110 lines
3.9 KiB
Python
110 lines
3.9 KiB
Python
"""Bootstrap must preserve build isolation and fall back without leaking secrets."""
|
|
|
|
import importlib.util
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.fixture
|
|
def installer():
|
|
spec = importlib.util.spec_from_file_location(
|
|
"ci_install", Path(__file__).parents[1] / "scripts/ci-install.py"
|
|
)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def test_scrub_credentials_and_signed_urls(installer):
|
|
text = "https://user:fixture-secret@mirror.example/simple?token=fixture-token"
|
|
assert installer.safe_output(text) == "https://mirror.example/[redacted-url]"
|
|
|
|
|
|
def test_install_environment_overrides_inherited_indexes(installer, monkeypatch):
|
|
for key in (
|
|
"PIP_NO_INDEX",
|
|
"PIP_EXTRA_INDEX_URL",
|
|
"PIP_FIND_LINKS",
|
|
"PIP_NO_BUILD_ISOLATION",
|
|
):
|
|
monkeypatch.setenv(key, "fixture")
|
|
monkeypatch.setenv("PIP_CONSTRAINT", "supply-chain-constraints.txt")
|
|
env = installer.install_env("https://pypi.org/simple")
|
|
assert env["PIP_CONFIG_FILE"] == installer.os.devnull
|
|
assert env["PIP_INDEX_URL"] == "https://pypi.org/simple"
|
|
assert env["PIP_CONSTRAINT"] == "supply-chain-constraints.txt"
|
|
assert all(
|
|
key not in env
|
|
for key in (
|
|
"PIP_NO_INDEX",
|
|
"PIP_EXTRA_INDEX_URL",
|
|
"PIP_FIND_LINKS",
|
|
"PIP_NO_BUILD_ISOLATION",
|
|
)
|
|
)
|
|
|
|
|
|
@pytest.mark.parametrize("fallback_succeeds", [True, False])
|
|
def test_sequential_fallback_keeps_editable_and_isolation(
|
|
installer, monkeypatch, capsys, fallback_succeeds
|
|
):
|
|
calls = []
|
|
monkeypatch.setenv(
|
|
"CI_PIP_INDEX_URL", "https://user:fixture-secret@mirror.example/simple"
|
|
)
|
|
monkeypatch.setenv("CI_PIP_FALLBACK_INDEX_URL", "https://pypi.org/simple")
|
|
|
|
def run(command, **kwargs):
|
|
if "config" in command:
|
|
return SimpleNamespace(
|
|
returncode=0,
|
|
stdout="global.index-url='https://user:fixture-secret@mirror.example/simple'\n",
|
|
)
|
|
calls.append((command, kwargs["env"]))
|
|
return SimpleNamespace(
|
|
returncode=0 if len(calls) == 2 and fallback_succeeds else 1,
|
|
stdout="Could not fetch https://user:fixture-secret@mirror.example/simple?token=fixture-token\n",
|
|
)
|
|
|
|
monkeypatch.setattr(installer.subprocess, "run", run)
|
|
if fallback_succeeds:
|
|
installer.main()
|
|
else:
|
|
with pytest.raises(SystemExit):
|
|
installer.main()
|
|
assert len(calls) == 2
|
|
assert calls[1][1]["PIP_INDEX_URL"] == "https://pypi.org/simple"
|
|
assert all(
|
|
command[-2:] == ["-e", ".[test]"] and "--no-build-isolation" not in command
|
|
for command, _ in calls
|
|
)
|
|
output = capsys.readouterr().out
|
|
assert "fixture-secret" not in output and "fixture-token" not in output
|
|
assert "mirror.example" in output and "pypi.org" in output
|
|
|
|
|
|
def test_docker_locked_install_has_independent_index_and_fallback(
|
|
installer, monkeypatch
|
|
):
|
|
monkeypatch.setattr(installer.sys, "argv", ["install.py", "--locked"])
|
|
monkeypatch.setenv("CI_PIP_INDEX_URL", "https://ci.example/simple")
|
|
monkeypatch.setenv("DOCKER_PIP_INDEX_URL", "https://docker.example/simple")
|
|
monkeypatch.setenv("DOCKER_PIP_FALLBACK_INDEX_URL", "https://pypi.org/simple")
|
|
calls = []
|
|
|
|
def run(command, **kwargs):
|
|
if "config" in command:
|
|
return SimpleNamespace(returncode=0, stdout="")
|
|
calls.append((command, kwargs["env"]))
|
|
return SimpleNamespace(returncode=0 if len(calls) == 2 else 1, stdout="")
|
|
|
|
monkeypatch.setattr(installer.subprocess, "run", run)
|
|
installer.main()
|
|
assert [env["PIP_INDEX_URL"] for _, env in calls] == [
|
|
"https://docker.example/simple",
|
|
"https://pypi.org/simple",
|
|
]
|
|
assert all(command[-2:] == ["-r", "requirements.lock"] for command, _ in calls)
|