40 lines
2.5 KiB
Bash
40 lines
2.5 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
set -o pipefail
|
|
# Shell syntax and static analysis cover the actual container shell scripts.
|
|
shellcheck -s ash -x -S warning dev/dispatch.sh dev/test.sh
|
|
shellcheck -x -S warning dev/tools.sh dev/start-*.sh
|
|
. dev/common.sh
|
|
. dev/images.sh
|
|
. dev/bootstrap.sh
|
|
# Offline fixtures exercise stable selection, reject prereleases, and preserve pins.
|
|
get() {
|
|
case "$1" in
|
|
*/tags/latest) printf '{"digest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}';;
|
|
*page_size*) cat <<'JSON'
|
|
{"results":[{"name":"2.1.0","digest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},{"name":"2.2.0-rc1","digest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}
|
|
JSON
|
|
;;
|
|
*) return 1;;
|
|
esac
|
|
}
|
|
[ "$(image hashicorp/vault latest)" = 'hashicorp/vault:2.1.0@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' ] || fail 'Stable release selection failed'
|
|
get() { printf '{"digest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","results":[{"name":"3.0.0-rc1","digest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}'; }
|
|
if image hashicorp/vault latest >/dev/null 2>&1; then fail 'Prerelease accepted'; fi
|
|
# Isolate state from the developer stack during failure tests.
|
|
STATE="$WORK/state"; mkdir "$STATE"; printf 'previous build' > "$STATE/images.env"
|
|
get() { return 1; }
|
|
if images >/dev/null 2>&1; then fail 'Offline resolution succeeded'; fi
|
|
[ "$(cat "$STATE/images.env")" = 'previous build' ] || fail 'Failed resolution replaced pins'
|
|
if printf '{"api_key":"","sender_address":"notifications@localhost.test"}' | email_valid; then fail 'Empty email accepted'; fi
|
|
printf '{"api_key":"fixture-only","sender_address":"sender@example.test"}' | email_valid
|
|
# Initialized Vault without matching local keys must fail without initializing it again.
|
|
vault() { printf '{"initialized":true}'; }
|
|
if (initialize) > "$WORK/initialize-error" 2>&1; then fail 'Missing local keys accepted'; fi
|
|
grep -q 'Missing .local' "$WORK/initialize-error"
|
|
for service in bff notifications; do
|
|
if grep -Eq 'database/creds/|SXCHNGE_MONGO_URI' "dev/vault/$service.hcl"; then fail 'Database credentials trigger Agent restart'; fi
|
|
done
|
|
echo 'PASS: shell analysis, stable selection, failed-resolution preservation, email validation, missing-key protection and Agent contract'
|
|
if command -v python >/dev/null 2>&1 || command -v python3 >/dev/null 2>&1; then fail 'Tool image unexpectedly contains Python'; fi
|