@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/deploy-direct.test.js

@@ -0,0 +1,241 @@
+// Build-layer test for `omega deploy --direct`'s platform guard
+// ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)).
+//
+// The local lane is now a FLAG, not a detection: a brand tree carrying a
+// `file:` @omega.js spec used to switch itself here, which took the CI lane
+// away from exactly the brands that need it most (a linked brand now packs its
+// frameworks into the snapshot the runner installs).
+//
+// And a local publish can only build what THIS machine can build. Electron
+// cross-building is what the CI matrix exists for, so a `--platforms` naming
+// anything else is refused by name rather than quietly building the host's.
+//
+// The laptop and the runner are ONE pipeline in two environments (#865), so
+// the last case PINS them to each other: the command the workflow's publishing
+// legs run, the script that command expands to, and the call `--direct` makes
+// are read from the files themselves rather than restated here.
+
+const fs = require('fs');
+const path = require('path');
+const Module = require('module');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+const attachLogFile = require('../../../vendor/devkit/attach-log-file.js');
+const deployRecord = require('../../../vendor/devkit/deploy-record.js');
+
+const COMMANDS = path.join(__dirname, '..', '..', '..', 'commands');
+const DEPLOY = path.join(COMMANDS, 'deploy.js');
+const WORKFLOW = path.join(__dirname, '..', '..', '..', 'defaults', '.github', 'workflows', 'build.yml');
+
+// The scripts every target gets from the scaffold, read from the one place that
+// declares them: expanding the workflow's command through THESE is what ties
+// the runner's step to the verb this laptop runs.
+const SCRIPTS = require(path.join(__dirname, '..', '..', '..', '..', 'package.json')).projectScripts;
+
+const { directPlatform } = require(DEPLOY);
+
+/**
+ * The publishing legs of the CI build, read from the workflow the scaffold
+ * writes: the mac and linux steps, which are the ones that publish (windows
+ * packages unsigned and `finalize-release` closes its release). A step's own
+ * command is ONE line; the `run: |` blocks around them are the leg's setup
+ * (decoding the signing assets, installing snapcraft), never the publish.
+ *
+ * @returns {Array<{ os: string, command: string }>} Every publishing leg's command, in file order.
+ */
+function ciPublishLegs() {
+  const lines = fs.readFileSync(WORKFLOW, 'utf8').split('\n').map((line) => line.trim());
+  const legs = [];
+  let os = null;
+
+  for (const line of lines) {
+    // A `- ` opens the next step, so the leg an `if:` names ends there.
+    if (line.startsWith('- ')) os = null;
+
+    const gate = /^(?:- )?if: matrix\.os == '(macos-latest|ubuntu-latest)'$/.exec(line);
+    if (gate) os = gate[1];
+
+    const run = /^(?:- )?run: (.+)$/.exec(line);
+    if (os && run && run[1] !== '|') legs.push({ os, command: run[1] });
+  }
+
+  return legs;
+}
+
+/**
+ * Swap ONE module for a recorder and hand back the undo. The precheck is the
+ * network boundary (it publishes this target's signing certs as Actions
+ * secrets), so proving `--direct` never reaches it means standing exactly
+ * there: everything else in the verb is the real code.
+ *
+ * @param {string} file - The module to replace.
+ * @param {object} exports - What it exports for the duration.
+ * @returns {Function} The restore.
