Make CI pip indexes explicit with safe diagnostics and sequential fallback

2026-10-07 20:51:05 +08:00
parent 58823051ee
commit f7e65de0a2
5 changed files with 253 additions and 3 deletions
@@ -0,0 +1,85 @@
+"""Bootstrap must preserve build isolation and fall back without leaking secrets."""
+
+import importlib.util
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+
+@pytest.fixture
+def installer():
+    spec = importlib.util.spec_from_file_location(
+        "ci_install", Path(__file__).parents[1] / "scripts/ci-install.py"
+    )
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_scrub_credentials_and_signed_urls(installer):
+    text = "https://user:fixture-secret@mirror.example/simple?token=fixture-token"
+    assert installer.safe_output(text) == "https://mirror.example/[redacted-url]"
+
+
+def test_install_environment_overrides_inherited_indexes(installer, monkeypatch):
+    for key in (
+        "PIP_NO_INDEX",
+        "PIP_EXTRA_INDEX_URL",
+        "PIP_FIND_LINKS",
+        "PIP_NO_BUILD_ISOLATION",
+    ):
+        monkeypatch.setenv(key, "fixture")
+    monkeypatch.setenv("PIP_CONSTRAINT", "supply-chain-constraints.txt")
+    env = installer.install_env("https://pypi.org/simple")
+    assert env["PIP_CONFIG_FILE"] == installer.os.devnull
+    assert env["PIP_INDEX_URL"] == "https://pypi.org/simple"
+    assert env["PIP_CONSTRAINT"] == "supply-chain-constraints.txt"
+    assert all(
+        key not in env
+        for key in (
+            "PIP_NO_INDEX",
+            "PIP_EXTRA_INDEX_URL",
+            "PIP_FIND_LINKS",
+            "PIP_NO_BUILD_ISOLATION",
+        )
+    )
+
+
+@pytest.mark.parametrize("fallback_succeeds", [True, False])
+def test_sequential_fallback_keeps_editable_and_isolation(
+    installer, monkeypatch, capsys, fallback_succeeds
+):
+    calls = []
+    monkeypatch.setenv(
+        "CI_PIP_INDEX_URL", "https://user:fixture-secret@mirror.example/simple"
+    )
+    monkeypatch.setenv("CI_PIP_FALLBACK_INDEX_URL", "https://pypi.org/simple")
+
+    def run(command, **kwargs):
+        if "config" in command:
+            return SimpleNamespace(
+                returncode=0,
+                stdout="global.index-url='https://user:fixture-secret@mirror.example/simple'\n",
+            )
+        calls.append((command, kwargs["env"]))
+        return SimpleNamespace(
+            returncode=0 if len(calls) == 2 and fallback_succeeds else 1,
+            stdout="Could not fetch https://user:fixture-secret@mirror.example/simple?token=fixture-token\n",
+        )
+
+    monkeypatch.setattr(installer.subprocess, "run", run)
+    if fallback_succeeds:
+        installer.main()
+    else:
+        with pytest.raises(SystemExit):
+            installer.main()
+    assert len(calls) == 2
+    assert calls[1][1]["PIP_INDEX_URL"] == "https://pypi.org/simple"
+    assert all(
+        command[-2:] == ["-e", ".[test]"] and "--no-build-isolation" not in command
+        for command, _ in calls
+    )
+    output = capsys.readouterr().out
+    assert "fixture-secret" not in output and "fixture-token" not in output
+    assert "mirror.example" in output and "pypi.org" in output