GovOPlaN/govoplan
1
0
Fork 0
Code Issues 19 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: authenticate private module bootstrap in CI
Dependency Audit / dependency-audit (push) Failing after 9s
Details
Deployment Installer / deployment-installer (push) Successful in 6s
Details
Security Audit / security-audit (push) Failing after 8s
Details

Browse Source
This commit is contained in:
zemion
2026-08-02 05:40:22 +02:00
parent ed31409034
commit d9003bf63a
7 changed files with 153 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_repository_bootstrap.py
+69 -19
View File
@@ -94,8 +94,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
"name": "govoplan-core",
"path": "govoplan-core",
"remote": (
"git@git.add-ideas.de:"
"GovOPlaN/govoplan-core.git"
"git@git.add-ideas.de:GovOPlaN/govoplan-core.git"
),
}
],
@@ -134,6 +133,66 @@ class RepositoryBootstrapTests(unittest.TestCase):
self.assertEqual("/bin/false", environment["GIT_ASKPASS"])
self.assertEqual("0", environment["GIT_TERMINAL_PROMPT"])
def test_checkout_auth_is_forwarded_without_entering_clone_arguments(self) -> None:
bootstrap = load_bootstrap_module()
environment = {
"GIT_CONFIG_COUNT": "1",
"GIT_CONFIG_KEY_0": "url.https://example.test/.insteadOf",
"GIT_CONFIG_VALUE_0": "ssh://example.test/",
}
auth_header = "AUTHORIZATION: basic c2hvcnQtbGl2ZWQtam9iLXRva2Vu"
with patch.object(
bootstrap.subprocess,
"run",
return_value=bootstrap.subprocess.CompletedProcess(
args=[],
returncode=0,
stdout=auth_header + "\n",
),
) as runner:
bootstrap._add_checkout_auth(environment, root=Path("/workspace/meta"))
runner.assert_called_once_with(
[
"git",
"-C",
"/workspace/meta",
"config",
"--local",
"--get",
bootstrap.GITEA_CHECKOUT_AUTH_KEY,
],
check=False,
capture_output=True,
text=True,
)
self.assertEqual("2", environment["GIT_CONFIG_COUNT"])
self.assertEqual(
bootstrap.GITEA_CHECKOUT_AUTH_KEY,
environment["GIT_CONFIG_KEY_1"],
)
self.assertEqual(auth_header, environment["GIT_CONFIG_VALUE_1"])
def test_checkout_auth_fails_closed_when_checkout_did_not_persist_it(self) -> None:
bootstrap = load_bootstrap_module()
with (
patch.object(
bootstrap.subprocess,
"run",
return_value=bootstrap.subprocess.CompletedProcess(
args=[],
returncode=1,
stdout="",
),
),
self.assertRaisesRegex(
ValueError, "checkout authentication is unavailable"
),
):
bootstrap._add_checkout_auth({}, root=Path("/workspace/meta"))
def test_main_validates_every_remote_before_cloning(self) -> None:
bootstrap = load_bootstrap_module()
with tempfile.TemporaryDirectory(prefix="govoplan-bootstrap-") as directory:
@@ -149,8 +208,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
"name": "govoplan-core",
"path": "govoplan-core",
"remote": (
"git@git.add-ideas.de:"
"GovOPlaN/govoplan-core.git"
"git@git.add-ideas.de:GovOPlaN/govoplan-core.git"
),
},
{
@@ -197,9 +255,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
"git@git.add-ideas.de:"
"add-ideas/addideas-govoplan-website.git"
),
"bootstrap_transport": (
bootstrap.REGISTERED_TRANSPORT
),
"bootstrap_transport": (bootstrap.REGISTERED_TRANSPORT),
}
],
}
@@ -240,10 +296,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
{
"name": name,
"path": name,
"remote": (
"git@git.add-ideas.de:GovOPlaN/"
f"{name}.git"
),
"remote": (f"git@git.add-ideas.de:GovOPlaN/{name}.git"),
}
for name in ("govoplan-core", "govoplan-poll")
],
@@ -291,8 +344,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
"name": "govoplan-core",
"path": "govoplan-core",
"remote": (
"git@git.add-ideas.de:"
"GovOPlaN/govoplan-core.git"
"git@git.add-ideas.de:GovOPlaN/govoplan-core.git"
),
}
],
@@ -333,8 +385,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
"name": "govoplan-core",
"path": "govoplan-core",
"remote": (
"git@git.add-ideas.de:"
"GovOPlaN/govoplan-core.git"
"git@git.add-ideas.de:GovOPlaN/govoplan-core.git"
),
}
],
@@ -359,7 +410,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
self.assertEqual(1, status)
runner.assert_not_called()
def test_anonymous_ci_bootstrap_excludes_registered_transport_repositories(
def test_ci_bootstrap_reuses_checkout_auth_and_excludes_registered_transport_repositories(
self,
) -> None:
manifest = json.loads(
@@ -372,9 +423,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
}
self.assertTrue(registered_only)
for workflow in sorted(
(META_ROOT / ".gitea" / "workflows").glob("*.yml")
):
for workflow in sorted((META_ROOT / ".gitea" / "workflows").glob("*.yml")):
contents = workflow.read_text(encoding="utf-8")
if (
"bootstrap-repositories.py" not in contents
@@ -382,6 +431,7 @@ class RepositoryBootstrapTests(unittest.TestCase):
):
continue
with self.subTest(workflow=workflow.name):
self.assertIn("--reuse-checkout-auth", contents)
for repository in registered_only:
self.assertIn(
f"--exclude-repo {repository}",