+ */
+function stubModule(file, exports) {
+  const resolved = require.resolve(file);
+  const previous = require.cache[resolved];
+  const stub = new Module(resolved);
+
+  stub.filename = resolved;
+  stub.loaded = true;
+  stub.exports = exports;
+  require.cache[resolved] = stub;
+
+  return () => {
+    if (previous) require.cache[resolved] = previous;
+    else delete require.cache[resolved];
+  };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'deploy --direct: the host platform, and only the host platform',
+  tests: [
+    {
+      name: 'no --platforms builds the host, in the workflow input vocabulary',
+      run: (ctx) => {
+        ctx.expect(directPlatform(undefined, 'darwin')).toBe('mac');
+        ctx.expect(directPlatform(undefined, 'win32')).toBe('windows');
+        ctx.expect(directPlatform(undefined, 'linux')).toBe('linux');
+      },
+    },
+    {
+      name: 'the host platform in OMEGA\'s own vocabulary is accepted, in any case (#867)',
+      run: (ctx) => {
+        ctx.expect(directPlatform('mac', 'darwin')).toBe('mac');
+        ctx.expect(directPlatform('MAC', 'darwin')).toBe('mac');
+        ctx.expect(directPlatform('windows', 'win32')).toBe('windows');
+        ctx.expect(directPlatform('WINDOWS', 'win32')).toBe('windows');
+        ctx.expect(directPlatform('linux', 'linux')).toBe('linux');
+      },
+    },
+    {
+      name: 'a host NAME from another vocabulary is refused, naming the one OMEGA speaks (#867)',
+      run: (ctx) => {
+        // The flag speaks mac | windows | linux and nothing else: the node and
+        // runner spellings of the SAME host are foreign words here, and a
+        // refusal names the host in the vocabulary the flag does accept.
+        ctx.expect(() => directPlatform('darwin', 'darwin')).toThrow(/can only build mac: darwin/);
+        ctx.expect(() => directPlatform('win32', 'win32')).toThrow(/can only build windows: win32/);
+        ctx.expect(() => directPlatform('ubuntu', 'linux')).toThrow(/can only build linux: ubuntu/);
+      },
+    },
+    {
+      name: 'a platform this machine cannot build is REFUSED, never silently swapped for the host',
+      run: (ctx) => {
+        ctx.expect(() => directPlatform('windows', 'darwin')).toThrow(/CI-only/);
+        ctx.expect(() => directPlatform('mac,linux', 'darwin')).toThrow(/linux/);
+        // 'all' names three platforms, and a laptop is one of them
+        ctx.expect(() => directPlatform('all', 'darwin')).toThrow(/CI-only/);
+      },
+    },
+    {
+      name: 'an unknown host refuses too, pointing at the CI lane',
+      run: (ctx) => {
+        ctx.expect(() => directPlatform(undefined, 'aix')).toThrow(/Dispatch the CI build/);
+      },
+    },
+    {
+      name: '--direct never runs the NETWORK precheck: a local deploy publishes no secrets (#872)',
+      run: async (ctx) => {
+        const ran = [];
+        const restores = [
+          stubModule(path.join(COMMANDS, 'lib', 'ensure-target.js'), { ensureTarget: async () => ran.push('ensure-target') }),
+          stubModule(path.join(COMMANDS, 'lib', 'deploy-precheck.js'), { deployPrecheck: async () => ran.push('precheck') }),
+        ];
+        const resolved = require.resolve(DEPLOY);
+        const cached = require.cache[resolved];
+        delete require.cache[resolved];
+
+        try {
+          const deploy = require(resolved);
+
+          // A platform no host can build: the direct lane refuses it, which is
+          // the proof the run REACHED that lane. What must not have happened on
+          // the way is the precheck, which publishes the signing certs to the
+          // repo's Actions secrets and needs a `gh` session to do it.
+          await ctx.expect(() => deploy({ direct: true, platforms: 'atari' })).toThrow(/CI-only/);
+          ctx.expect(ran).toEqual(['ensure-target']);
+        } finally {
+          // The verb tees this process' writers now (#873): hand them back.
+          attachLogFile.detach();
+          for (const restore of restores) restore();
+          if (cached) require.cache[resolved] = cached;
+          else delete require.cache[resolved];
+        }
+      },
+    },
+    {
+      // One pipeline, two environments (Ian on #865): the runner's publishing
+      // legs and this laptop's `--direct` run the SAME publish, so the three
+      // links between them are read from the files here. Nothing pinned them
+      // before, and the workflow step, the script and the verb could each move
+      // without the other two.
