mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

test: align release gates with installation config

Browse Source
This commit is contained in:
Codex
2026-08-31 15:59:39 +02:00
parent b4b97436e1
commit e82fe8d322
7 changed files with 28 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/e2e/auth.spec.ts
+1 -1
View File
@@ -59,7 +59,7 @@ async function expectShell(page: Page): Promise<void> {
async function signInLocally(page: Page, account: "ordinary" | "admin", remember = false): Promise<void> {
await page.getByLabel("Username").fill(stack.localAccount(account).username);
await page.getByLabel("Password").fill(stack.localAccount(account).password);
await page.getByLabel("Password", { exact: true }).fill(stack.localAccount(account).password);
const rememberControl = page.getByRole("checkbox", { name: /remember me/i });
if (remember) await rememberControl.check();
await page.getByRole("button", { name: "Sign in", exact: true }).click();
frontend/e2e/f1.spec.ts
+1 -1
View File
@@ -29,7 +29,7 @@ test.afterAll(async () => {
async function signInLocally(page: Page): Promise<void> {
const account = stack.localAccount("ordinary");
await page.getByLabel("Username").fill(account.username);
await page.getByLabel("Password").fill(account.password);
await page.getByLabel("Password", { exact: true }).fill(account.password);
await page.getByRole("button", { name: "Sign in", exact: true }).click();
await expect(page.getByTestId("app-shell")).toBeVisible({ timeout: 30_000 });
}
scripts/test-canonical-install-compose.sh
+12 -7
View File
@@ -20,7 +20,8 @@ done
printf '%s\n' '{}' >"$tmp/pi-auth.json"
printf '%s\n' 'THT_MODEL_API_KEY=fixture-model-api-key' >"$tmp/thothii.secrets"
chmod 0600 "$tmp/pi-auth.json" "$tmp/thothii.secrets"
printf '%s\n' 'schema_version: 1' >"$tmp/thothii-installation.yaml"
chmod 0600 "$tmp/pi-auth.json" "$tmp/thothii.secrets" "$tmp/thothii-installation.yaml"
mkdir -p "$tmp/data" "$tmp/pi-state" "$tmp/workspace-registry" "$tmp/auth"
chmod 0700 "$tmp/auth"
"$root/scripts/prepare-server-pi-state.sh" "$tmp/pi-state" "$(id -u)" "$(id -g)" >/dev/null
@@ -37,6 +38,7 @@ for profile in local server; do
'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git' \
"PI_AUTH_FILE=$tmp/pi-auth.json" \
"THT_SECRETS_FILE=$tmp/thothii.secrets" \
"THT_INSTALLATION_CONFIG_SOURCE=$tmp/thothii-installation.yaml" \
"THT_AUTH_CONFIG_ROOT=$tmp/auth"
if [[ "$profile" == server ]]; then
printf '%s\n' \
@@ -108,15 +110,18 @@ if (JSON.stringify(config).includes("fixture-model-api-key")) {
NODE
done
for profile in local server; do
manual="$root/docs/install/$profile-workspace-registry.md"
grep -Fq -- '--env-file "$THT_OPERATOR_ENV"' "$manual" \
&& grep -Fq -- "-f \"\$THT_SOURCE_ROOT/compose.yaml\" -f \"\$THT_SOURCE_ROOT/deploy/compose.$profile.yaml\"" "$manual" || {
echo "$profile manual lacks the canonical base+profile command" >&2
for manual in "$root/README.md" "$root/docs/installazione-docker-4-contesti.md"; do
grep -Fq -- './scripts/run-stack.sh' "$manual" || {
echo "${manual#"$root/"} lacks the canonical local launcher" >&2
exit 1
}
grep -Fq -- 'docker compose --env-file deploy/env/server.env' "$manual" \
&& grep -Fq -- '-f compose.yaml -f deploy/compose.server.yaml' "$manual" || {
echo "${manual#"$root/"} lacks the canonical server base+profile command" >&2
exit 1
}
if rg -q 'local-compose\.workspace-registry|server-compose\.workspace-registry' "$manual"; then
echo "$profile manual still references a superseded standalone Compose example" >&2
echo "${manual#"$root/"} still references a superseded standalone Compose example" >&2
exit 1
fi
done
scripts/test-compose-secret-policy.sh
+6 -4
View File
@@ -121,6 +121,7 @@ assert_unsafe_source_rejected() {
write_secret "$fixture_root/pi-auth.json" 'fixture-pi-auth'
write_secret "$fixture_root/thothii.secrets" 'THT_MODEL_API_KEY=fixture-model-api-key'
write_secret "$fixture_root/thothii-installation.yaml" 'schema_version: 1'
write_secret "$fixture_root/ssh-private-key" 'fixture-ssh-private-key'
write_secret "$fixture_root/ssh-known-hosts" 'fixture-ssh-known-hosts'
write_secret "$fixture_root/https-credentials" 'fixture-https-credentials'
@@ -133,6 +134,7 @@ printf '%s\n' \
'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git' \
"PI_AUTH_FILE=$fixture_root/pi-auth.json" \
"THT_SECRETS_FILE=$fixture_root/thothii.secrets" \
"THT_INSTALLATION_CONFIG_SOURCE=$fixture_root/thothii-installation.yaml" \
"THT_AUTH_CONFIG_ROOT=$fixture_root/auth" \
"THT_WORKSPACE_BINDINGS_ENV_FILE=$fixture_root/workspace-bindings.env" \
