mirror of
https://github.com/hanzoai/ci.git
synced 2026-10-27 09:19:34 +00:00
zeekay
117b7ec72f
Hanzo CI/CD / test (linux-amd64) (push) Successful in 3m47s
Hanzo CI/CD / test (linux-arm64) (push) Successful in 8m51s
Hanzo CI/CD / cicd (push) Successful in 1m37s
CI/CD / gate (push) Successful in 12m40s
A static export inlines its ingest key at build just as an image bakes one, but only images[] were read, so a site had no way to take a pk- key from KMS and fell back to committing a literal. Claude-Session: https://claude.ai/code/session_01TUxvfuta1Z44KVNYuAz71F
80 lines
4.2 KiB
Bash
Executable File
80 lines
4.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Tests for bin/publishable. Offline and deterministic: every case is a
|
|
# hanzo.yml written into a temp dir. Run: bash bin/publishable_test.sh
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
PUB="$PWD/bin/publishable"
|
|
tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
|
|
fail=0
|
|
|
|
# t <name> <want-rc> <build_secrets yaml-inline list>
|
|
t() {
|
|
local name=$1 want=$2 list=$3
|
|
local d="$tmp/$RANDOM$RANDOM"; mkdir -p "$d"
|
|
{ echo 'images:'; echo ' - name: app'; echo ' repo: ghcr.io/hanzoai/app'
|
|
[ -n "$list" ] && echo " build_secrets: $list"; } > "$d/hanzo.yml"
|
|
out=$(bash "$PUB" "$d/hanzo.yml" 2>&1); rc=$?
|
|
if [ "$rc" = "$want" ]; then printf 'ok %-56s rc=%s\n' "$name" "$rc"
|
|
else printf 'FAIL %-56s rc=%s (want %s)\n %s\n' "$name" "$rc" "$want" "$out"; fail=1; fi
|
|
}
|
|
|
|
echo "--- refused: a name that never claimed to be public ---"
|
|
# The live case. hanzoai/ui declares exactly this, and its value IS publishable
|
|
# — but nothing outside its own Dockerfile could know that.
|
|
t "EVENT_INGEST_KEY is refused" 1 '[EVENT_INGEST_KEY]'
|
|
t "a real credential is refused" 1 '[STRIPE_SECRET_KEY]'
|
|
t "a token is refused" 1 '[GITHUB_TOKEN]'
|
|
t "a password is refused" 1 '[DB_PASSWORD]'
|
|
t "a private key is refused" 1 '[SIGNING_PRIVATE_KEY]'
|
|
t "one bad name among good ones is refused" 1 '[VITE_GTM_ID, EVENT_INGEST_KEY]'
|
|
|
|
echo "--- allowed: the name declares it ---"
|
|
# These are the fleet's real declarations, verbatim.
|
|
t "PUBLISHABLE_KEY (hanzoai/docs)" 0 '[PUBLISHABLE_KEY]'
|
|
t "VITE_MAPBOX_TOKEN (hanzoai/world)" 0 '[VITE_MAPBOX_TOKEN]'
|
|
t "VITE_SENTRY_DSN (hanzoai/world)" 0 '[VITE_SENTRY_DSN]'
|
|
t "world's four together" 0 '[VITE_MAPBOX_TOKEN, VITE_SENTRY_DSN, VITE_ANALYTICS_WEBSITE_ID, VITE_GTM_ID]'
|
|
t "NEXT_PUBLIC_ prefix" 0 '[NEXT_PUBLIC_INGEST_KEY]'
|
|
t "REACT_APP_ prefix" 0 '[REACT_APP_MAP_KEY]'
|
|
t "EXPO_PUBLIC_ prefix" 0 '[EXPO_PUBLIC_API_KEY]'
|
|
t "NUXT_PUBLIC_ prefix" 0 '[NUXT_PUBLIC_API_KEY]'
|
|
t "PUBLIC_ prefix" 0 '[PUBLIC_ANALYTICS_ID]'
|
|
t "_PUBLISHABLE suffix" 0 '[STRIPE_PUBLISHABLE]'
|
|
t "_PUBLIC suffix" 0 '[ANALYTICS_ID_PUBLIC]'
|
|
|
|
echo "--- a site declares them too ---"
|
|
# A static export has no image, but it inlines at build all the same, so the
|
|
# same names are refused or allowed. webby-ai/intel-hub is the live case.
|
|
ts() {
|
|
local name=$1 want=$2 yml=$3
|
|
local d="$tmp/$RANDOM$RANDOM"; mkdir -p "$d"; printf '%b' "$yml" > "$d/hanzo.yml"
|
|
out=$(bash "$PUB" "$d/hanzo.yml" 2>&1); rc=$?
|
|
if [ "$rc" = "$want" ]; then printf 'ok %-56s rc=%s\n' "$name" "$rc"
|
|
else printf 'FAIL %-56s rc=%s (want %s)\n %s\n' "$name" "$rc" "$want" "$out"; fail=1; fi
|
|
}
|
|
ts "site: VITE_PUBLISHABLE_KEY" 0 'site:\n slug: intel\n build_secrets: [VITE_PUBLISHABLE_KEY]\n'
|
|
ts "site: a bare name is refused" 1 'site:\n slug: intel\n build_secrets: [INGEST_KEY]\n'
|
|
ts "sites: a bare name in any entry" 1 'sites:\n - slug: a\n build_secrets: [VITE_A]\n - slug: b\n build_secrets: [API_TOKEN]\n'
|
|
|
|
echo "--- silent: nothing declared, nothing to say ---"
|
|
# 44 of the fleet's 47 repos are this case and must be byte-for-byte unchanged.
|
|
t "no build_secrets key at all" 0 ''
|
|
t "empty build_secrets list" 0 '[]'
|
|
|
|
echo "--- a missing file is not a refusal ---"
|
|
out=$(bash "$PUB" "$tmp/does-not-exist.yml" 2>&1); rc=$?
|
|
if [ "$rc" = 0 ]; then printf 'ok %-56s rc=0\n' "absent hanzo.yml is silent"
|
|
else printf 'FAIL %-56s rc=%s\n' "absent hanzo.yml is silent" "$rc"; fail=1; fi
|
|
|
|
echo "--- the refusal says what to do about it ---"
|
|
d="$tmp/msg"; mkdir -p "$d"
|
|
printf 'images:\n - name: app\n build_secrets: [EVENT_INGEST_KEY]\n' > "$d/hanzo.yml"
|
|
out=$(bash "$PUB" "$d/hanzo.yml" 2>&1)
|
|
for pat in "EVENT_INGEST_KEY" "docker history" "PUBLISHABLE_" "cannot be a build_secret"; do
|
|
if grep -qF -- "$pat" <<<"$out"; then printf 'ok %-56s\n' "message names '$pat'"
|
|
else printf 'FAIL %-56s\n got: %s\n' "message names '$pat'" "$out"; fail=1; fi
|
|
done
|
|
|
|
[ "$fail" = 0 ] && echo "PASS" || echo "FAIL"
|
|
exit $fail
|