+      name: '--direct runs the ONE publish CI runs: the workflow\'s release:local script, local flag and all (#865)',
+      run: async (ctx) => {
+        // 1. What the runner runs, taken from the workflow the scaffold writes.
+        const legs = ciPublishLegs();
+
+        ctx.expect(legs).toEqual([
+          { os: 'macos-latest', command: 'npm run release:local' },
+          { os: 'ubuntu-latest', command: 'npm run release:local' },
+        ]);
+
+        // 2. Expanded through the target's own scripts, that command IS the
+        // publish verb under the local flag.
+        const script = SCRIPTS[legs[0].command.replace(/^npm run /, '')];
+
+        ctx.expect(script).toBe('omega publish --local');
+
+        // 3. And `--direct` calls the very same publish, in process.
+        const ran = [];
+        const published = [];
+        const restores = [
+          stubModule(path.join(COMMANDS, 'lib', 'ensure-target.js'), { ensureTarget: async () => ran.push('ensure-target') }),
+          stubModule(path.join(COMMANDS, 'lib', 'deploy-precheck.js'), { deployPrecheck: async () => ran.push('precheck') }),
+          stubModule(path.join(COMMANDS, 'publish.js'), async (options) => {
+            ran.push('publish');
+            published.push(options);
+          }),
+        ];
+        // A real run stamps the brand's deploy record, and a test must never
+        // write one into the tree it happens to be standing in.
+        const recordDeploy = deployRecord.recordDeploy;
+        deployRecord.recordDeploy = () => {};
+        const resolved = require.resolve(DEPLOY);
+        const cached = require.cache[resolved];
+        delete require.cache[resolved];
+
+        try {
+          const deploy = require(resolved);
+
+          // This machine's platform, in the vocabulary the flag speaks: the
+          // direct lane builds the host and only the host, whichever host is
+          // running the suite.
+          await deploy({ direct: true, platforms: directPlatform(undefined, process.platform) });
+
+          // The publish ran once, under the local flag, and the precheck (the
+          // network boundary) never did.
+          ctx.expect(ran).toEqual(['ensure-target', 'publish']);
+          ctx.expect(published.length).toBe(1);
+          ctx.expect(published[0].local).toBe(true);
+
+          // 4. The two ends meet at that flag. `src/cli-run.js` is what maps
+          // one to the other: it declares `local` boolean and hands the parsed
+          // options to the router, so the script's `--local` arrives at the
+          // verb as `{ local: true }`. The parse itself is pinned in
+          // build/cli.test.js; this pin names the flag on both sides.
+          ctx.expect(script.split(' ').filter((word) => word.startsWith('--'))).toEqual(['--local']);
+        } finally {
+          // The verb tees this process' writers now (#873): hand them back.
+          attachLogFile.detach();
+          deployRecord.recordDeploy = recordDeploy;
+          for (const restore of restores) restore();
+          if (cached) require.cache[resolved] = cached;
+          else delete require.cache[resolved];
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/deploy-dispatch.test.js

@@ -0,0 +1,287 @@
+// Build-layer test for the dispatch lane's run follower
+// ([#873](https://github.com/Omega-JS-Stack/omega/issues/873)).
+//
+// `omega deploy` delegates to `omega release`, which owns desktop's dispatch.
+// The dispatch used to BE the verb's answer: it printed the runs page and
+// exited 0 while the run it started went red minutes later. Now the ONE devkit
+// follower (`@omega.js/devkit/deploy-follow`, ported out of this very file) is
+// called with the repo and workflow the dispatch used, and its verdict is the
+// verb's exit code. The follower's own behavior is pinned in devkit's
+// `test/deploy-follow.test.js`.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const RELEASE = path.join(__dirname, '..', '..', '..', 'commands', 'release.js');
+
+// Required as literals: that is what resolves to the same instance the command
+// loads (a vendored devkit inside dist, the workspace one from src).
