pigway-frame-flow/tests/test_publication_security.py

from pathlib import Path


def test_external_forks_do_not_execute_on_nas_runner():
    workflow = Path(".github/workflows/verify.yml").read_text()
    assert (
        "github.event.pull_request.head.repo.full_name == github.repository" in workflow
    )
    assert "python scripts/production-deploy.py" not in workflow


def test_verification_runner_receives_no_production_configuration():
    workflow = Path(".github/workflows/verify.yml").read_text()
    for key in (
        "PROD_DATA_DIR",
        "PROD_CONFIG_DIR",
        "PROD_PHOTOS_DIR",
        "PROD_WEB_BIND",
        "SYNOLOGY_PHOTOS_URL",
        "SYNOLOGY_PHOTOS_CERT_SHA256",
    ):
        assert "${{ secrets." + key + " }}" not in workflow
        assert "${{ vars." + key + " }}" not in workflow


def test_actions_downloads_do_not_depend_on_personal_server():
    import re

    workflow = Path(".github/workflows/verify.yml").read_text()
    actions = re.findall(r"uses:\s*(\S+)", workflow)
    assert len(actions) == 2
    for action in actions:
        assert re.fullmatch(
            r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",
            action,
        )