browser4-cli 4.14.0-rc.5 → 4.14.0-rc.7

package/scripts/tests/install-browser4-cli.tests.sh

@@ -27,8 +27,8 @@ dim()    { echo -e "\033[2m$*\033[0m"; }
 
 test() {
     local name="$1"
-    local fn="$2"
-    if "$fn"; then
+    shift
+    if "$@"; then
         PASS=$((PASS + 1))
         green "  PASS  $name"
     else
@@ -109,26 +109,65 @@ test "--source invalid rejected" bash -c "
     bash '$INSTALL_SCRIPT' --source invalid --dry-run 2>&1 | grep -qi 'github.*oss\|must be'
 "
 
+test "--version rejects a following option as its value" bash -c "
+    rc=0
+    out=\$(bash '$INSTALL_SCRIPT' --version --dry-run 2>&1) || rc=\$?
+    [[ \$rc -ne 0 ]] && echo \"\$out\" | grep -q 'requires a value'
+"
+
+test "--install-dir rejects a following option as its value" bash -c "
+    rc=0
+    out=\$(bash '$INSTALL_SCRIPT' --install-dir --silent 2>&1) || rc=\$?
+    [[ \$rc -ne 0 ]] && echo \"\$out\" | grep -q 'requires a value'
+"
+
+test "--version accepts a bare semver and prefixes it with v" bash -c "
+    bash '$INSTALL_SCRIPT' --locate --version 4.13.18 2>&1 | grep -q 'releases/download/v4\.13\.18/'
+"
+
+test "--version with the v prefix is left untouched" bash -c "
+    bash '$INSTALL_SCRIPT' --locate --version v4.13.18 2>&1 | grep -q 'releases/download/v4\.13\.18/'
+"
+
 test "--dry-run flag accepted" bash -c "
-    bash '$INSTALL_SCRIPT' --dry-run 2>&1 | grep -qi 'DRY-RUN\|dry-run\|Install'
+    bash '$INSTALL_SCRIPT' --dry-run 2>&1 | grep -q 'DRY-RUN'
 "
 
-test "--silent flag accepted" bash -c "
-    bash '$INSTALL_SCRIPT' --silent --dry-run 2>&1 | grep -v '^$' | head -1 | grep -qv '→\|step'
+test "--silent suppresses progress output" bash -c "
+    out=\$(bash '$INSTALL_SCRIPT' --silent --dry-run 2>&1)
+    echo \"\$out\" | grep -q 'DRY-RUN' && ! echo \"\$out\" | grep -q 'Install:'
 "
 
 test "--skip-local flag accepted" bash -c "
-    bash '$INSTALL_SCRIPT' --skip-local --dry-run 2>&1 | grep -qi 'skip\|DRY-RUN\|Already\|Install'
+    bash '$INSTALL_SCRIPT' --skip-local --dry-run 2>&1 | grep -q 'Skipping local binary check'
 "
 
 test "--no-path flag accepted" bash -c "
-    bash '$INSTALL_SCRIPT' --no-path --dry-run 2>&1 | grep -vq 'Added to PATH'
+    ! bash '$INSTALL_SCRIPT' --no-path --dry-run 2>&1 | grep -q 'Added to PATH'
 "
 
 test "unknown arg rejected" bash -c "
     bash '$INSTALL_SCRIPT' --bogus-flag 2>&1 | grep -q 'Unknown argument'
 "
 
+# A PATH that has everything the diagnostics need except the download tooling.
+# `--locate` must still answer; a real install must refuse with a clear message
+# instead of failing later with 'curl: command not found'.
+minimal_path_locate_works() {
+    local dir; dir="$(mktemp -d)"
+    local bash_bin; bash_bin=$(command -v bash)
+    local tool tool_path
+    for tool in uname stat cat grep awk sed dirname basename tr od; do
+        tool_path=$(command -v "$tool") && ln -sf "$tool_path" "$dir/$tool"
+    done
+    local locate_rc=0 install_rc=0
+    PATH="$dir" "$bash_bin" "$INSTALL_SCRIPT" --locate >/dev/null 2>&1 || locate_rc=$?
+    PATH="$dir" "$bash_bin" "$INSTALL_SCRIPT" --dry-run --no-path >/dev/null 2>&1 || install_rc=$?
+    rm -rf "$dir"
+    [[ $locate_rc -eq 0 ]] && [[ $install_rc -ne 0 ]]
+}
+test "--locate needs no download tooling, installing does" minimal_path_locate_works
+
 echo ""
 
