clusev/tests/scripts/release-images.test.sh

76 lines
3.4 KiB
Bash

#!/usr/bin/env bash
# Unit test for scripts/release-images.sh — pure resolver, no root/Docker.
set -euo pipefail
here="$(cd "$(dirname "$0")/../.." && pwd)"
# shellcheck source=scripts/release-images.sh disable=SC1091
. "$here/scripts/release-images.sh"
tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
pass=0; fail=0
ok() { if [ "$2" = "$3" ]; then pass=$((pass+1)); else fail=$((fail+1)); printf 'FAIL %s: want=[%s] got=[%s]\n' "$1" "$3" "$2"; fi; }
reset_env() { unset CLUSEV_IMAGE CLUSEV_TERMINAL_IMAGE CLUSEV_PULL CLUSEV_RELEASE_MODE; }
mklock() { printf '{ "version": "v0.11.0", "app": "%s", "terminal": "%s" }\n' "$1" "$2" > "$3"; }
valid_lock="$tmp/valid.lock"; mklock "ghcr.io/o/clusev@sha256:aaa" "ghcr.io/o/clusev-terminal@sha256:bbb" "$valid_lock"
empty_lock="$tmp/empty.lock"; mklock "" "ghcr.io/o/clusev-terminal@sha256:bbb" "$empty_lock"
slash_lock="$tmp/slash.lock"; mklock "hello/world" "ghcr.io/o/clusev-terminal@sha256:bbb" "$slash_lock"
notag_lock="$tmp/notag.lock"; mklock "ghcr.io/o/clusev" "ghcr.io/o/clusev-terminal@sha256:bbb" "$notag_lock"
evil_lock="$tmp/evil.lock"; mklock "evil.io/o/clusev@sha256:aaa" "ghcr.io/o/clusev-terminal@sha256:bbb" "$evil_lock"
# 1) no lock -> build with local default tags, no pull
reset_env
clusev_resolve_release_images "$tmp/nope.lock"
ok "no-lock mode" "${CLUSEV_RELEASE_MODE:-}" "build"
ok "no-lock image" "${CLUSEV_IMAGE:-}" "clusev-app:prod"
ok "no-lock terminal" "${CLUSEV_TERMINAL_IMAGE:-}" "clusev-terminal:prod"
ok "no-lock pull" "${CLUSEV_PULL:-}" "0"
# 2) valid ghcr digest lock -> pull the exact digests
reset_env
clusev_resolve_release_images "$valid_lock"
ok "valid mode" "${CLUSEV_RELEASE_MODE:-}" "pull"
ok "valid image" "${CLUSEV_IMAGE:-}" "ghcr.io/o/clusev@sha256:aaa"
ok "valid terminal" "${CLUSEV_TERMINAL_IMAGE:-}" "ghcr.io/o/clusev-terminal@sha256:bbb"
ok "valid pull" "${CLUSEV_PULL:-}" "1"
# 3) empty app ref -> build fallback
reset_env
clusev_resolve_release_images "$empty_lock"
ok "empty mode" "${CLUSEV_RELEASE_MODE:-}" "build"
ok "empty image" "${CLUSEV_IMAGE:-}" "clusev-app:prod"
ok "empty pull" "${CLUSEV_PULL:-}" "0"
# 4) slash-shaped garbage (has "/", no @sha256) -> build fallback (not a doomed pull)
reset_env
clusev_resolve_release_images "$slash_lock"
ok "slash mode" "${CLUSEV_RELEASE_MODE:-}" "build"
# 5) tag-less ghcr ref (no @sha256:) -> build fallback
reset_env
clusev_resolve_release_images "$notag_lock"
ok "notag mode" "${CLUSEV_RELEASE_MODE:-}" "build"
# 6) non-ghcr host, even digest-pinned -> build fallback (registry allowlist)
reset_env
clusev_resolve_release_images "$evil_lock"
ok "evil mode" "${CLUSEV_RELEASE_MODE:-}" "build"
ok "evil image" "${CLUSEV_IMAGE:-}" "clusev-app:prod"
# 7) env preset wins over lock; terminal defaults when unset
reset_env
export CLUSEV_IMAGE="ghcr.io/preset/clusev@sha256:zzz"
clusev_resolve_release_images "$valid_lock"
ok "env mode" "${CLUSEV_RELEASE_MODE:-}" "env"
ok "env image" "${CLUSEV_IMAGE:-}" "ghcr.io/preset/clusev@sha256:zzz"
ok "env terminal" "${CLUSEV_TERMINAL_IMAGE:-}" "clusev-terminal:prod"
ok "env pull" "${CLUSEV_PULL:-}" "1"
# 8) json_str: known + missing key
reset_env
ok "json known" "$(clusev_json_str "$valid_lock" app)" "ghcr.io/o/clusev@sha256:aaa"
ok "json missing" "$(clusev_json_str "$valid_lock" nope)" ""
printf '\n%d passed, %d failed\n' "$pass" "$fail"
[ "$fail" -eq 0 ]