code-be-01
28f4002a70
A repository with no CI configured has no sanctioned wrapper merge path: the queue guard fails closed on zero status contexts for purpose=merge (exit 3). That fail-closed default stays correct, because at merge time no-status may also mean CI has not reported yet; but it left CI-less repos unmergeable without the break-glass override, which makes the override a gap rather than an exception. --no-ci-expected reclassifies only the zero-context case for merge as queue-clear, and only when the acting token holds repository admin. The elevation check reads the repository object's permissions.admin: the branch-head and combined-status responses the guard already fetches carry no permissions object at all. The assertion prints its own audit line (purpose, branch, asserting identity, reason) and writes a NO_CI_ASSERTED JSONL record to the existing audit sink; an unauditable pass is refused (exit 70). A non-admin caller is refused with exit 77 (ASSERTION_REFUSED, own text, audited), kept distinct from ASSERTED_NOT_READY's exit 3; an unavailable permissions lookup holds as CANNOT_ASSERT exit 75. --require-status contradicts the flag and is a usage error; a pending or failed context still holds or fails exactly as before; push behavior is unchanged. pr-merge.sh gains a pass-through --no-ci-expected that only forwards the flag to the guard invocation. PowerShell twins are unchanged: no existing test exercises their guard path (pr-merge.ps1 only runs with -SkipQueueGuard; ci-queue-wait.ps1 has no test). Closes #1372
85 lines
2.6 KiB
Bash
Executable File
85 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# pr-merge must forward --no-ci-expected to the queue guard, and only then.
|
|
# The flag is the sanctioned merge path for a repository with no CI configured
|
|
# (see test-ci-queue-wait-no-ci-expected.sh for the guard-side semantics);
|
|
# this harness pins only the pass-through: present when requested, absent when
|
|
# not, with the rest of the guard invocation unchanged.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-merge-no-ci-expected}"
|
|
FIXTURE_DIR="$WORK_DIR/tools/git"
|
|
CALL_LOG="$WORK_DIR/queue-call.log"
|
|
|
|
rm -rf "$WORK_DIR"
|
|
mkdir -p "$FIXTURE_DIR"
|
|
cp "$SCRIPT_DIR/pr-merge.sh" "$FIXTURE_DIR/pr-merge.sh"
|
|
cp "$SCRIPT_DIR/detect-platform.sh" "$FIXTURE_DIR/detect-platform.sh"
|
|
|
|
cat > "$FIXTURE_DIR/pr-metadata.sh" <<'SH'
|
|
#!/usr/bin/env bash
|
|
printf '%s\n' '{"baseRefName":"main","baseRepository":"mosaicstack/stack","headRefName":"fix/no-ci-fixture","headRefOid":"0123456789abcdef0123456789abcdef01234567","headRepository":"mosaicstack/stack"}'
|
|
SH
|
|
|
|
cat > "$FIXTURE_DIR/ci-queue-wait.sh" <<'SH'
|
|
#!/usr/bin/env bash
|
|
printf '%s\n' "$*" > "${MOSAIC_QUEUE_CALL_LOG:?}"
|
|
exit 42
|
|
SH
|
|
chmod +x "$FIXTURE_DIR"/*.sh
|
|
|
|
run_merge() {
|
|
(
|
|
cd "$WORK_DIR"
|
|
export MOSAIC_QUEUE_CALL_LOG="$CALL_LOG"
|
|
"$FIXTURE_DIR/pr-merge.sh" -n 123 "$@"
|
|
) >/dev/null 2>&1
|
|
}
|
|
|
|
fail=0
|
|
|
|
# With the flag: it must reach the guard invocation.
|
|
: > "$CALL_LOG"
|
|
set +e
|
|
run_merge --no-ci-expected
|
|
rc_with=$?
|
|
set -e
|
|
if [[ "$rc_with" -ne 42 ]]; then
|
|
echo "FAIL(with): expected queue stub rc=42 to propagate, got $rc_with" >&2
|
|
fail=1
|
|
elif ! grep -q -- '--no-ci-expected' "$CALL_LOG"; then
|
|
echo "FAIL(with): --no-ci-expected did not reach the queue guard" >&2
|
|
cat "$CALL_LOG" >&2
|
|
fail=1
|
|
fi
|
|
# The rest of the guard invocation is unchanged by the flag.
|
|
for required in '--purpose merge' '-B fix/no-ci-fixture' '-R mosaicstack/stack' \
|
|
'--sha 0123456789abcdef0123456789abcdef01234567'; do
|
|
if ! grep -qF -- "$required" "$CALL_LOG"; then
|
|
echo "FAIL(with): guard invocation lost '$required'" >&2
|
|
cat "$CALL_LOG" >&2
|
|
fail=1
|
|
fi
|
|
done
|
|
|
|
# Without the flag: it must NOT appear in the guard invocation.
|
|
: > "$CALL_LOG"
|
|
set +e
|
|
run_merge
|
|
rc_without=$?
|
|
set -e
|
|
if [[ "$rc_without" -ne 42 ]]; then
|
|
echo "FAIL(without): expected queue stub rc=42 to propagate, got $rc_without" >&2
|
|
fail=1
|
|
elif grep -q -- '--no-ci-expected' "$CALL_LOG"; then
|
|
echo "FAIL(without): --no-ci-expected reached the guard without being requested" >&2
|
|
cat "$CALL_LOG" >&2
|
|
fail=1
|
|
fi
|
|
|
|
if [[ "$fail" -eq 0 ]]; then
|
|
echo "pr-merge no-ci-expected pass-through regression passed"
|
|
fi
|
|
exit "$fail"
|