 # ── Locate mode ────────────────────────────────────────
@@ -191,6 +230,103 @@ test "OSS URL NOT using broken download/latest pattern" bash -c "
 
 echo ""
 
+# ── Download integrity (stubbed curl -- no network) ────
+
+echo "--- Download integrity ---" | cyan
+
+STUB_DIR="$(mktemp -d)"
+mkdir -p "$STUB_DIR"
+
+cat > "$STUB_DIR/curl" << 'STUBEOF'
+#!/usr/bin/env bash
+# curl stub for the installer tests.  Honours -o <file>, takes the body from
+# STUB_BODY (html = an error page, elf = a native binary), reports STUB_STATUS
+# and records its own command line in STUB_ARGS_FILE so a test can assert on
+# the headers the installer would have sent.
+out=""
+printf '%s\n' "$*" >> "${STUB_ARGS_FILE:-/dev/null}"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -o) out="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+if [[ "${STUB_STATUS:-200}" == "200" ]]; then
+  if [[ "${STUB_BODY:-elf}" == "html" ]]; then
+    { printf '<html>'; head -c 200000 /dev/zero | tr '\0' 'x'; printf '</html>'; } > "$out"
+  else
+    { printf '\177ELF\002\001\001\000'; head -c 200000 /dev/zero; } > "$out"
+  fi
+fi
+echo "${STUB_STATUS:-200}"
+exit "${STUB_EXIT:-0}"
+STUBEOF
+chmod +x "$STUB_DIR/curl"
+
+stub_install() {
+    # $1 = body kind (html|elf), $2 = source, $3 = args file, $4 = extra env
+    local body="$1" source="$2" args_file="$3" dir rc=0
+    dir="$(mktemp -d)"
+    STUB_BODY="$body" STUB_ARGS_FILE="$args_file" \
+        PATH="$STUB_DIR:$PATH" bash "$INSTALL_SCRIPT" \
+        --source "$source" --no-path --skip-backend --skip-local \
+        --install-dir "$dir/inst" >"$dir/out" 2>&1 || rc=$?
+    printf '%s\n' "$rc" > "$dir/rc"
+    echo "$dir"
+}
+
+download_rejects_html() {
+    local args; args="$(mktemp)"
+    local dir; dir=$(stub_install html oss "$args")
+    local rc; rc=$(cat "$dir/rc")
+    local rejected=0
+    grep -q 'not a native executable' "$dir/out" && rejected=1
+    rm -rf "$dir" "$args"
+    [[ "$rc" -ne 0 ]] && [[ $rejected -eq 1 ]]
+}
+
+download_accepts_elf() {
+    local args; args="$(mktemp)"
+    local dir; dir=$(stub_install elf oss "$args")
+    local rc; rc=$(cat "$dir/rc")
+    local installed; installed=$(find "$dir/inst" -maxdepth 1 -type f -name 'browser4-cli-*' 2>/dev/null | head -1)
+    local ok=1
+    [[ "$rc" -eq 0 ]] && [[ -n "$installed" ]] && [[ -x "$installed" ]] && ok=0
+    rm -rf "$dir" "$args"
+    [[ $ok -eq 0 ]]
+}
+
+token_not_sent_to_oss() {
+    local args; args="$(mktemp)"
+    export GITHUB_TOKEN=stub-secret-token
+    local dir; dir=$(stub_install elf oss "$args")
+    unset GITHUB_TOKEN
+    local leaked=0
+    grep -q 'stub-secret-token' "$args" && leaked=1
+    rm -rf "$dir" "$args"
+    [[ $leaked -eq 0 ]]
+}
+
+token_sent_to_github() {
+    local args; args="$(mktemp)"
+    export GITHUB_TOKEN=stub-secret-token
+    local dir; dir=$(stub_install elf github "$args")
+    unset GITHUB_TOKEN
+    local sent=0
+    grep -q 'stub-secret-token' "$args" && sent=1
+    rm -rf "$dir" "$args"
+    [[ $sent -eq 1 ]]
+}
+
+test "download rejects an HTML error page (bad magic bytes)" download_rejects_html
+test "download accepts a native binary body" download_accepts_elf
+test "GITHUB_TOKEN is never sent to the OSS mirror" token_not_sent_to_oss
+test "GITHUB_TOKEN is sent to GitHub" token_sent_to_github
+
+rm -rf "$STUB_DIR"
+
+echo ""
+
 # ── Functions (extracted via copy without main call) ──
 
