Release v0.1.9: enforce Photos API boundary and finalize Server migration

tests/test_publication_security.py

@@ -6,10 +6,10 @@ def test_external_forks_do_not_execute_on_nas_runner():
     assert (
         "github.event.pull_request.head.repo.full_name == github.repository" in workflow
     )
-    assert "needs: verify" in workflow
+    assert "python scripts/production-deploy.py" not in workflow
 
 
-def test_private_production_configuration_uses_secrets():
+def test_verification_runner_receives_no_production_configuration():
     workflow = Path(".github/workflows/verify.yml").read_text()
     for key in (
         "PROD_DATA_DIR",
@@ -19,7 +19,7 @@ def test_private_production_configuration_uses_secrets():
         "SYNOLOGY_PHOTOS_URL",
         "SYNOLOGY_PHOTOS_CERT_SHA256",
     ):
-        assert "${{ secrets." + key + " }}" in workflow
+        assert "${{ secrets." + key + " }}" not in workflow
         assert "${{ vars." + key + " }}" not in workflow
 
 
@@ -28,7 +28,7 @@ def test_actions_downloads_do_not_depend_on_personal_server():
 
     workflow = Path(".github/workflows/verify.yml").read_text()
     actions = re.findall(r"uses:\s*(\S+)", workflow)
-    assert len(actions) == 4
+    assert len(actions) == 2
     for action in actions:
         assert re.fullmatch(
             r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",