36 lines
1.5 KiB
JavaScript
36 lines
1.5 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { describe, it } from "vitest";
|
|
import { inspectSentryPin, verifyUpstreamSourcePins } from "./verify-upstream-source-pins.mjs";
|
|
|
|
const commit = "5c9794c9b1fda551f38515f85d56ec298371d060";
|
|
const validInstaller = [
|
|
`UPSTREAM_COMMIT="${commit}"`,
|
|
'git -C "${UPSTREAM_DIR}" fetch --depth 1 origin "${UPSTREAM_COMMIT}"',
|
|
'git -C "${UPSTREAM_DIR}" checkout --quiet --detach "${UPSTREAM_COMMIT}"',
|
|
'ACTUAL_COMMIT="$(git -C "${UPSTREAM_DIR}" rev-parse --verify HEAD)"',
|
|
'if [[ "${ACTUAL_COMMIT}" != "${UPSTREAM_COMMIT}" ]]; then exit 1; fi',
|
|
].join("\n");
|
|
|
|
describe("upstream source pin verification", () => {
|
|
it("accepts the repository Sentry pin contract", () => {
|
|
const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
|
|
const result = verifyUpstreamSourcePins(rootDir);
|
|
assert.deepEqual(result.failures, []);
|
|
});
|
|
|
|
it("rejects mutable tag execution and missing commit verification", () => {
|
|
const result = inspectSentryPin(
|
|
`UPSTREAM_TAG="25.12.1"\ngit clone --branch "\${UPSTREAM_TAG}" https://example.invalid/repo.git`,
|
|
`Tag 25.12.1`,
|
|
);
|
|
assert.match(result.failures.join("\n"), /UPSTREAM_COMMIT must be a full 40-character commit/);
|
|
});
|
|
|
|
it("rejects a pin that is not documented", () => {
|
|
const result = inspectSentryPin(validInstaller, "tag only");
|
|
assert.match(result.failures.join("\n"), /must document/);
|
|
});
|
|
});
|