT, f"win32-{arch}", built, includes)
|
|
|
|
|
|
def _stage_universal_bundle(built, *, signed=True, store=True):
|
|
from scripts.releases import handoff
|
|
|
|
if signed:
|
|
bundle = built / "Product-1.2.3-win.msixbundle"
|
|
with zipfile.ZipFile(bundle, "w") as archive:
|
|
archive.writestr("AppxMetadata/AppxBundleManifest.xml",
|
|
f'<Bundle><Identity Name="test.application" Publisher="CN=Test" Version="{WINDOWS_VERSION}"/>'
|
|
'<Packages><Package Type="application" Architecture="arm64"/>'
|
|
'<Package Type="application" Architecture="x64"/></Packages></Bundle>')
|
|
if store:
|
|
(built / "Store-Product-1.2.3-win.msixbundle").write_bytes(b"Store bundle transport fixture")
|
|
handoff.stage(ATTEMPT, RECEIPT_COMMIT, "windows-universal", built, ["*.msixbundle"])
|
|
|
|
|
|
def _receipt_env(tmp_path, base):
|
|
return {"RELEASE_TAG": "v1.2.3", "CLOUDFLARE_R2_PUBLIC_URL": base,
|
|
"GITHUB_OUTPUT": str(tmp_path / "output")}
|
|
|
|
|
|
def test_stage_receipt_publishes_the_groups_signed_receipt(tmp_path, r2_server, https_origin,
|
|
monkeypatch, capsys):
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_darwin_handoff(built, "arm64")
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context())
|
|
stable.main(["stage-receipt", "--receipt", "darwin-arm64"], _receipt_env(tmp_path, https_origin.base))
|
|
|
|
stored, _ = r2_server.store[f"releases/tag/{ATTEMPT}/darwin-arm64-receipt.json"]
|
|
receipt = json.loads(stored)
|
|
assert receipt["tag"] == "v1.2.3" and receipt["archive"] == ATTEMPT
|
|
assert receipt["releaseEpoch"] == RELEASE_EPOCH
|
|
assert [f"{row['platform']}/{row['arch']}" for row in receipt["packages"]] == ["macos/arm64"]
|
|
assert "smoke_results" not in receipt
|
|
url = f"{https_origin.base}/releases/tag/{ATTEMPT}/darwin-arm64-receipt.json"
|
|
digest = hashlib.sha256(stored).hexdigest()
|
|
printed = capsys.readouterr().out
|
|
assert url in printed and digest in printed
|
|
emitted = (tmp_path / "output").read_text(encoding="utf-8")
|
|
assert f"receipt-url={url}" in emitted and f"receipt-sha256={digest}" in emitted
|
|
|
|
|
|
def test_stage_receipt_publishes_both_windows_rows_from_the_bundle(tmp_path, r2_server, https_origin,
|
|
monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_windows_handoff(built, "x64")
|
|
_stage_windows_handoff(built, "arm64")
|
|
_stage_universal_bundle(built)
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context())
|
|
stable.main(["stage-receipt", "--receipt", "win32-bundle"], _receipt_env(tmp_path, https_origin.base))
|
|
|
|
stored, _ = r2_server.store[f"releases/tag/{ATTEMPT}/win32-bundle-receipt.json"]
|
|
receipt = json.loads(stored)
|
|
rows = {f"{row['platform']}/{row['arch']}": row for row in receipt["packages"]}
|
|
assert set(rows) == {"windows/x64", "windows/arm64"}
|
|
assert all(row["artifact"]["url"].endswith("Product-1.2.3-win.msixbundle") for row in rows.values())
|
|
assert rows["windows/x64"]["artifact"]["url"].startswith(f"{https_origin.base}/releases/tag/{ATTEMPT}/")
|
|
assert rows["windows/x64"]["executableVersion"] == WINDOWS_VERSION
|
|
|
|
|
|
def test_stage_receipt_refuses_a_bundle_whose_arm64_row_is_absent(tmp_path, r2_server, https_origin,
|
|
monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_windows_handoff(built, "x64")
