cesnimda
35 lines
1.5 KiB
Python
35 lines
1.5 KiB
Python
"""Repository quarantine guards; these never certify actual runner isolation."""
|
|
from pathlib import Path
|
|
import re
|
|
import unittest
|
|
|
|
WORKFLOW = Path(__file__).resolve().parents[1] / '.gitea/workflows/mariadb-integration.yml'
|
|
|
|
|
|
class MariaDbWorkflowQuarantine(unittest.TestCase):
|
|
def setUp(self):
|
|
self.text = WORKFLOW.read_text(encoding='utf-8')
|
|
|
|
def test_requires_dedicated_routing_instead_of_shared_deployment_label(self):
|
|
self.assertRegex(self.text, r'(?m)^ runs-on: jobtracker-mariadb-isolated$')
|
|
self.assertNotRegex(self.text, r'(?m)^ runs-on: ubuntu-latest$')
|
|
|
|
def test_untrusted_pull_requests_cannot_automatically_prepare_a_job(self):
|
|
self.assertNotRegex(self.text, r'(?m)^ pull_request(?:_target)?:')
|
|
|
|
def test_operator_blocker_precedes_checkout_and_database_execution(self):
|
|
guard = self.text.index('- name: Require verified runner isolation')
|
|
checkout = self.text.index('- uses: actions/checkout')
|
|
self.assertLess(guard, checkout)
|
|
self.assertRegex(self.text[guard:checkout], r'(?m)^ exit 1$')
|
|
|
|
def test_current_development_branch_keeps_a_visible_qualification_lane(self):
|
|
self.assertIn('fix/p9-model-cache-and-ci-qualification', self.text)
|
|
self.assertIn('python3 scripts/mariadb-integration.py', self.text)
|
|
self.assertNotIn('privileged:', self.text)
|
|
self.assertNotIn('/var/run/docker.sock', self.text)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|