mirror of
https://github.com/AmanTahiliani/box-box.git
synced 2026-08-07 11:54:59 -04:00
81 lines
3.2 KiB
JavaScript
81 lines
3.2 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import { execFileSync } from 'node:child_process'
|
|
import { mkdtemp, mkdir, writeFile } from 'node:fs/promises'
|
|
import { tmpdir } from 'node:os'
|
|
import { join, resolve } from 'node:path'
|
|
import test from 'node:test'
|
|
|
|
const verifier = resolve('scripts/release-fidelity/verify.mjs')
|
|
|
|
function git(directory, ...args) {
|
|
return execFileSync('git', args, { cwd: directory, encoding: 'utf8' }).trim()
|
|
}
|
|
|
|
function verify(root, evidence) {
|
|
return execFileSync(process.execPath, [verifier, '--version', 'v-test', '--evidence', evidence], {
|
|
cwd: root,
|
|
encoding: 'utf8',
|
|
})
|
|
}
|
|
|
|
async function approvedCandidate({ changeCodeWithSignoff = false, decision = 'approved' } = {}) {
|
|
const root = await mkdtemp(join(tmpdir(), 'boxbox-fidelity-verify-'))
|
|
git(root, 'init')
|
|
git(root, 'config', 'user.email', 'test@example.com')
|
|
git(root, 'config', 'user.name', 'Test')
|
|
await writeFile(join(root, 'candidate.txt'), 'candidate')
|
|
git(root, 'add', 'candidate.txt')
|
|
git(root, 'commit', '-m', 'candidate')
|
|
const candidate = git(root, 'rev-parse', 'HEAD')
|
|
|
|
await mkdir(join(root, 'docs/release/owner-reviews'), { recursive: true })
|
|
await writeFile(join(root, 'docs/release/owner-reviews/v-test.md'), `- Version: v-test\n- Candidate commit: ${candidate}\n- Reviewed by: Owner\n- Reviewed on: 2026-07-30\n- Decision: ${decision}\n`)
|
|
if (changeCodeWithSignoff) await writeFile(join(root, 'candidate.txt'), 'changed with approval')
|
|
git(root, 'add', 'docs/release/owner-reviews/v-test.md')
|
|
if (changeCodeWithSignoff) git(root, 'add', 'candidate.txt')
|
|
git(root, 'commit', '-m', 'owner sign-off')
|
|
|
|
const evidence = join(root, 'evidence')
|
|
await mkdir(evidence)
|
|
await writeFile(join(evidence, 'index.html'), '')
|
|
await writeFile(join(evidence, 'summary.md'), '')
|
|
return { candidate, evidence, root }
|
|
}
|
|
|
|
function assertBlocked(root, evidence) {
|
|
assert.throws(() => verify(root, evidence), (error) => {
|
|
assert.match(String(error.stderr), /HEAD must contain only the sign-off file change/)
|
|
return true
|
|
})
|
|
}
|
|
|
|
test('accepts a sign-off-only HEAD for its direct parent candidate', async () => {
|
|
const { candidate, evidence, root } = await approvedCandidate()
|
|
const output = verify(root, evidence)
|
|
assert.match(output, new RegExp(candidate))
|
|
})
|
|
|
|
test('rejects code committed after approval', async () => {
|
|
const { evidence, root } = await approvedCandidate()
|
|
await writeFile(join(root, 'candidate.txt'), 'changed after review')
|
|
git(root, 'add', 'candidate.txt')
|
|
git(root, 'commit', '-m', 'code after approval')
|
|
|
|
assertBlocked(root, evidence)
|
|
})
|
|
|
|
test('rejects a sign-off commit that also changes code', async () => {
|
|
const { evidence, root } = await approvedCandidate({ changeCodeWithSignoff: true })
|
|
assertBlocked(root, evidence)
|
|
})
|
|
|
|
test('rejects a dirty working-tree edit that spoofs approval', async () => {
|
|
const { candidate, evidence, root } = await approvedCandidate({ decision: 'rejected' })
|
|
await writeFile(join(root, 'docs/release/owner-reviews/v-test.md'), `- Version: v-test\n- Candidate commit: ${candidate}\n- Reviewed by: Owner\n- Reviewed on: 2026-07-30\n- Decision: approved\n`)
|
|
|
|
assert.throws(() => verify(root, evidence), (error) => {
|
|
assert.match(String(error.stderr), /Decision: approved/)
|
|
return true
|
|
})
|
|
})
|