Files
pigway-frame-flow/tests/test_publication_security.py
T

24 lines
729 B
Python

from pathlib import Path
def test_external_forks_do_not_execute_on_nas_runner():
workflow = Path(".github/workflows/verify.yml").read_text()
assert (
"github.event.pull_request.head.repo.full_name == github.repository" in workflow
)
assert "needs: verify" in workflow
def test_private_production_configuration_uses_secrets():
workflow = Path(".github/workflows/verify.yml").read_text()
for key in (
"PROD_DATA_DIR",
"PROD_CONFIG_DIR",
"PROD_PHOTOS_DIR",
"PROD_WEB_BIND",
"SYNOLOGY_PHOTOS_URL",
"SYNOLOGY_PHOTOS_CERT_SHA256",
):
assert "${{ secrets." + key + " }}" in workflow
assert "${{ vars." + key + " }}" not in workflow