75 lines
3.0 KiB
Bash
Executable File
75 lines
3.0 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
auth_file="$tmp/auth.json"
|
|
printf '%s\n' '{}' >"$auth_file"
|
|
chmod 0600 "$auth_file"
|
|
auth_config="$tmp/auth"
|
|
mkdir "$auth_config"
|
|
chmod 0700 "$auth_config"
|
|
printf '%s\n' 'mode: local' >"$auth_config/auth.yaml"
|
|
chmod 0600 "$auth_config/auth.yaml"
|
|
secrets_file="$tmp/thothii.secrets"
|
|
printf '%s\n' 'THT_MODEL_API_KEY=fixture-model-api-key' >"$secrets_file"
|
|
chmod 0600 "$secrets_file"
|
|
|
|
rendered=$(THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git \
|
|
PI_AUTH_FILE="$auth_file" THT_SECRETS_FILE="$secrets_file" \
|
|
THT_AUTH_CONFIG_ROOT="$auth_config" docker compose config)
|
|
printf '%s\n' "$rendered" | grep -q "source: $auth_file"
|
|
printf '%s\n' "$rendered" | grep -q 'target: /home/thoth/.pi/agent/auth.json'
|
|
printf '%s\n' "$rendered" | grep -A4 'target: /home/thoth/.pi/agent/auth.json' \
|
|
| grep -q 'read_only: true'
|
|
for target in \
|
|
/home/thoth/.pi/agent/models.json \
|
|
/home/thoth/.pi/agent/settings.json; do
|
|
printf '%s\n' "$rendered" | grep -q "target: $target"
|
|
printf '%s\n' "$rendered" | grep -A4 "target: $target" | grep -q 'read_only: true'
|
|
done
|
|
printf '%s\n' "$rendered" | grep -q "file: $secrets_file"
|
|
printf '%s\n' "$rendered" | grep -q 'target: thothii.secrets'
|
|
if grep -Fq 'fixture-model-api-key' <<<"$rendered"; then
|
|
echo "rendered base Compose leaked the model key" >&2
|
|
exit 1
|
|
fi
|
|
|
|
dev_rendered=$(THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git \
|
|
PI_AUTH_FILE="$auth_file" THT_SECRETS_FILE="$secrets_file" \
|
|
THT_AUTH_CONFIG_ROOT="$auth_config" \
|
|
docker compose --env-file deploy/env/local.env.example -f docker-compose.dev.yml config)
|
|
printf '%s\n' "$dev_rendered" | grep -q "source: $auth_file"
|
|
printf '%s\n' "$dev_rendered" | grep -q 'target: /home/thoth/.pi/agent/auth.json'
|
|
printf '%s\n' "$dev_rendered" | grep -q 'target: /home/thoth/.pi/agent/models.json'
|
|
printf '%s\n' "$dev_rendered" | grep -q 'target: /home/thoth/.pi/agent/settings.json'
|
|
printf '%s\n' "$dev_rendered" | grep -q "file: $secrets_file"
|
|
printf '%s\n' "$dev_rendered" | grep -q 'target: thothii.secrets'
|
|
if grep -Fq 'fixture-model-api-key' <<<"$dev_rendered"; then
|
|
echo "rendered development Compose leaked the model key" >&2
|
|
exit 1
|
|
fi
|
|
|
|
python3 - <<'PY'
|
|
import json
|
|
from pathlib import Path
|
|
|
|
settings = json.loads(Path("deploy/pi/settings.json").read_text())
|
|
assert settings["enabledModels"] == [
|
|
"zai/glm-5.2",
|
|
"deepseek/deepseek-v4-flash",
|
|
"deepseek/deepseek-v4-pro",
|
|
"aritmolab/qwen3.6-35b-a3b",
|
|
]
|
|
PY
|
|
|
|
grep -q '^ARG PI_VERSION=0.80.3$' docker/core.Dockerfile
|
|
grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/local.env.example
|
|
grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/server.env.example
|
|
grep -q '^THT_SECRETS_FILE=/absolute/path/to/thothii.secrets$' deploy/env/local.env.example
|
|
grep -q '^THT_SECRETS_FILE=/absolute/path/to/thothii.secrets$' deploy/env/server.env.example
|
|
|
|
echo "Pi user-auth Compose contract passed."
|