mirror of
https://github.com/Matysh/houseplan-card
synced 2026-10-07 15:09:30 +00:00
Claudeandclaude[bot]
b44bb82a3a
night-red.mjs fell back to `https://github.com/<repo>/actions/runs/<id>` when the API did not return html_url, and five publishing steps pushed to `https://x-access-token:$TOKEN@github.com/<repo>`. On github.com nothing breaks today; on any other server (GHES) the links and pushes would point to the wrong host while GITHUB_API_URL is already honoured (#751). - ci-proof.mjs: githubServerUrl(env) - GITHUB_SERVER_URL without a trailing slash, github.com when unset; night-red threads it as `server` into commentBody and nightRed, html_url from the API still wins. - _beta-derived, _process (rebase and review document), _ship-review and release-review: `server="${GITHUB_SERVER_URL:-https://github.com}"` and push_url built from it; every token push uses "$push_url". Tests: the night step executed on a non-standard server writes comment and summary links to that host; every token push in every workflow takes its host from GITHUB_SERVER_URL; the four publishing steps executed with GITHUB_SERVER_URL=https://ghe.example.test push to that host, and to github.com when it is empty. Checked: on the previous workflows and with the hard-coded fallback restored in night-red these tests are red. Issue: #766 User-Visible: no Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018qZfe7YS4rqEMKoVeS3GKd
73 lines
5.3 KiB
JavaScript
73 lines
5.3 KiB
JavaScript
// #697, PROCESS.md §8: отпечаток и кадры скриншотов, эталоны golden —
|
|
// одним коммитом бота на dev перед бетой, а не в каждой ветке задачи.
|
|
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import { readFileSync } from 'node:fs';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { validateCommitMessage } from '../scripts/validate-commit-provenance.mjs';
|
|
import { isCandidateSubject } from '../scripts/bundle-policy.mjs';
|
|
|
|
const readWorkflow = (name) => readFileSync(fileURLToPath(new URL(`../.github/workflows/${name}`, import.meta.url)), 'utf8');
|
|
// #716: кнопка — у тонкого вызывающего, который лежит и в `main`; шаги — в теле из `dev`.
|
|
const CALLER = readWorkflow('beta-derived.yml');
|
|
const WORKFLOW = readWorkflow('_beta-derived.yml');
|
|
const step = (name) => {
|
|
const start = WORKFLOW.indexOf(` - name: ${name}\n`);
|
|
assert.ok(start > 0, `нет шага ${name}`);
|
|
const next = WORKFLOW.indexOf('\n - ', start + 10);
|
|
return next < 0 ? WORKFLOW.slice(start) : WORKFLOW.slice(start, next);
|
|
};
|
|
|
|
test('#697 бот: только по кнопке, прав на запись у job нет — пишет PAT одним push', () => {
|
|
assert.match(CALLER, /^on:\n workflow_dispatch:\n/m);
|
|
assert.match(CALLER, /uses: Matysh\/houseplan-card\/\.github\/workflows\/_beta-derived\.yml@dev\b/);
|
|
assert.match(WORKFLOW, /^on:\n(?: {2}#[^\n]*\n)* {2}workflow_call:\n/m);
|
|
for (const text of [CALLER, WORKFLOW]) {
|
|
assert.doesNotMatch(text, /^\s+(push|schedule|workflow_run):/m);
|
|
assert.match(text, /permissions:\n\s+contents: read\n\s+actions: read\n/);
|
|
assert.doesNotMatch(text, /contents: write/);
|
|
}
|
|
const commit = step('Коммит в dev');
|
|
// #766: хост — сервер раннера (GITHUB_SERVER_URL), не зашитый github.com.
