mirror of
https://github.com/MadsLorentzen/ai-job-search.git
synced 2026-11-02 13:12:50 +00:00
33 lines
1.2 KiB
Python
33 lines
1.2 KiB
Python
|
"""The weekly release workflow can't run offline, so pin its safety properties.
|
||
|
|
|
||
|
|
The version itself comes from commitizen (`cz bump --get-next`, .cz.toml).
|
||
|
|
"""
|
||
|
|
import unittest
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
REPO = Path(__file__).resolve().parent.parent
|
||
|
|
WORKFLOW = REPO / ".github" / "workflows" / "release.yml"
|
||
|
|
|
||
|
|
|
||
|
|
class ReleaseWorkflowTests(unittest.TestCase):
|
||
|
|
def setUp(self):
|
||
|
|
self.text = WORKFLOW.read_text(encoding="utf-8")
|
||
|
|
|
||
|
|
def test_release_runs_only_on_upstream(self):
|
||
|
|
self.assertIn("if: github.repository == 'ai-job-search-dev/ai-job-search'", self.text)
|
||
|
|
|
||
|
|
def test_write_access_is_granted_to_the_job_not_the_workflow(self):
|
||
|
|
top_level = self.text.split("\njobs:", 1)[0]
|
||
|
|
self.assertIn("permissions:\n contents: read", top_level)
|
||
|
|
self.assertIn("contents: write", self.text.split("\njobs:", 1)[1])
|
||
|
|
|
||
|
|
def test_actions_are_sha_pinned(self):
|
||
|
|
for line in self.text.splitlines():
|
||
|
|
stripped = line.strip()
|
||
|
|
if stripped.startswith(("- uses:", "uses:")):
|
||
|
|
ref = stripped.split("uses:", 1)[1].strip()
|
||
|
|
self.assertRegex(ref.split("@", 1)[1].split()[0], r"^[0-9a-f]{40}$", f"action not SHA-pinned: {ref}")
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
unittest.main()
|