|
|
# The arm64 leg staged its bytes but no metadata row: the receipt must refuse.
|
|
_stage_windows_handoff(built, "arm64", with_metadata=False)
|
|
_stage_universal_bundle(built)
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context())
|
|
with pytest.raises(ValueError):
|
|
stable.main(["stage-receipt", "--receipt", "win32-bundle"], _receipt_env(tmp_path, https_origin.base))
|
|
assert f"releases/tag/{ATTEMPT}/win32-bundle-receipt.json" not in r2_server.store
|
|
|
|
|
|
def _stage_termux_handoff(built):
|
|
from scripts.releases import handoff
|
|
|
|
deb = built / "deb" / "product.deb"
|
|
deb.parent.mkdir(exist_ok=True)
|
|
deb.write_bytes(b"termux deb transport fixture")
|
|
metadata = built / "metadata-termux-aarch64.json"
|
|
metadata.write_text(json.dumps({
|
|
"platform": "termux", "arch": "aarch64", "tag": "v1.2.3", "commit": RECEIPT_COMMIT,
|
|
"baseVersion": "1.2.3", "identity": "hermes-desktop", "version": "1.2.3-1",
|
|
"filename": "deb/product.deb",
|
|
}), encoding="utf-8")
|
|
handoff.stage(ATTEMPT, RECEIPT_COMMIT, "termux", built, ["deb/*", metadata.name])
|
|
|
|
|
|
def _local_baseline(base):
|
|
"""The published previous stable, keyed to the fixture's HTTPS origin."""
|
|
baseline = candidates("v1.2.2", "9" * 40, "3" * 64)
|
|
for row in baseline["packages"]:
|
|
row["artifact"]["url"] = row["artifact"]["url"].replace(BASE, base)
|
|
return baseline
|
|
|
|
|
|
def _transitions_env(tmp_path, base, receipt, url, digest):
|
|
# A runner always provides RUNNER_TEMP as an existing directory.
|
|
(tmp_path / "runner-temp").mkdir(exist_ok=True)
|
|
return {"RECEIPT": receipt, "RECEIPT_URL": url, "RECEIPT_SHA256": digest,
|
|
"RELEASE_TAG": "v1.2.3", "RELEASE_CLAIM_TAG": ATTEMPT,
|
|
"RELEASE_CLAIM_OBJECT": "0" * 40,
|
|
"BASELINE_MANIFEST_URL": f"{base}/baseline.json",
|
|
"CLOUDFLARE_R2_PUBLIC_URL": base,
|
|
"RUNNER_TEMP": str(tmp_path / "runner-temp"),
|
|
"GITHUB_OUTPUT": str(tmp_path / "output"),
|
|
"GITHUB_REPOSITORY": "example/project"}
|
|
|
|
|
|
def _staged_receipt(tmp_path, r2_server, https_origin, monkeypatch, receipt):
|
|
"""Stage one group's handoffs and publish its receipt; return its URL+digest."""
|
|
import urllib.request
|
|
|
|
from scripts.releases import stable
|
|
|
|
# The receipt and the baseline are read over the fixture's self-signed
|
|
# origin; trust it the way the production opener would trust the CDN.
|
|
monkeypatch.setattr(urllib.request, "urlopen", https_origin.opener)
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir(exist_ok=True)
|
|
if receipt in ("darwin-arm64", "darwin-x64"):
|
|
_stage_darwin_handoff(built, receipt.split("-")[1])
|
|
elif receipt == "win32-bundle":
|
|
_stage_windows_handoff(built, "x64")
|
|
_stage_windows_handoff(built, "arm64")
|
|
_stage_universal_bundle(built)
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context())
|
|
stable.main(["stage-receipt", "--receipt", receipt], _receipt_env(tmp_path, https_origin.base))
|
|
key = f"releases/tag/{ATTEMPT}/{receipt}-receipt.json"
|
|
stored, _ = r2_server.store[key]
|
|
return f"{https_origin.base}/releases/tag/{ATTEMPT}/{receipt}-receipt.json", \
|
|
hashlib.sha256(stored).hexdigest()
|
|
|
|
|
|
def test_transitions_from_one_darwin_receipt_emit_one_macos_row(tmp_path, r2_server, https_origin,
|
|
monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
url, digest = _staged_receipt(tmp_path, r2_server, https_origin, monkeypatch, "darwin-arm64")
|
|
baseline = _local_baseline(https_origin.base)
|
|
https_origin.store["baseline.json"] = (json.dumps(baseline).encode(), '"e"')
|
|
monkeypatch.setattr(stable, "output", lambda argv: json.dumps(
|
|
{"tagName": baseline["tag"], "isDraft": False, "isPrerelease": False}))
|
|
stable.main(["transitions"], _transitions_env(tmp_path, https_origin.base,
|
|
"darwin-arm64", url, digest))
|
|
emitted = dict(line.split("=", 1)
|
|
for line in (tmp_path / "output").read_text(encoding="utf-8").splitlines())
|
|
macos = json.loads(emitted["macos"])
|
|
windows = json.loads(emitted["windows"])
|
|