|
|
assert.match(commit, /push_url="\$\{server%%:\/\/\*\}:\/\/x-access-token:\$TOKEN@\$\{server#\*:\/\/\}\/\$\{\{ github\.repository \}\}"/);
|
|
assert.match(commit, /git push -q "\$push_url" HEAD:dev/);
|
|
assert.equal((commit.match(/git push/g) || []).length, 1, 'один push');
|
|
assert.doesNotMatch(commit, /--force/, 'ушедший dev — перезапуск, а не перезапись');
|
|
});
|
|
|
|
test('#697 бот: скриншоты принимаются по канону, изменённый кадр — только объявленный', () => {
|
|
const docs = step('Кадры документации — съёмка и приёмка');
|
|
assert.match(docs, /node demo\/docs\/capture\.mjs --stability=3/);
|
|
assert.match(docs, /git checkout -- docs\/images\n\s+git clean -fdq -- docs\/images/, 'приёмка сравнивает с закоммиченными кадрами');
|
|
assert.match(docs, /args=\(--reviewed "--from=\$cand"\)/);
|
|
assert.match(docs, /--expect-change=\$EXPECT/);
|
|
assert.match(docs, /EXPECT: \$\{\{ inputs\.docs_expect_change \}\}/);
|
|
assert.match(WORKFLOW, /OXIPNG_VERSION: 10\.2\.0/, 'тот же упаковщик, что docs-screenshots.yml');
|
|
const screenshots = readFileSync(fileURLToPath(new URL('../.github/workflows/docs-screenshots.yml', import.meta.url)), 'utf8');
|
|
assert.match(screenshots, /OXIPNG_VERSION: 10\.2\.0/);
|
|
});
|
|
|
|
test('#697 бот: эталоны golden — только из завершённого Validate на dev', () => {
|
|
const golden = step('Эталоны golden из прогона Validate');
|
|
assert.match(golden, /if: inputs\.golden_run != ''/);
|
|
assert.match(golden, /\[ "\$path" != "\.github\/workflows\/validate\.yml" \] \|\| \[ "\$branch" != "dev" \] \|\| \[ "\$status" != "completed" \]/);
|
|
assert.match(golden, /gh run download "\$RUN" --repo "\$\{\{ github\.repository \}\}" -n golden-images/);
|
|
assert.match(golden, /node scripts\/golden-accept\.mjs "\$\{args\[@\]\}"/);
|
|
});
|
|
|
|
test('#697 бот: сообщение коммита проходит провенанс и не выдаёт себя за кандидата', () => {
|
|
const commit = step('Коммит в dev');
|
|
assert.match(commit, /if \[ "\$GOLDEN_CHANGED" = "true" \]; then\n\s+echo "Release: \$TAG"\n\s+echo "Baseline-Reviewed: \$GOLDEN_URL"/,
|
|
'эталоны без Release: и Baseline-Reviewed: провенанс отклонит');
|
|
assert.match(commit, /echo "Issue: #697"\n\s+echo "User-Visible: no"/);
|
|
const subject = 'docs: accept derived artifacts on dev for v1.79.0-beta.1';
|
|
assert.match(commit, /echo "docs: accept derived artifacts on dev for \$TAG"/);
|
|
assert.equal(isCandidateSubject(subject), false, 'бандл кандидата у коммита бота не сверяется');
|
|
const golden = [subject, '', 'Производные артефакты беты.', '',
|
|
'Release: v1.79.0-beta.1', 'Baseline-Reviewed: https://github.com/o/r/actions/runs/1', 'Issue: #697', 'User-Visible: no'].join('\n');
|
|
assert.deepEqual(validateCommitMessage(golden, ['docs/images/screenshots.json', 'demo/golden/baselines/a.png']), []);
|
|
const docsOnly = [subject, '', 'Производные артефакты беты.', '', 'Issue: #697', 'User-Visible: no'].join('\n');
|
|
assert.deepEqual(validateCommitMessage(docsOnly, ['docs/images/screenshots.json']), []);
|
|
assert.notDeepEqual(validateCommitMessage(docsOnly, ['demo/golden/baselines/a.png']), [], 'эталоны без провенанса — отказ');
|
|
});
|