mirror of
https://github.com/soxoj/maigret.git
synced 2026-08-17 19:25:41 +02:00
97 lines
3.6 KiB
Python
97 lines
3.6 KiB
Python
"""Guards for the release-publishing GitHub Actions workflow.
|
|
|
|
Regression tests for #2959. The PyInstaller development build used to publish
|
|
itself with ``makeLatest: true`` under a tag named after the branch it was built
|
|
from, which caused three separate problems:
|
|
|
|
1. the Windows dev build held the repository's "Latest release" marker ahead of
|
|
every stable release, and stole it back on every push to ``main``;
|
|
2. the tag never moved, so it kept naming the first build while the attached
|
|
``.exe`` was replaced on every push;
|
|
3. the tags ``main`` / ``dev`` shadowed the branches of the same name, making a
|
|
bare ``main`` refname ambiguous in every clone.
|
|
|
|
These tests read the workflow as data, so they fail if any of the three
|
|
conditions is reintroduced.
|
|
"""
|
|
|
|
import os
|
|
|
|
import pytest
|
|
|
|
yaml = pytest.importorskip("yaml")
|
|
|
|
WORKFLOW_PATH = os.path.join(
|
|
os.path.dirname(os.path.dirname(os.path.realpath(__file__))),
|
|
".github",
|
|
"workflows",
|
|
"pyinstaller.yml",
|
|
)
|
|
|
|
RELEASE_ACTION = "ncipollo/release-action"
|
|
|
|
|
|
@pytest.fixture(scope="module")
|
|
def workflow():
|
|
with open(WORKFLOW_PATH, encoding="utf-8") as f:
|
|
return yaml.safe_load(f)
|
|
|
|
|
|
@pytest.fixture(scope="module")
|
|
def release_step(workflow):
|
|
steps = workflow["jobs"]["build"]["steps"]
|
|
matching = [s for s in steps if RELEASE_ACTION in s.get("uses", "")]
|
|
assert len(matching) == 1, f"expected exactly one {RELEASE_ACTION} step"
|
|
return matching[0]
|
|
|
|
|
|
def _push_branches(workflow):
|
|
# PyAML resolves the bare `on` key to the boolean True (YAML 1.1 treats it as
|
|
# a truthy literal), so accept either spelling.
|
|
triggers = workflow.get("on", workflow.get(True))
|
|
return triggers["push"]["branches"]
|
|
|
|
|
|
def _resolve(expression, workflow, branch):
|
|
"""Expand the workflow-level env and `github.ref_name` in an expression."""
|
|
for name, value in (workflow.get("env") or {}).items():
|
|
expression = expression.replace("${{ env.%s }}" % name, str(value))
|
|
return expression.replace("${{ github.ref_name }}", branch)
|
|
|
|
|
|
def test_dev_build_is_a_prerelease(release_step):
|
|
# Keeps the build out of /releases/latest and out of the `release: released`
|
|
# event that publishes to PyPI.
|
|
assert str(release_step["with"]["prerelease"]).lower() == "true"
|
|
|
|
|
|
def test_dev_build_never_claims_the_latest_marker(release_step):
|
|
assert str(release_step["with"]["makeLatest"]).lower() == "false"
|
|
|
|
|
|
def test_release_tag_does_not_shadow_a_branch(workflow, release_step):
|
|
tag = release_step["with"]["tag"]
|
|
for branch in _push_branches(workflow):
|
|
resolved = _resolve(tag, workflow, branch)
|
|
assert resolved != branch, (
|
|
f"tag {resolved!r} shadows the {branch!r} branch: a bare "
|
|
f"{branch!r} refname would resolve to the tag in every clone"
|
|
)
|
|
assert resolved, f"tag resolved to an empty string for branch {branch!r}"
|
|
|
|
|
|
def test_release_tag_is_moved_to_the_built_commit(workflow, release_step):
|
|
# release-action only creates a tag when it is missing, and GitHub ignores
|
|
# target_commitish for an existing tag, so an explicit push is what keeps the
|
|
# tag in step with the attached binary.
|
|
tag = release_step["with"]["tag"]
|
|
scripts = [s["run"] for s in workflow["jobs"]["build"]["steps"] if "run" in s]
|
|
moves_tag = any(
|
|
"refs/tags/" in script and "--force" in script for script in scripts
|
|
)
|
|
assert moves_tag, (
|
|
f"no step force-pushes {tag!r}; without it the tag stays pinned to the "
|
|
"first build while the release keeps getting new binaries"
|
|
)
|
|
assert workflow.get("permissions", {}).get("contents") == "write"
|