 echo "--- Functions ---" | cyan
@@ -232,7 +368,9 @@ test "get_default_install_dir returns non-empty" bash -c "
 
 test "detect_china_locale returns 0 or 1 (no crash)" bash -c "
     source '$FUNC_TEST_SCRIPT' >/dev/null 2>&1
-    detect_china_locale && true || true
+    rc=0
+    detect_china_locale || rc=\$?
+    [[ \$rc -eq 0 || \$rc -eq 1 ]]
 "
 
 test "detect_os returns valid OS" bash -c "
@@ -323,7 +461,10 @@ test "header is ASCII (no box-drawing chars)" bash -c "
 "
 
 test "header does not contain Unicode box-drawing" bash -c "
-    ! bash '$INSTALL_SCRIPT' --locate 2>&1 | grep -P '[\x{2500}-\x{257F}]' 2>/dev/null || true
+    # Portable (no grep -P): drop the ANSI colour escapes first, then any byte
+    # outside printable ASCII would be a non-ASCII character; the installer
+    # prints ASCII only.
+    ! bash '$INSTALL_SCRIPT' --locate 2>&1 | tr -d '\033' | LC_ALL=C grep -q '[^ -~]'
 "
 
 echo ""
@@ -333,7 +474,13 @@ echo ""
 echo "--- Edge cases ---" | cyan
 
 test "double dash in --version handled (no operator parsing)" bash -c "
-    bash '$INSTALL_SCRIPT' --locate 2>&1 | grep -q 'version'
+    # '--version --dry-run' must not be read as the tag '--dry-run'; the value
+    # has to be a release tag, and a bare semver gets the 'v' prefix.
+    rc=0
+    out=\$(bash '$INSTALL_SCRIPT' --version --dry-run 2>&1) || rc=\$?
+    [[ \$rc -ne 0 ]] || exit 1
+    echo \"\$out\" | grep -q 'looks like another option' || exit 1
+    bash '$INSTALL_SCRIPT' --locate --version 4.13.18 2>&1 | grep -q 'releases/download/v4\.13\.18/'
 "
 
 test "empty --version with dry-run doesn't download" bash -c "

