@bongos/core 1.21.150 → 1.21.152

package/tests/module_test_runner.mjs

@@ -18,9 +18,12 @@ import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const runner = require('../scripts/gds/module-test-runner.js');
-const { runnerConfig, maybeDispatch, collectResults, sweepTick, readZipEntry, validateSignal, runName, artifactName } = runner;
+const { runnerConfig, archiveCore, maybeDispatch, collectResults, sweepTick, readZipEntry, validateSignal, runName, artifactName } = runner;
 
-const CFG = { repo: 'owner/module-tests', token: 't0ken', coreRepo: 'owner/core' };
+const CFG = { repo: 'owner/module-tests', token: 't0ken' };
+const SHA = 'a1'.repeat(20);
+const coreRef = () => SHA;
+const archive = async () => Buffer.from('core-tgz');
 const VER = { id: 7, module_key: 'weather', version: '1.0.0', artifact_path: 'weather/weather-1.0.0.tgz' };
 const quiet = { warn() {}, error() {} };
 
@@ -104,36 +107,75 @@ test('unconfigured: no runner, so Tests stays plain pending and nothing is sent'
   assert.equal(db.signals.length, 0);
 });
 
-test('config: owner/name is required, the core repo falls back to git origin', () => {
+test('config: owner/name is required; there is no core repo to name', () => {
   assert.throws(() => runnerConfig({ MODULE_TEST_REPO: 'nope', MODULE_TEST_TOKEN: 'x' }), /owner\/name/);
-  const c = runnerConfig({ MODULE_TEST_REPO: 'o/r', MODULE_TEST_TOKEN: 'x' }, { origin: () => 'o/core' });
-  assert.deepEqual(c, { repo: 'o/r', token: 'x', coreRepo: 'o/core', ref: 'main' });
-  assert.equal(runnerConfig({ MODULE_TEST_REPO: 'o/r', MODULE_TEST_TOKEN: 'x', MODULE_TEST_REF: 'trunk' }, { origin: () => 'o/core' }).ref, 'trunk');
+  assert.deepEqual(runnerConfig({ MODULE_TEST_REPO: 'o/r', MODULE_TEST_TOKEN: 'x', MODULE_TEST_CORE_REPO: 'o/core' }), { repo: 'o/r', token: 'x', ref: 'main' });
+  assert.equal(runnerConfig({ MODULE_TEST_REPO: 'o/r', MODULE_TEST_TOKEN: 'x', MODULE_TEST_REF: 'trunk' }).ref, 'trunk');
 });
 
-test('dispatch pushes the tarball to a throwaway branch, dispatches, and records the nonce', async () => {
+const short = (c) => `${c.method} ${c.url.replace('https://api.github.com/repos/owner/module-tests', '')}`;
+const PUSH = ['POST /git/blobs', 'POST /git/trees', 'POST /git/commits', 'POST /git/refs'];
+const DISPATCH = 'POST /actions/workflows/module-tests.yml/dispatches';
+
+test('the first dispatch on a core commit pushes the core to core/<sha>, then the tarball, then dispatches', async () => {
   const db = fakeDb();
   const gh = fakeGitHub(dispatchRoutes);
-  const r = await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('tgz'), coreRef: () => 'abc123', log: quiet });
+  const r = await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('tgz'), coreRef, archive, log: quiet });
   assert.match(r.nonce, /^[0-9a-f]{32}$/);
   assert.equal(r.branch, `module-test/${r.nonce}`);
-  assert.deepEqual(gh.calls.map((c) => `${c.method} ${c.url.replace('https://api.github.com/repos/owner/module-tests', '')}`), [
-    'POST /git/blobs', 'POST /git/trees', 'POST /git/commits', 'POST /git/refs', 'POST /actions/workflows/module-tests.yml/dispatches']);
-  assert.deepEqual(gh.calls[2].body.parents, [], 'an orphan commit: the branch carries only the tarball');
-  assert.equal(gh.calls[3].body.ref, `refs/heads/module-test/${r.nonce}`);
-  assert.equal(gh.calls[4].body.ref, 'main');
-  assert.deepEqual(gh.calls[4].body.inputs, { version_id: '7', module_key: 'weather', nonce: r.nonce, core_repo: 'owner/core', core_ref: 'abc123' });
+  assert.equal(r.core_ref, SHA);
+  assert.deepEqual(gh.calls.map(short), [`GET /git/ref/heads/core/${SHA}`, ...PUSH, ...PUSH, DISPATCH]);
+  assert.equal(Buffer.from(gh.calls[1].body.content, 'base64').toString(), 'core-tgz');
+  assert.equal(gh.calls[2].body.tree[0].path, 'core.tgz');
+  assert.deepEqual(gh.calls[3].body.parents, [], 'the core snapshot is an orphan commit');
+  assert.equal(gh.calls[4].body.ref, `refs/heads/core/${SHA}`);
+  assert.deepEqual(gh.calls[7].body.parents, [], 'an orphan commit: the branch carries only the tarball');
+  assert.equal(gh.calls[8].body.ref, `refs/heads/module-test/${r.nonce}`);
+  assert.equal(gh.calls[9].body.ref, 'main');
+  assert.deepEqual(gh.calls[9].body.inputs, { version_id: '7', module_key: 'weather', nonce: r.nonce, core_ref: SHA });
   assert.equal(db.signals.length, 1);
   assert.equal(db.signals[0].outcome, 'pending');
   assert.equal(db.signals[0].detail.runner.nonce, r.nonce);
 });
 
