mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 20:32:20 +03:00
5ab63203aa
* feat(release): post-publish verifier — clean-container install + boot (WS1.4) verify-published.mjs installs the PUBLISHED version from the public registry inside node:24-slim and boots it until /api/monitoring/health returns 200 with the expected version — validating the exact bytes users install, on a machine with no repo/devbox state. Version + knobs travel as docker env vars, never interpolated into the container script (Hard Rule #13); strict semver arg validation. Wired into the release Phase 4 monitoring playbook. Live evidence: omniroute@3.8.48 from the real registry installed and booted in a clean container — HTTP 200, version 3.8.48, exit 0. Tests: 4 pure-function guards (semver strictness incl. shell-hostile rejects, env-passing invariant, clean-image pin, health-poll source guard). * chore(quality): allowlist verify-published container env vars in env-doc-sync
41 lines
1.9 KiB
TypeScript
41 lines
1.9 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import {
|
|
parseVersionArg,
|
|
buildDockerArgs,
|
|
CONTAINER_SCRIPT,
|
|
} from "../../scripts/release/verify-published.mjs";
|
|
|
|
// WS1.4 (v3.8.49 quality plan) — pure-function guards for the post-publish verifier
|
|
// (clean-container install of the PUBLISHED bytes + boot). The end-to-end path is
|
|
// exercised live against the registry; these pin the safety-relevant logic.
|
|
|
|
test("parseVersionArg accepts strict semver incl. prerelease", () => {
|
|
assert.equal(parseVersionArg("3.8.48"), "3.8.48");
|
|
assert.equal(parseVersionArg("3.9.0-rc.1"), "3.9.0-rc.1");
|
|
});
|
|
|
|
test("parseVersionArg rejects shell-hostile and malformed input", () => {
|
|
for (const bad of ["", "3.8", "latest", "3.8.48; rm -rf /", "$(whoami)", "3.8.48 && x"]) {
|
|
assert.equal(parseVersionArg(bad), null, `should reject: ${bad}`);
|
|
}
|
|
});
|
|
|
|
test("buildDockerArgs passes the version via env, never into the script body", () => {
|
|
const args = buildDockerArgs("3.8.48");
|
|
assert.equal(args[0], "run");
|
|
assert.ok(args.includes("VERIFY_VERSION=3.8.48"), "version must travel as -e env");
|
|
const script = args[args.length - 1];
|
|
assert.equal(script, CONTAINER_SCRIPT);
|
|
assert.ok(!script.includes("3.8.48"), "script body must not embed the version (Hard Rule #13)");
|
|
assert.ok(args.includes("node:24-slim"), "clean base image");
|
|
assert.ok(args.includes("--rm"), "container must not linger");
|
|
});
|
|
|
|
test("container script installs from the registry and polls health with a version match", () => {
|
|
assert.ok(CONTAINER_SCRIPT.includes('npm install -g "omniroute@${VERIFY_VERSION}"'));
|
|
assert.ok(CONTAINER_SCRIPT.includes("/api/monitoring/health"));
|
|
assert.ok(CONTAINER_SCRIPT.includes("body.version === want"), "must assert the served version");
|
|
assert.ok(CONTAINER_SCRIPT.includes("WRONG VERSION"), "must fail loudly on version mismatch");
|
|
});
|