+const devkitDeploy = require('../../../vendor/devkit/deploy.js');
+const devkitFollow = require('../../../vendor/devkit/deploy-follow.js');
+const devkitRecord = require('../../../vendor/devkit/deploy-record.js');
+const attachLogFile = require('../../../vendor/devkit/attach-log-file.js');
+
+// The dispatch a stub stands in for: accepted, on the ONE lane (#915).
+const LANE = { mode: 'snapshot', ref: 'omega-deploy' };
+
+/**
+ * A desktop target inside a brand that names its repo, run as cwd.
+ *
+ * @returns {{ brandRoot: string, targetDir: string }} The staged tree.
+ */
+function stageBrand() {
+  const brandRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-dispatch-')));
+  const targetDir = path.join(brandRoot, 'targets', 'desktop');
+
+  fs.mkdirSync(path.join(brandRoot, 'config'), { recursive: true });
+  fs.writeFileSync(path.join(brandRoot, 'config', 'omega.json5'), JSON.stringify({
+    brand: { id: 'acme', name: 'Acme', url: 'https://acme.test' },
+    repo: { provider: 'github', org: 'Acme-Org' },
+    targets: { desktop: { type: 'desktop' } },
+  }));
+  fs.writeFileSync(path.join(brandRoot, 'package.json'), '{"name":"acme-brand","version":"0.0.0"}');
+  fs.mkdirSync(targetDir, { recursive: true });
+  fs.writeFileSync(path.join(targetDir, 'package.json'), '{"name":"acme-desktop","version":"0.0.0"}');
+
+  return { brandRoot, targetDir };
+}
+
+/**
+ * Run the release verb from a staged target with the network steps swapped
+ * out. The verb DESTRUCTURES its imports at load, so it is dropped from the
+ * cache and re-required inside the patch.
+ *
+ * @param {object} follower - What `followRun` does for this run.
+ * @param {object} [options] - Extra verb options for this run (the fan-out's `--snapshot`).
+ * @param {object} [token] - The token surfaces this run has: `env` is what
+ *   `GH_TOKEN` holds (null for a shell that never exported one) and `resolved`
+ *   is what devkit's `resolveToken()` chain answers (null for a machine with no
+ *   token anywhere, `gh` included).
+ * @returns {Promise<{ sent: object[], followed: object[], error: Error|null, lines: string[], targetDir: string, brandRoot: string }>} The run's record.
+ */
+async function runRelease(follower, options = {}, token = {}) {
+  const envToken = 'env' in token ? token.env : 'tok';
+  const resolvedToken = 'resolved' in token ? token.resolved : 'tok';
+  const { brandRoot, targetDir } = stageBrand();
+  const followed = [];
+  const sent = [];
+  const patched = [
+    [devkitDeploy, 'deployViaDispatch', async (args) => {
+      sent.push(args);
+      // The executor's own answer shape (`buildDispatch`): the verb prints the
+      // plan's runs url rather than rebuilding that address for itself, and a
+      // run carrying the root's snapshot is on the snapshot lane by definition.
+      // The `sha` is part of that shape (#902): it is what the verb labels the
+      // dispatch with and what it holds the followed run's head to, so a stub
+      // that dropped it hid both.
+      return {
+        sha: args.snapshot || null,
+        plan: {
+          method: 'POST',
+          url: `https://api.github.com/repos/${args.owner}/${args.repo}/actions/workflows/${args.workflow}/dispatches`,
+          body: { ref: LANE.ref, ...(args.inputs ? { inputs: args.inputs } : {}) },
+          runsUrl: `https://github.com/${args.owner}/${args.repo}/actions/workflows/${args.workflow}`,
+        },
+        dispatched: !args.dryRun,
+        lane: LANE,
+      };
+    }],
+    [devkitDeploy, 'resolveToken', () => resolvedToken],
+    [devkitRecord, 'recordDeploy', () => {}],
+    [devkitFollow, 'followRun', async (args) => {
+      followed.push(args);
+      return follower(args);
+    }],
+  ];
+  const restore = patched.map(([module, key]) => [module, key, module[key]]);
+  for (const [module, key, value] of patched) module[key] = value;
+
+  const lines = [];
+  const previousLog = console.log;
+  console.log = (...args) => lines.push(args.map(String).join(' '));
+
+  const previousCwd = process.cwd();
+  const previousToken = process.env.GH_TOKEN;
+  if (envToken === null) delete process.env.GH_TOKEN;
+  else process.env.GH_TOKEN = envToken;
+  process.chdir(targetDir);
+  delete require.cache[require.resolve(RELEASE)];
+
+  let error = null;
+  try {
+    await require(RELEASE)(options);
+  } catch (e) {
+    error = e;
+  } finally {
+    // The verb tees this process' writers: hand them back before the next
+    // suite prints through a fixture that is about to be gone.