+test('a later dispatch on the same core commit reuses core/<sha> and never archives again', async () => {
+  const gh = fakeGitHub({ ...dispatchRoutes, [`GET /git/ref/heads/core/${SHA}$`]: { ref: `refs/heads/core/${SHA}` } });
+  let archived = 0;
+  const r = await maybeDispatch(VER, { db: fakeDb(), cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('tgz'), coreRef, archive: async () => { archived += 1; return Buffer.from('x'); }, log: quiet });
+  assert.ok(r);
+  assert.equal(archived, 0);
+  assert.deepEqual(gh.calls.map(short), [`GET /git/ref/heads/core/${SHA}`, ...PUSH, DISPATCH]);
+  assert.equal(gh.calls[1].body.content, Buffer.from('tgz').toString('base64'), 'only the module tarball is pushed');
+});
+
+test('two dispatches racing on a new commit: the loser\'s refused ref create still dispatches', async () => {
+  const gh = fakeGitHub({ ...dispatchRoutes, 'POST /git/refs$': (url, init) => (JSON.parse(init.body).ref.startsWith('refs/heads/core/') ? new Response('{"message":"Reference already exists"}', { status: 422 }) : { ref: 'x' }) });
+  assert.ok(await maybeDispatch(VER, { db: fakeDb(), cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('tgz'), coreRef, archive, log: quiet }));
+  assert.equal(gh.calls.at(-1).url.endsWith('/dispatches'), true);
+});
+
+test('an oversized core snapshot, or an unknown core commit, fails the dispatch loudly and pushes nothing', async () => {
+  for (const opts of [{ archive: async () => Buffer.alloc(73 * 1024 * 1024) }, { coreRef: () => null, archive }]) {
+    const db = fakeDb();
+    const gh = fakeGitHub(dispatchRoutes);
+    const errors = [];
+    assert.equal(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('tgz'), coreRef, log: { warn() {}, error: (m) => errors.push(m) }, ...opts }), null);
+    assert.match(errors[0], /over the 72 MB|core commit is unknown/);
+    assert.ok(!gh.calls.some((c) => c.method === 'POST'), 'nothing was pushed or dispatched');
+    assert.equal(db.signals.length, 0);
+  }
+});
+
+test('a core commit git cannot find fails with a cause a person can act on, not git\'s bare error', async () => {
+  await assert.rejects(archiveCore('0'.repeat(40)), /must run from a git checkout that holds it/);
+});
+
 test('a version with a real Tests result, or a run already in flight, is not dispatched again', async () => {
   for (const existing of [{ outcome: 'scored', detail: {} }, { outcome: 'pending', detail: { runner: { nonce: 'a'.repeat(32) } } }]) {
     const db = fakeDb();
     db.signals.push({ id: 1, version_id: 7, part: 'tests', ...existing });
     const gh = fakeGitHub(dispatchRoutes);
-    assert.equal(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef: () => 'c', log: quiet }), null);
+    assert.equal(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef, archive, log: quiet }), null);
     assert.equal(gh.calls.length, 0);
   }
 });
@@ -142,13 +184,13 @@ test('a plain pending (from before the runner was set up) is dispatched', async
   const db = fakeDb();
   db.signals.push({ id: 1, version_id: 7, part: 'tests', outcome: 'pending', detail: {} });
   const gh = fakeGitHub(dispatchRoutes);
-  assert.ok(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef: () => 'c', log: quiet }));
+  assert.ok(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef, archive, log: quiet }));
 });
 
 test('a failed dispatch deletes the branch, records nothing and never throws', async () => {
   const db = fakeDb();
   const gh = fakeGitHub({ ...dispatchRoutes, 'POST /dispatches$': () => new Response('{"message":"nope"}', { status: 422 }), 'DELETE /git/refs/heads/module-test/': null });
-  assert.equal(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef: () => 'c', log: quiet }), null);
+  assert.equal(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef, archive, log: quiet }), null);
   assert.equal(gh.calls.at(-1).method, 'DELETE');
   assert.equal(db.signals.length, 0);
 });
@@ -274,7 +316,18 @@ test('the workflow template: no permissions for the job that runs module code, n
   assert.match(yml, /^run-name: module-tests \$\{\{ inputs\.version_id \}\} \$\{\{ inputs\.nonce \}\}$/m);
   assert.equal(runName(7, 'n'), 'module-tests 7 n', 'collect matches the template\'s run-name');
   const testJob = yml.slice(yml.indexOf('\n  test:'));
+  const fetchJob = yml.slice(yml.indexOf('\n  fetch:'), yml.indexOf('\n  test:'));
   assert.match(testJob, /permissions: \{\}/);
+  // The core repo is private (task 1004739): the test job checks out nothing by
+  // name; the fetch job reads the snapshot dispatch pushed to core/<sha> and hands
+  // it over as an artifact.
+  assert.doesNotMatch(testJob, /actions\/checkout/, 'the job that runs module code checks out no repo');
+  assert.doesNotMatch(yml, /repository:|core_repo/, 'no repo is named anywhere');
+  assert.match(fetchJob, /ref: "core\/\$\{\{ inputs\.core_ref \}\}"/);
+  assert.match(fetchJob, /name: "core-\$\{\{ inputs\.nonce \}\}", path: core-snapshot\/core\.tgz/);
+  assert.match(fetchJob, /\^\[0-9a-f\]\{40\}\$/, 'the core ref is checked before it is used');
+  assert.match(testJob, /name: "core-\$\{\{ inputs\.nonce \}\}", path: core-in/);
+  assert.ok(testJob.indexOf('Unpack the core') < testJob.indexOf('npm ci'), 'the core is unpacked before it is installed');
   assert.match(testJob, /MODULE_TEST_SANDBOX=1/);
   // Module code runs as an unprivileged user whose packets the firewall rejects off loopback.
   const cut = testJob.indexOf('Cut the network');