assert [row["arch"] for row in macos["include"]] == ["arm64"]
|
|
assert windows["include"] == []
|
|
assert all(row["manifest"].startswith(f"{https_origin.base}/releases/tag/{ATTEMPT}/")
|
|
for row in macos["include"])
|
|
|
|
|
|
def test_transitions_from_the_bundle_receipt_emit_two_windows_rows(tmp_path, r2_server, https_origin,
|
|
monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
url, digest = _staged_receipt(tmp_path, r2_server, https_origin, monkeypatch, "win32-bundle")
|
|
baseline = _local_baseline(https_origin.base)
|
|
https_origin.store["baseline.json"] = (json.dumps(baseline).encode(), '"e"')
|
|
monkeypatch.setattr(stable, "output", lambda argv: json.dumps(
|
|
{"tagName": baseline["tag"], "isDraft": False, "isPrerelease": False}))
|
|
stable.main(["transitions"], _transitions_env(tmp_path, https_origin.base,
|
|
"win32-bundle", url, digest))
|
|
emitted = dict(line.split("=", 1)
|
|
for line in (tmp_path / "output").read_text(encoding="utf-8").splitlines())
|
|
macos = json.loads(emitted["macos"])
|
|
windows = json.loads(emitted["windows"])
|
|
assert [row["arch"] for row in windows["include"]] == ["x64", "arm64"]
|
|
assert macos["include"] == []
|
|
|
|
|
|
def test_missing_baseline_plans_no_upgrade_arm_but_a_missing_supplied_one_blocks(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
url, digest = _staged_receipt(tmp_path, r2_server, https_origin, monkeypatch, "darwin-arm64")
|
|
env = {**_transitions_env(tmp_path, https_origin.base, "darwin-arm64", url, digest),
|
|
"BASELINE_MANIFEST_URL": ""}
|
|
stable.main(["transitions"], env)
|
|
emitted = dict(line.split("=", 1)
|
|
for line in (tmp_path / "output").read_text(encoding="utf-8").splitlines())
|
|
assert emitted["baseline"] == "none"
|
|
assert json.loads(emitted["macos"]) == json.loads(emitted["windows"]) == {"include": []}
|
|
env["BASELINE_MANIFEST_URL"] = f"{https_origin.base}/baseline.json"
|
|
with pytest.raises(ValueError, match="supplied baseline-manifest does not exist"):
|
|
stable.main(["transitions"], env)
|
|
|
|
|
|
def test_gate_excuses_an_upgrade_arm_only_for_its_planners_no_baseline_output():
|
|
from scripts.releases.stable import PACKAGED_BY, require_gate
|
|
|
|
required = [*PACKAGED_BY, *PACKAGED_BY.values()]
|
|
needs = {name: {"result": "skipped"} for name in PACKAGED_BY}
|
|
needs.update({name: {"result": "success", "outputs": {"baseline": "none"}}
|
|
for name in PACKAGED_BY.values()})
|
|
require_gate(needs, required, lanes=lane_set.NAMES)
|
|
for packaged, planner in PACKAGED_BY.items():
|
|
for planned in ({"result": "success", "outputs": {"baseline": "published"}},
|
|
{"result": "success"}, {"result": "failure", "outputs": {"baseline": "none"}}):
|
|
with pytest.raises(ValueError, match=packaged):
|
|
require_gate({**needs, planner: planned}, required, lanes=lane_set.NAMES)
|
|
|
|
|
|
def test_candidate_manifest_needs_every_call_and_stages_the_archive_manifest(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_darwin_handoff(built, "arm64")
|
|
_stage_windows_handoff(built, "x64")
|
|
_stage_windows_handoff(built, "arm64")
|
|
_stage_universal_bundle(built)
|
|
_stage_termux_handoff(built)
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context())
|
|
env = {**_receipt_env(tmp_path, https_origin.base),
|
|
"RELEASE_NEEDS": json.dumps(_calls())}
|
|
stable.main(["candidate-manifest"], env)
|
|
|
|
stored, _ = r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"]
|
|
manifest = json.loads(stored)
|
|
assert {f"{row['platform']}/{row['arch']}" for row in manifest["packages"]} == {
|
|
"macos/arm64", "windows/x64", "windows/arm64", "termux/aarch64"}
|
|
stable.validate_candidates(manifest, "v1.2.3", RECEIPT_COMMIT, https_origin.base,
|
|
RELEASE_EPOCH, archive=ATTEMPT)
|
|
emitted = dict(line.split("=", 1)
|
|
for line in (tmp_path / "output").read_text(encoding="utf-8").splitlines())
|
|
assert emitted["manifest-url"] == \
|
|
f"{https_origin.base}/releases/tag/{ATTEMPT}/release-candidates.json"
|
|
assert emitted["manifest-sha256"] == hashlib.sha256(stored).hexdigest()
