fargo
d789a43cae
ci/woodpecker/pr/ci Pipeline was canceled
test-issue-create-body-safety.sh and test-issue-create-interactive-auth.sh inherited the seat's real HOME and global git config. With the #1280 fix activating identity mode BEFORE the tea path, a workstation-global mosaic.gitIdentity resolved inside the fixture repo, and the wrapper's API fallback posted to the LIVE forge with a real per-slot token — six real issues (#1282-#1287, authored mos-dt-0, closed with provenance by fred within the hour). Neutralize the source the resolver actually reads, and prove it by making the resolution fail. A control that does not make the thing fail has not been shown to control it. The earlier attempted neutralization pinned MOSAIC_CREDENTIALS_FILE to a fake — a real guard aimed at an adjacent input: the identity arm reads the per-slot token file directly and never consults credentials.json. Hence env -i with a fake HOME and GIT_CONFIG_GLOBAL=/dev/null (severing the global identity) rather than one more targeted variable, plus a curl tripwire stub in the body-safety harness so ANY provider request is a loud test failure instead of a live write.
106 lines
4.0 KiB
Bash
Executable File
106 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Regression harness for #703: interactive issue creation and stale Tea-user fallback.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/issue-create-interactive-auth}"
|
|
REPO_DIR="$WORK_DIR/repo"
|
|
BIN_DIR="$WORK_DIR/bin"
|
|
LOG_FILE="$WORK_DIR/calls.log"
|
|
CREDENTIALS_FILE="$WORK_DIR/credentials.json"
|
|
|
|
rm -rf "$WORK_DIR"
|
|
mkdir -p "$REPO_DIR" "$BIN_DIR"
|
|
git -C "$REPO_DIR" init -q
|
|
git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
|
|
|
|
cat > "$CREDENTIALS_FILE" <<'JSON'
|
|
{"gitea":{"mosaicstack":{"url":"https://git.mosaicstack.dev","token":"test-token"}}}
|
|
JSON
|
|
|
|
cat > "$BIN_DIR/tea" <<'SH'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
if [[ "$*" == "login list --output json" ]]; then
|
|
printf '%s\n' '[{"name":"mosaicstack","url":"https://git.mosaicstack.dev"}]'
|
|
exit 0
|
|
fi
|
|
if [[ "${1:-}" == "api" ]]; then
|
|
if [[ "${MOSAIC_TEA_STALE_USER:-0}" == "1" ]]; then
|
|
echo 'GetUserByName: stale configured user' >&2
|
|
exit 1
|
|
fi
|
|
printf '%s\n' '{"login":"current-user"}'
|
|
exit 0
|
|
fi
|
|
printf 'tea %s\n' "$*" >> "$MOSAIC_TEST_LOG"
|
|
exit 0
|
|
SH
|
|
|
|
cat > "$BIN_DIR/curl" <<'SH'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
printf 'curl %s\n' "$*" >> "$MOSAIC_TEST_LOG"
|
|
printf '%s\n' '{"number":703}'
|
|
SH
|
|
chmod +x "$BIN_DIR/tea" "$BIN_DIR/curl"
|
|
|
|
run_wrapper() {
|
|
# Hermetic: fake HOME (fixture credentials only, no token slots, no tea
|
|
# config) and GIT_CONFIG_GLOBAL severed — `git config --get
|
|
# mosaic.gitIdentity` otherwise resolves the WORKSTATION's global identity
|
|
# and reroutes the wrapper into identity mode before the tea paths this
|
|
# harness exercises (#1280 family; see test-issue-create-body-safety.sh).
|
|
# An `env …` prefix (used for MOSAIC_TEA_STALE_USER) is re-wrapped, not
|
|
# doubled: arguments beginning with "env" are shifted past.
|
|
local env_pairs=()
|
|
if [[ "${1:-}" == "env" ]]; then
|
|
shift
|
|
while [[ "$#" -gt 0 && "$1" == *=* ]]; do
|
|
env_pairs+=("$1")
|
|
shift
|
|
done
|
|
fi
|
|
(
|
|
cd "$REPO_DIR"
|
|
env -i HOME="$WORK_DIR/home" PATH="$BIN_DIR:$PATH" \
|
|
GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null \
|
|
MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
|
|
MOSAIC_TEST_LOG="$LOG_FILE" "${env_pairs[@]}" \
|
|
"$@"
|
|
)
|
|
}
|
|
mkdir -p "$WORK_DIR/home"
|
|
|
|
: > "$LOG_FILE"
|
|
printf 'Interactive title\nInteractive body\nlabel-a,label-b\nM1\n' | run_wrapper "$SCRIPT_DIR/issue-create.sh" -i >/dev/null
|
|
|
|
grep -q -- 'tea issue create --repo mosaicstack/stack --login mosaicstack --title Interactive title --description Interactive body --labels label-a,label-b --milestone M1' "$LOG_FILE"
|
|
|
|
# Explicit values take precedence in interactive mode: no title input is
|
|
# supplied, but the wrapper still creates the issue with the explicit title.
|
|
: > "$LOG_FILE"
|
|
printf '\n\n\n' | run_wrapper "$SCRIPT_DIR/issue-create.sh" -i -t 'Explicit title' >/dev/null
|
|
grep -q -- 'tea issue create --repo mosaicstack/stack --login mosaicstack --title Explicit title' "$LOG_FILE"
|
|
|
|
: > "$LOG_FILE"
|
|
run_wrapper env MOSAIC_TEA_STALE_USER=1 "$SCRIPT_DIR/issue-create.sh" -t 'Fallback title' -b 'Fallback body' >/dev/null 2>"$WORK_DIR/issue-stderr"
|
|
grep -q -- 'curl .*https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/issues' "$LOG_FILE"
|
|
grep -q -- 'Tea authenticated-user validation failed' "$WORK_DIR/issue-stderr"
|
|
if grep -q -- 'tea issue create' "$LOG_FILE"; then
|
|
echo 'FAIL: issue-create invoked Tea mutation after stale-user validation failed' >&2
|
|
exit 1
|
|
fi
|
|
|
|
: > "$LOG_FILE"
|
|
run_wrapper env MOSAIC_TEA_STALE_USER=1 "$SCRIPT_DIR/pr-create.sh" -t 'PR fallback' -H feature/wrapfix >/dev/null 2>"$WORK_DIR/pr-stderr"
|
|
grep -q -- 'curl .*https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/pulls' "$LOG_FILE"
|
|
grep -q -- 'Tea authenticated-user validation failed' "$WORK_DIR/pr-stderr"
|
|
if grep -q -- 'tea pr create' "$LOG_FILE"; then
|
|
echo 'FAIL: pr-create invoked Tea mutation after stale-user validation failed' >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo 'issue-create interactive/auth regression harness passed'
|