mirror of
https://github.com/elder-plinius/OBLITERATUS.git
synced 2026-08-17 16:37:30 +02:00
48 lines
1.6 KiB
Python
48 lines
1.6 KiB
Python
"""Repository contracts for immutable CI execution dependencies."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).parents[1]
|
|
WORKFLOW = ROOT / ".github" / "workflows" / "ci.yml"
|
|
MANIFEST = ROOT / "ci" / "digests.txt"
|
|
ACTION_REF = re.compile(
|
|
r"^\s*uses:\s*([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)@([0-9a-f]{40})\s+#\s+(\S+)\s*$",
|
|
)
|
|
|
|
|
|
def _manifest_entries() -> dict[tuple[str, str], tuple[str, str]]:
|
|
entries: dict[tuple[str, str], tuple[str, str]] = {}
|
|
for line in MANIFEST.read_text(encoding="utf-8").splitlines():
|
|
if not line or line.startswith("#"):
|
|
continue
|
|
kind, name, pin, version, _date, _rationale = line.split(maxsplit=5)
|
|
entries[(kind, name)] = (pin, version)
|
|
return entries
|
|
|
|
|
|
def test_every_external_action_is_sha_pinned_and_manifested():
|
|
entries = _manifest_entries()
|
|
uses_lines = [
|
|
line for line in WORKFLOW.read_text(encoding="utf-8").splitlines()
|
|
if "uses:" in line and "uses: ./" not in line
|
|
]
|
|
|
|
assert uses_lines
|
|
for line in uses_lines:
|
|
match = ACTION_REF.match(line)
|
|
assert match is not None, f"external action is not SHA-pinned with a version comment: {line}"
|
|
name, pin, version = match.groups()
|
|
assert entries[("action", name)] == (pin, version)
|
|
|
|
|
|
def test_actionlint_version_and_checksum_match_manifest():
|
|
workflow = WORKFLOW.read_text(encoding="utf-8")
|
|
pin, version = _manifest_entries()[("tool", "rhysd/actionlint")]
|
|
|
|
assert f'ACTIONLINT_VERSION: "{version.removeprefix("v")}"' in workflow
|
|
assert f'ACTIONLINT_SHA256: "{pin.removeprefix("sha256:")}"' in workflow
|