Repair Gitea Actions bootstrap and module matrix

tests/test_postgres_integration_check.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+import importlib.util
+import os
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+
+
+META_ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = META_ROOT / "tools" / "checks" / "postgres-integration-check.py"
+
+
+def _load_script():
+    spec = importlib.util.spec_from_file_location(
+        "postgres_integration_check",
+        SCRIPT,
+    )
+    if spec is None or spec.loader is None:
+        raise RuntimeError(f"Could not load {SCRIPT}")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class PostgresIntegrationCheckTests(unittest.TestCase):
+    def test_staging_check_has_explicit_runtime_safety_settings(self) -> None:
+        module = _load_script()
+
+        with patch.dict(os.environ, {}, clear=True):
+            env = module._check_env(
+                database_url="postgresql+psycopg://user:password@postgres/db",
+                modules="tenancy,access,search",
+                app_env="staging",
+            )
+
+        self.assertEqual(
+            env["CORS_ORIGINS"],
+            "http://127.0.0.1:5173,http://localhost:5173",
+        )
+        self.assertEqual(
+            env["GOVOPLAN_TRUSTED_HOSTS"],
+            "127.0.0.1,localhost,testserver",
+        )
+        self.assertEqual(
+            env["GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS"],
+            "false",
+        )
+
+    def test_existing_runtime_safety_settings_are_preserved(self) -> None:
+        module = _load_script()
+        configured = {
+            "CORS_ORIGINS": "https://govoplan.example.test",
+            "GOVOPLAN_TRUSTED_HOSTS": "govoplan.example.test",
+            "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "true",
+        }
+
+        with patch.dict(os.environ, configured, clear=True):
+            env = module._check_env(
+                database_url="postgresql+psycopg://user:password@postgres/db",
+                modules="tenancy,access,search",
+                app_env="staging",
+            )
+
+        for key, value in configured.items():
+            self.assertEqual(env[key], value)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_release_integration.py

@@ -141,6 +141,15 @@ def test_pytest_style_function():
         self.assertIn('--core-root "$ROOT"', script)
         self.assertNotIn('"$PYTHON" -m unittest tests.test_module_system', script)
 
+    def test_module_matrix_installs_search_before_postgres_validation(self) -> None:
+        meta_root = Path(__file__).resolve().parents[1]
+        workflow = (meta_root / ".gitea" / "workflows" / "module-matrix.yml").read_text(encoding="utf-8")
+
+        install = workflow.index("pip install --no-deps ../govoplan-search")
+        validation = workflow.index("Validate Search against PostgreSQL")
+
+        self.assertLess(install, validation)
+
     def test_release_workflow_installs_tagged_source_test_harness(self) -> None:
         meta_root = Path(__file__).resolve().parents[1]
         workflow = (meta_root / ".gitea" / "workflows" / "release-integration.yml").read_text(encoding="utf-8")

tests/test_repository_bootstrap.py

@@ -359,6 +359,35 @@ class RepositoryBootstrapTests(unittest.TestCase):
         self.assertEqual(1, status)
         runner.assert_not_called()
 
+    def test_anonymous_ci_bootstrap_excludes_registered_transport_repositories(
+        self,
+    ) -> None:
+        manifest = json.loads(
+            (META_ROOT / "repositories.json").read_text(encoding="utf-8")
+        )
+        registered_only = {
+            entry["name"]
+            for entry in manifest["repositories"]
+            if entry.get("bootstrap_transport") == "registered"
+        }
+        self.assertTrue(registered_only)
+
+        for workflow in sorted(
+            (META_ROOT / ".gitea" / "workflows").glob("*.yml")
+        ):
+            contents = workflow.read_text(encoding="utf-8")
+            if (
+                "bootstrap-repositories.py" not in contents
+                or "--transport public-https" not in contents
+            ):
+                continue
+            with self.subTest(workflow=workflow.name):
+                for repository in registered_only:
+                    self.assertIn(
+                        f"--exclude-repo {repository}",
+                        contents,
+                    )
+
 
 if __name__ == "__main__":
     unittest.main()