ajaynomics/opencode-compat
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request 'Route Gitea image contract to trusted runner' (#4) from fix/gitea-runner-topology-20260727 into main

Browse Source
This commit is contained in:
ajay@krishnan.ca
2026-07-27 16:59:29 -07:00
parent 82378391c6 c846fb3d66
commit 8a90d1f46f
2 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.github/workflows/candidate.yml vendored
View File

@@ -18,6 +18,8 @@ jobs:
- uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1 - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
with: with:
ruby-version: "3.4" ruby-version: "3.4"
- name: Install standalone test dependency
run: gem install minitest --version 6.0.6 --no-document
- run: | - run: |
ruby test/repository_test.rb ruby test/repository_test.rb
ruby test/runtime_tuple_promoter_test.rb ruby test/runtime_tuple_promoter_test.rb
@@ -267,9 +269,12 @@ jobs:
retention-days: 30 retention-days: 30
exact-image-contract-gitea: exact-image-contract-gitea:
if: github.server_url != 'https://github.com' if: >-
github.server_url != 'https://github.com' &&
(github.event_name == 'workflow_dispatch' ||
(github.event_name == 'push' && github.ref == 'refs/heads/main'))
needs: prepare needs: prepare
runs-on: ubuntu-latest runs-on: heyoka-image-build
name: Gitea full exact image matrix name: Gitea full exact image matrix
steps: steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

21
test/repository_test.rb
View File

@@ -335,6 +335,13 @@ class RepositoryTest < Minitest::Test
end end
end end
def test_repository_job_installs_its_pinned_standalone_test_dependency
workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
repository_job = workflow.split(/^ repository:\n/, 2).fetch(1).split(/^ prepare:\n/, 2).fetch(0)
assert_includes repository_job, "gem install minitest --version 6.0.6 --no-document"
end
def test_candidate_workflow_verifies_and_preserves_the_lockstep_client_tuple def test_candidate_workflow_verifies_and_preserves_the_lockstep_client_tuple
workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml")) workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
@@ -383,6 +390,20 @@ class RepositoryTest < Minitest::Test
refute_includes gitea_job, "actions/upload-artifact@" refute_includes gitea_job, "actions/upload-artifact@"
end end
def test_gitea_exact_image_contract_uses_the_trusted_builder_only_for_main_pushes_or_manual_dispatches
workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
ordinary_jobs = workflow.split(/^ exact-image-contract:\n/, 2).fetch(0)
github_job, gitea_job = workflow.split(/^ exact-image-contract:\n/, 2).fetch(1)
.split(/^ exact-image-contract-gitea:\n/, 2)
assert_equal 4, ordinary_jobs.scan("runs-on: ubuntu-latest").length
assert_includes github_job, "runs-on: ubuntu-latest"
assert_includes gitea_job, "runs-on: heyoka-image-build"
assert_includes gitea_job, "github.server_url != 'https://github.com'"
assert_includes gitea_job, "github.event_name == 'workflow_dispatch'"
assert_includes gitea_job, "github.event_name == 'push' && github.ref == 'refs/heads/main'"
end
def test_gitea_matrix_runner_uses_every_generated_entry_without_hardcoded_coordinates def test_gitea_matrix_runner_uses_every_generated_entry_without_hardcoded_coordinates
runner = File.read(File.join(ROOT, "scripts/run_image_matrix_contract.sh")) runner = File.read(File.join(ROOT, "scripts/run_image_matrix_contract.sh"))