mathias
3112b4ce92
The repo had a `task check` structure gate and a 28-case shell test suite that nothing ever ran. The only workflow auto-tagged every push to main, so CI reported green having tested nothing — a gate that fails open, and the reason `mathias/skills` shows up as repository-blocked in the estate backlog classification. release.yml becomes ci.yml with two jobs: `gate` runs check + test on every push and PR; `tag` keeps the existing semver-from-trailer logic but declares `needs: gate`, so a red check cannot ship a tag. The pull_request trigger also gives `tbd_ship` a CI run to read on a branch head — without one it fails closed and never merges (#22). The tagger now pushes the manifest bump commit and the tag in a single `git push`. Two pushes left a window where the gate ran `task check` on the bump commit before the tag existed, and the manifest/tag parity assertion would fail on a commit that was in fact correct. tests/ci_gate_test.sh pins the wiring: PR trigger present, both tasks run, tag needs gate, no second ungated workflow file. Refs: #22 Bump-Type: minor
58 lines
1.8 KiB
Bash
58 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# Tests for the CI gate workflow.
|
|
#
|
|
# The regression these exist for: this repo had a release workflow that
|
|
# auto-tagged every push to main, and a `task check` / `task test` suite that
|
|
# nothing ever ran. CI reported green having tested nothing — a gate that
|
|
# fails *open*. These assertions pin the wiring so it cannot silently regress.
|
|
|
|
set -u
|
|
|
|
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
|
SUT="$ROOT/.gitea/workflows/ci.yml"
|
|
|
|
pass=0
|
|
fail=0
|
|
|
|
ok() { pass=$((pass + 1)); printf ' ok %s\n' "$1"; }
|
|
no() { fail=$((fail + 1)); printf ' FAIL %s\n' "$1"; }
|
|
|
|
if [ ! -f "$SUT" ]; then
|
|
printf 'FAIL: %s does not exist\n' "$SUT"
|
|
exit 1
|
|
fi
|
|
ok 'ci.yml exists'
|
|
|
|
# A pull_request trigger is what gives tbd_ship a CI run to read on the head
|
|
# commit of a branch; without one it fails closed and never merges (#22).
|
|
grep -qE '^ pull_request:' "$SUT" \
|
|
&& ok 'runs on pull_request' \
|
|
|| no 'runs on pull_request'
|
|
|
|
grep -qE '^ +push:' "$SUT" \
|
|
&& ok 'runs on push' \
|
|
|| no 'runs on push'
|
|
|
|
grep -qE '^ +- *(run: *)?task check$|task check' "$SUT" \
|
|
&& ok 'gate runs task check' \
|
|
|| no 'gate runs task check'
|
|
|
|
grep -qE 'task test' "$SUT" \
|
|
&& ok 'gate runs task test' \
|
|
|| no 'gate runs task test'
|
|
|
|
# The point of the gate: tagging must not happen on a red check.
|
|
tag_job=$(awk '/^ tag:/{f=1} f&&/^ [a-z][a-z_-]*:/&&!/^ tag:/{f=0} f' "$SUT")
|
|
printf '%s' "$tag_job" | grep -qE '^ +needs: *gate' \
|
|
&& ok 'tag job needs the gate' \
|
|
|| no 'tag job needs the gate'
|
|
|
|
# The old workflow file must be gone, or two workflows race on the same push
|
|
# and the ungated one still tags.
|
|
[ ! -f "$ROOT/.gitea/workflows/release.yml" ] \
|
|
&& ok 'ungated release.yml removed' \
|
|
|| no 'ungated release.yml removed'
|
|
|
|
printf '\nci_gate: %d passed, %d failed\n' "$pass" "$fail"
|
|
[ "$fail" -eq 0 ]
|