+    attachLogFile.detach();
+    console.log = previousLog;
+    process.chdir(previousCwd);
+    if (previousToken === undefined) delete process.env.GH_TOKEN;
+    else process.env.GH_TOKEN = previousToken;
+    for (const [module, key, value] of restore) module[key] = value;
+    delete require.cache[require.resolve(RELEASE)];
+  }
+
+  return { sent, followed, error, lines, targetDir, brandRoot };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'deploy dispatch: the run is followed, and its conclusion is the verb\'s (#873)',
+  tests: [
+    {
+      name: 'the dispatched run is followed with the repo and workflow the dispatch used (#873, #847)',
+      run: async (ctx) => {
+        const { sent, followed, error, targetDir, brandRoot } = await runRelease(async () => ({ run: {}, conclusion: 'success' }));
+
+        try {
+          ctx.expect(error).toBe(null);
+
+          // The dispatch address is devkit's ONE helper's (#847): the repo the
+          // brand's config names, and the per-target workflow the scaffold
+          // composed at the brand root (#265).
+          ctx.expect(sent.length).toBe(1);
+          ctx.expect({ owner: sent[0].owner, repo: sent[0].repo, workflow: sent[0].workflow })
+            .toEqual({ owner: 'Acme-Org', repo: 'acme-omega', workflow: 'desktop-build.yml' });
+          ctx.expect(followed.length).toBe(1);
+          ctx.expect(followed[0].owner).toBe('Acme-Org');
+          ctx.expect(followed[0].repo).toBe('acme-omega');
+          // The COMPOSED name (#265), the one the dispatch itself named.
+          ctx.expect(followed[0].workflow).toBe('desktop-build.yml');
+          ctx.expect(followed[0].token).toBe('tok');
+          ctx.expect(followed[0].since instanceof Date).toBe(true);
+          // And the whole verb went to the target's own deploy log, the name
+          // every target's deploy writes now (logs/ci.log is retired).
+          ctx.expect(fs.existsSync(path.join(targetDir, 'logs', 'deploy.log'))).toBe(true);
+          ctx.expect(fs.existsSync(path.join(targetDir, 'logs', 'ci.log'))).toBe(false);
+        } finally {
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // #901: the brand root pushes the snapshot ONCE and hands every target
+      // of the run the sha, so this verb dispatches against it and pushes
+      // nothing. The flag is the root's word to the verb, never typed.
+      name: '--snapshot=<sha> reaches the executor as the run\'s snapshot (#901)',
+      run: async (ctx) => {
+        const { sent, followed, error, lines, brandRoot } = await runRelease(
+          async () => ({ run: {}, conclusion: 'success' }),
+          { snapshot: 'abc1234567890' },
+        );
+
+        try {
+          ctx.expect(error).toBe(null);
+          ctx.expect(sent.length).toBe(1);
+          ctx.expect(sent[0].snapshot).toBe('abc1234567890');
+
+          // And the sha the executor answers with is what the run is BOTH
+          // labelled with and held to (#902): the dispatch line names it, and
+          // the follower refuses a run whose head is anything else.