|
|
|
|
# A candidate call that did not succeed (a failed smoke behind it) leaves
|
|
# no accepted manifest in the archive.
|
|
failed = dict(env)
|
|
failed["RELEASE_NEEDS"] = json.dumps({**_calls(), "candidates-darwin-arm64": {"result": "failure"}})
|
|
del r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"]
|
|
(tmp_path / "output").unlink()
|
|
with pytest.raises(ValueError, match="smoke-darwin-arm64"):
|
|
stable.main(["candidate-manifest"], failed)
|
|
assert f"releases/tag/{ATTEMPT}/release-candidates.json" not in r2_server.store
|
|
|
|
|
|
def test_a_claim_without_the_smoke_lane_records_skipped_smokes_never_passed(
|
|
tmp_path, r2_server, https_origin, monkeypatch):
|
|
from scripts.releases import stable
|
|
|
|
https_origin.store = r2_server.store
|
|
built = tmp_path / "built"
|
|
built.mkdir()
|
|
_stage_darwin_handoff(built, "arm64")
|
|
_stage_windows_handoff(built, "x64")
|
|
_stage_windows_handoff(built, "arm64")
|
|
_stage_universal_bundle(built)
|
|
_stage_termux_handoff(built)
|
|
monkeypatch.setattr(stable, "stable_context", _fake_stable_context(lanes=lane_set.select(only=lane_set.NAMES, without=["smoke"])))
|
|
calls = _calls()
|
|
env = {**_receipt_env(tmp_path, https_origin.base), "RELEASE_NEEDS": json.dumps(calls)}
|
|
# A build call that failed still leaves no manifest, even with the smokes off.
|
|
failed = {**env, "RELEASE_NEEDS": json.dumps({**calls, "candidates-win32-x64": {"result": "failure"}})}
|
|
with pytest.raises(ValueError, match="candidates-win32-x64"):
|
|
stable.main(["candidate-manifest"], failed)
|
|
assert f"releases/tag/{ATTEMPT}/release-candidates.json" not in r2_server.store
|
|
|
|
stable.main(["candidate-manifest"], env)
|
|
|
|
stored, _ = r2_server.store[f"releases/tag/{ATTEMPT}/release-candidates.json"]
|
|
manifest = json.loads(stored)
|
|
assert manifest["smoke_results"] == {job: {"result": "skipped"} for job in stable.SMOKE_JOBS}
|
|
stable.validate_candidates(manifest, "v1.2.3", RECEIPT_COMMIT, https_origin.base,
|
|
RELEASE_EPOCH, archive=ATTEMPT)
|
|
stable.require_smokes_match_claim(manifest, lane_set.select(without=["smoke"]))
|
|
with pytest.raises(ValueError, match="test policy"):
|
|
stable.require_smokes_match_claim(manifest, lane_set.DEFAULT)
|
|
|
|
|
|
def test_the_final_tag_push_authenticates_with_gh_token_without_persisted_credentials():
|
|
"""The publication checkout persists no credentials; the push brings GH_TOKEN itself."""
|
|
from scripts.releases.stable import authenticated_push
|
|
ref = "refs/tags/v1.2.3"
|
|
argv = authenticated_push(ref, {"GH_TOKEN": "token"})
|
|
assert argv[0] == "git" and argv[-3:] == ["push", "origin", ref]
|
|
# Reset inherited helpers first, then hand git the token through gh.
|
|
assert argv[1:5] == ["-c", "credential.helper=", "-c", "credential.helper=!gh auth git-credential"]
|
|
assert "token" not in " ".join(argv)
|
|
assert authenticated_push(ref, {}) == ["git", "push", "origin", ref]
|