mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

test: align release gates with installation config

Browse Source
This commit is contained in:
Codex
2026-08-31 15:59:39 +02:00
parent b4b97436e1
commit e82fe8d322
7 changed files with 28 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/test-compose-secret-policy.sh
+6 -4
View File
@@ -121,6 +121,7 @@ assert_unsafe_source_rejected() {
write_secret "$fixture_root/pi-auth.json" 'fixture-pi-auth'
write_secret "$fixture_root/thothii.secrets" 'THT_MODEL_API_KEY=fixture-model-api-key'
write_secret "$fixture_root/thothii-installation.yaml" 'schema_version: 1'
write_secret "$fixture_root/ssh-private-key" 'fixture-ssh-private-key'
write_secret "$fixture_root/ssh-known-hosts" 'fixture-ssh-known-hosts'
write_secret "$fixture_root/https-credentials" 'fixture-https-credentials'
@@ -133,6 +134,7 @@ printf '%s\n' \
'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git' \
"PI_AUTH_FILE=$fixture_root/pi-auth.json" \
"THT_SECRETS_FILE=$fixture_root/thothii.secrets" \
"THT_INSTALLATION_CONFIG_SOURCE=$fixture_root/thothii-installation.yaml" \
"THT_AUTH_CONFIG_ROOT=$fixture_root/auth" \
"THT_WORKSPACE_BINDINGS_ENV_FILE=$fixture_root/workspace-bindings.env" \
"THT_WORKSPACE_GIT_SSH_KEY_FILE=$fixture_root/ssh-private-key" \
@@ -152,13 +154,13 @@ connector_override="$fixture_root/compose.connector-secrets.local.yaml"
--output "$connector_override"
render base
assert_render_contract base '' 'thothii.secrets'
assert_render_contract base '' '/run/secrets/catalog_runtime_password,thothii.secrets'
render ssh -f "$root/deploy/compose.git-ssh.yaml"
assert_render_contract ssh '/run/secrets/workspace-registry-git-known-hosts,/run/secrets/workspace-registry-git-ssh-key' 'thothii.secrets'
assert_render_contract ssh '/run/secrets/workspace-registry-git-known-hosts,/run/secrets/workspace-registry-git-ssh-key' '/run/secrets/catalog_runtime_password,thothii.secrets'
render https -f "$root/deploy/compose.git-https.yaml"
assert_render_contract https '/run/secrets/workspace-registry-git-ca,/run/secrets/workspace-registry-git-credentials' 'thothii.secrets'
assert_render_contract https '/run/secrets/workspace-registry-git-ca,/run/secrets/workspace-registry-git-credentials' '/run/secrets/catalog_runtime_password,thothii.secrets'
render connector -f "$connector_override"
assert_render_contract connector '' 'north-star-research-dwh-password,thothii.secrets'
assert_render_contract connector '' '/run/secrets/catalog_runtime_password,north-star-research-dwh-password,thothii.secrets'
assert_missing_source_rejected THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_SOURCE
assert_unsafe_source_rejected 'relative/secret' relative-source