+          ctx.expect(lines.join('\n')).toContain('Dispatched desktop-build.yml (snapshot lane, ref omega-deploy @ abc1234)');
+          ctx.expect(followed.length).toBe(1);
+          ctx.expect(followed[0].headSha).toBe('abc1234567890');
+        } finally {
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // The token chain is devkit's ONE resolver, `GH_TOKEN` → `GITHUB_TOKEN` →
+      // `gh auth token`, which every other target and this verb's own follower
+      // already use. Testing the bare env var here refused a machine signed in
+      // with `gh` and holding no variable at all.
+      name: 'a signed-in `gh` and no GH_TOKEN in the env still dispatches: the token chain is the one resolver',
+      run: async (ctx) => {
+        const { sent, followed, error, brandRoot } = await runRelease(
+          async () => ({ run: {}, conclusion: 'success' }),
+          {},
+          { env: null, resolved: 'gh-cli-token' },
+        );
+
+        try {
+          ctx.expect(error).toBe(null);
+          ctx.expect(sent.length).toBe(1);
+          ctx.expect(followed[0].token).toBe('gh-cli-token');
+        } finally {
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'no token anywhere refuses by name, before the dispatch',
+      run: async (ctx) => {
+        const { sent, error, brandRoot, targetDir } = await runRelease(
+          async () => ({ run: {}, conclusion: 'success' }),
+          {},
+          { env: null, resolved: null },
+        );
+
+        try {
+          ctx.expect(error === null).toBe(false);
+          ctx.expect(error.message).toContain('GH_TOKEN');
+          ctx.expect(error.message).toContain('gh auth login');
+          ctx.expect(sent.length).toBe(0);
+          // The tee attached before the token check (#873), so the harness's
+          // detach above popped this verb's layer and not the `omega test` log
+          // under it.
+          ctx.expect(fs.existsSync(path.join(targetDir, 'logs', 'deploy.log'))).toBe(true);
+        } finally {
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      // P4/P6: the preview used to be a SECOND dispatch call in deploy.js, built
+      // without the snapshot or the ref, so `--dry-run --snapshot=<sha>`
+      // printed a plan that ignored the sha the fan-out pushed. One call site
+      // now answers both.
+      name: 'a --dry-run threads the snapshot and sends nothing, and the runs url is the PLAN\'s (#895, #901)',
+      run: async (ctx) => {
+        const { sent, followed, error, lines, brandRoot } = await runRelease(
+          async () => ({ run: {}, conclusion: 'success' }),
+          { dryRun: true, snapshot: 'abc1234567890', platforms: 'mac' },
+          // A dry run resolves no token: every step under it is a read or a plan.
+          { env: null, resolved: null },
+        );
+
+        try {
+          ctx.expect(error).toBe(null);
+          ctx.expect(sent.length).toBe(1);
+          ctx.expect(sent[0].dryRun).toBe(true);
+          ctx.expect(sent[0].snapshot).toBe('abc1234567890');
+          ctx.expect(followed.length).toBe(0);
+
+          const preview = lines.join('\n');
+          // The header names the LANE, the same spelling the other three verbs
+          // print (docs/shared/deploys.md); the sha rides the Dispatched line only.
+          ctx.expect(preview).toContain('DRY RUN (snapshot lane, ref omega-deploy)');
+          ctx.expect(preview).not.toContain('abc1234');
+          ctx.expect(preview).toContain('https://github.com/Acme-Org/acme-omega/actions/workflows/desktop-build.yml');
+        } finally {
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'a follower that throws is the verb throwing, so a red run exits 1 (#873)',
+      run: async (ctx) => {
+        const { error, brandRoot } = await runRelease(async () => {
+          throw new Error('desktop-build.yml concluded failure: https://github.com/Acme-Org/acme-omega/actions/runs/7');
+        });
+
+        try {
+          ctx.expect(error && error.message).toContain('concluded failure');
+          ctx.expect(error.message).toContain('actions/runs/7');
+        } finally {
+          fs.rmSync(brandRoot, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});