mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(ci): verify projected server auth layout

Browse Source
This commit is contained in:
marcopan
2026-08-26 02:11:36 +02:00
parent 20341a7124
commit a3259ced99
1 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/unified-deployment-smoke.sh
+22 -1
View File
@@ -1592,7 +1592,18 @@ task13_assert_server_runtime() {
|| task13_fail "server frontend did not use the smoke-built frontend image"
task13_compose_logged "verify server runtime configuration and secret readability" exec -T core sh -ceu '
check_readable() { test -r "$1" || { printf "server precondition failed: unreadable %s\n" "$1" >&2; exit 1; }; }
check_readable /run/thothii-auth/auth.yaml
check_readable /run/thothii-auth/CURRENT
projection_generation="$(node -e '\''
const fs = require("node:fs");
const selector = JSON.parse(fs.readFileSync("/run/thothii-auth/CURRENT", "utf8"));
if (selector.version !== 1 || selector.state !== "ready" ||
typeof selector.generation !== "string" || !/^[0-9a-f]{64}$/.test(selector.generation)) {
process.exit(1);
}
process.stdout.write(selector.generation);
'\'')" || { printf "server precondition failed: invalid authentication projection selector\n" >&2; exit 1; }
check_readable "/run/thothii-auth/generations/$projection_generation/auth.yaml"
check_readable "/run/thothii-auth/generations/$projection_generation/manifest.json"
test -d /data/auth || { printf "server precondition failed: missing /data/auth\n" >&2; exit 1; }
test -z "${AUTH_MODE+x}" || { printf "server precondition failed: AUTH_MODE must be unset\n" >&2; exit 1; }
test "$THT_SESSION_STORAGE" = postgres || { printf "server precondition failed: session storage\n" >&2; exit 1; }
@@ -2557,6 +2568,7 @@ task13_self_test_source_contract() {
local server_auth_projection_override server_auth_projection_descriptor
local server_auth_projection_environment server_auth_privileged_configure
local server_fixture_reclamation server_runtime_config_probe server_workspace_config_permission
local server_runtime_selector_probe server_runtime_generation_probe server_runtime_direct_file_probe
local server_secret_source_owner server_secret_source_preparation server_tht_wrapper
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
workflow="$root/.github/workflows/deployment.yml"
@@ -2589,6 +2601,9 @@ task13_self_test_source_contract() {
server_auth_privileged_configure='sudo -n -- "$TASK13_''THT"'
server_fixture_reclamation='task13_reclaim_server_fixture_''ownership'
server_runtime_config_probe='task13_compose_''logged "verify server runtime configuration and secret readability"'
server_runtime_selector_probe='check_readable /run/thothii-auth/''CURRENT'
server_runtime_generation_probe='check_readable "/run/thothii-auth/generations/$projection_generation/''auth.yaml"'
server_runtime_direct_file_probe='check_readable /run/thothii-auth/''auth.yaml'
server_secret_source_preparation='task13_prepare_server_secret_''sources'
server_secret_source_owner='chown 10001:''10001 -- "$TASK13_SECRETS" "$TASK13_PI_AUTH"'
server_tht_wrapper='task13_server_''tht'
@@ -2670,6 +2685,12 @@ task13_self_test_source_contract() {
|| task13_fail "the server smoke must reclaim its root- and core-owned fixture exactly once"
grep -Fq -- "$server_runtime_config_probe" "$root/scripts/unified-deployment-smoke.sh" \
|| task13_fail "the server runtime preconditions must emit a named diagnostic"
grep -Fq -- "$server_runtime_selector_probe" "$root/scripts/unified-deployment-smoke.sh" \
|| task13_fail "the server runtime preconditions must verify the projection selector"
grep -Fq -- "$server_runtime_generation_probe" "$root/scripts/unified-deployment-smoke.sh" \
|| task13_fail "the server runtime preconditions must verify the selected generation"
! grep -Fq -- "$server_runtime_direct_file_probe" "$root/scripts/unified-deployment-smoke.sh" \
|| task13_fail "the server runtime preconditions must not require the forbidden direct-file fallback"
grep -Fq -- "$server_workspace_config_permission" "$root/scripts/unified-deployment-smoke.sh" \
|| task13_fail "the server workspace fixture must be readable by the container UID"
[[ "$(grep -Ec "^${server_secret_source_preparation}\\(\\)|^[[:space:]]+${server_secret_source_preparation}$" \