"THT_WORKSPACE_GIT_SSH_KEY_FILE=$fixture_root/ssh-private-key" \
@@ -152,13 +154,13 @@ connector_override="$fixture_root/compose.connector-secrets.local.yaml"
--output "$connector_override"
render base
assert_render_contract base '' 'thothii.secrets'
assert_render_contract base '' '/run/secrets/catalog_runtime_password,thothii.secrets'
render ssh -f "$root/deploy/compose.git-ssh.yaml"
assert_render_contract ssh '/run/secrets/workspace-registry-git-known-hosts,/run/secrets/workspace-registry-git-ssh-key' 'thothii.secrets'
assert_render_contract ssh '/run/secrets/workspace-registry-git-known-hosts,/run/secrets/workspace-registry-git-ssh-key' '/run/secrets/catalog_runtime_password,thothii.secrets'
render https -f "$root/deploy/compose.git-https.yaml"
assert_render_contract https '/run/secrets/workspace-registry-git-ca,/run/secrets/workspace-registry-git-credentials' 'thothii.secrets'
assert_render_contract https '/run/secrets/workspace-registry-git-ca,/run/secrets/workspace-registry-git-credentials' '/run/secrets/catalog_runtime_password,thothii.secrets'
render connector -f "$connector_override"
assert_render_contract connector '' 'north-star-research-dwh-password,thothii.secrets'
assert_render_contract connector '' '/run/secrets/catalog_runtime_password,north-star-research-dwh-password,thothii.secrets'
assert_missing_source_rejected THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_SOURCE
assert_unsafe_source_rejected 'relative/secret' relative-source
scripts/test-server-pi-state-topology.sh
+3 -1
View File
@@ -34,17 +34,19 @@ printf '%s\n' preserved-placeholder >"$pi_state/agent/models.json"
printf '{}\n' >"$fixture/pi-auth.json"
printf 'THT_MODEL_API_KEY=fixture-model-key\n' >"$fixture/thothii.secrets"
printf 'schema_version: 1\n' >"$fixture/thothii-installation.yaml"
printf 'fixture-session-password\n' >"$fixture/session-runtime-password"
printf 'fixture-session-migrator-password\n' >"$fixture/session-migrator-password"
printf 'fixture-session-ca\n' >"$fixture/session-ca.pem"
cp "$root/deploy/workspaces/server-sessions.yaml.example" "$fixture/server-sessions.yaml"
chmod 0600 "$fixture"/*.json "$fixture"/*.secrets "$fixture"/*password "$fixture"/*.pem
chmod 0600 "$fixture"/*.json "$fixture"/*.secrets "$fixture"/*.yaml "$fixture"/*password "$fixture"/*.pem
cat >"$fixture/server.env" <<EOF
THOTH_SERVER_BIND=127.0.0.1
THOTH_HTTP_PORT=0
PI_AUTH_FILE=$fixture/pi-auth.json
THT_SECRETS_FILE=$fixture/thothii.secrets
THT_INSTALLATION_CONFIG_SOURCE=$fixture/thothii-installation.yaml
THT_AUTH_CONFIG_ROOT=$auth_config
THT_DATA_ROOT=$fixture/data
THT_PI_STATE_ROOT=$pi_state
scripts/test-unified-compose.sh
+2
View File
@@ -5,6 +5,7 @@ cd "$(dirname "$0")/.."
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
printf 'schema_version: 1\n' >"$tmp/thothii-installation.yaml"
render_profile() {
local profile=$1
@@ -164,6 +165,7 @@ assert_remote_required() {
THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git \
PI_AUTH_FILE=/dev/null \
THT_SECRETS_FILE=/dev/null \
THT_INSTALLATION_CONFIG_SOURCE="$tmp/thothii-installation.yaml" \
THT_AUTH_CONFIG_ROOT=/tmp/thothii-auth \
docker compose -f compose.yaml config --format json >"$tmp/base.json"
node - "$tmp/base.json" <<'NODE'
scripts/unified-deployment-smoke.sh
+3 -1
View File
@@ -396,6 +396,7 @@ task13_write_environment() {
printf 'MAX_PI_PROCESSES=2\n'
printf 'PI_AUTH_FILE=%s\n' "$TASK13_PI_AUTH"
printf 'THT_SECRETS_FILE=%s\n' "$TASK13_SECRETS"
printf 'THT_INSTALLATION_CONFIG_SOURCE=%s\n' "$TASK13_INSTALLATION"
printf 'THT_AUTH_CONFIG_ROOT=%s\n' "$TASK13_AUTH_ROOT"
printf 'THT_WORKSPACE_GIT_REMOTE=%s\n' "$remote"
printf 'THT_WORKSPACE_GIT_BRANCH=%s\n' "$TASK13_BRANCH"
@@ -781,6 +782,7 @@ EOF
printf 'MAX_PI_PROCESSES=2\n'
printf 'PI_AUTH_FILE=%s\n' "$TASK13_PI_AUTH"
printf 'THT_SECRETS_FILE=%s\n' "$TASK13_SECRETS"
printf 'THT_INSTALLATION_CONFIG_SOURCE=%s\n' "$TASK13_INSTALLATION"
printf 'THT_AUTH_CONFIG_ROOT=%s\n' "$TASK13_AUTH_ROOT"
printf 'THT_AUTH_RUNTIME_ROOT=%s\n' "$TASK13_AUTH_RUNTIME_ROOT"
printf 'THT_WORKSPACE_GIT_REMOTE=/fixtures/remote.git\n'
@@ -931,7 +933,7 @@ task13_build_tht() {
task13_assert_rendered_contract() {
local services rendered
services="$(task13_compose config --services | sort)"
[[ "$services" == $'core\nembedding\nembedding-model-init\nfrontend\nqdrant' ]] \
[[ "$services" == $'catalog-db\ncore\nembedding\nembedding-model-init\nfrontend\nqdrant' ]] \
|| task13_fail "rendered stack is not the mandatory internal semantic topology"
rendered="$TASK13_TMP/rendered-compose.yaml"
task13_compose config >"$rendered"