package/scripts/tests/reconcile-release-assets.tests.sh

@@ -0,0 +1,421 @@
+#!/usr/bin/env bash
+# reconcile-release-assets.tests.sh
+# Test suite for reconcile-release-assets.sh
+# Uses only bash builtins and standard Unix tools -- no external test
+# frameworks and no network: `gh` is stubbed on PATH.
+#
+# Run:
+#   bash cli/scripts/tests/reconcile-release-assets.tests.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_UNDER_TEST="$(cd "$SCRIPT_DIR/.." && pwd)/reconcile-release-assets.sh"
+
+PASS=0
+FAIL=0
+
+green()  { echo -e "\033[0;32m$*\033[0m"; }
+red()    { echo -e "\033[0;31m$*\033[0m"; }
+cyan()   { echo -e "\033[0;36m$*\033[0m"; }
+dim()    { echo -e "\033[2m$*\033[0m"; }
+
+# test <name> <command...>
+# The whole command is forwarded: `test "x" bash -c "..."` must not drop the
+# `-c "..."` part, or a bare `bash` would exit 0 and the assertion would pass
+# vacuously.
+test() {
+    local name="$1"
+    shift
+    if "$@"; then
+        PASS=$((PASS + 1))
+        green "  PASS  $name"
+    else
+        FAIL=$((FAIL + 1))
+        red   "  FAIL  $name"
+    fi
+}
+
+# ---- fixture: three release assets ------------------------------------
+
+STUB_DIR="$(mktemp -d)"
+cleanup() { rm -rf "$STUB_DIR"; }
+trap cleanup EXIT
+
+ASSET_DIR="$STUB_DIR/assets"
+mkdir -p "$ASSET_DIR"
+
+# make_asset <name> <bytes> -- a real file of an exact size, so the script's
+# size comparison runs against real byte counts.
+make_asset() {
+    local path="$ASSET_DIR/$1" bytes="$2" i=0
+    rm -f "$path"
+    : > "$path"
+    while [ "$i" -lt "$bytes" ]; do
+        printf 'x' >> "$path"
+        i=$((i + 1))
+    done
+}
+
+JAR="Browser4.jar"
+CLI_BIN="browser4-cli-linux-x64"
+BUNDLE="browser4-bundle-runtime-linux-x64.tar.gz"
+JAR_BYTES=101
+CLI_BIN_BYTES=202
+BUNDLE_BYTES=303
+make_asset "$JAR" "$JAR_BYTES"
+make_asset "$CLI_BIN" "$CLI_BIN_BYTES"
+make_asset "$BUNDLE" "$BUNDLE_BYTES"
+
+ASSET_PATHS=("$ASSET_DIR/$JAR" "$ASSET_DIR/$CLI_BIN" "$ASSET_DIR/$BUNDLE")
+
+# ---- stub gh ----------------------------------------------------------
+
+cat > "$STUB_DIR/gh" <<'STUB'
+#!/usr/bin/env bash
+# Fake `gh release view` / `gh release upload`, driven by the test environment:
+#
+#   FAKE_GH_STATE   directory holding one file per asset the release "has",
+#                   whose content is the size GitHub reports for it
+#   FAKE_GH_COUNTS  directory holding the per-command invocation counters
+#   FAKE_GH_LOG     append-only command log the assertions read
+#   FAKE_GH_MODE    ok | view-fails-once | upload-fails-once |
+#                   upload-never-succeeds | release-missing
+#
+# upload-fails-once and upload-never-succeeds answer with the message the
+# v4.14.0-rc.6 release run died on.
+set -euo pipefail
+
+state="${FAKE_GH_STATE:?FAKE_GH_STATE is required}"
+counts="${FAKE_GH_COUNTS:?FAKE_GH_COUNTS is required}"
+log="${FAKE_GH_LOG:?FAKE_GH_LOG is required}"
+mode="${FAKE_GH_MODE:?FAKE_GH_MODE is required}"
+
+bump() {
+    local file="$counts/$1" count=0
+    if [ -f "$file" ]; then count="$(cat "$file")"; fi
+    count=$((count + 1))
+    printf '%s' "$count" > "$file"
+    printf '%s' "$count"
+}
+
+command_name="${1:-} ${2:-}"
+
+case "$command_name" in
+    "release view")
+        printf 'view\n' >> "$log"
+        n="$(bump view)"
+
+        if [ "$mode" = "release-missing" ]; then
+            echo "release not found" >&2
+            exit 1
+        fi
+        if [ "$mode" = "view-fails-once" ] && [ "$n" -le 1 ]; then
+            echo "HTTP 502: Bad Gateway (https://api.github.com/repos/o/r/releases/tags/v1.2.3)" >&2
+            exit 1
+        fi
+
+        for asset in "$state"/*; do
+            [ -e "$asset" ] || continue
+            printf '%s %s\n' "$(basename "$asset")" "$(cat "$asset")"
+        done
+        ;;
+
+    "release upload")
+        # Skip the subcommand and the tag; keep the arguments that are real
+        # files -- --repo and its value are not.
+        shift 2
+        shift
+        files=()
+        for arg in "$@"; do
+            [ -f "$arg" ] || continue
+            files+=("$arg")
+        done
+
+        names=()
+        for f in "${files[@]}"; do names+=("${f##*/}"); done
+        printf 'upload %s\n' "${names[*]}" >> "$log"
+
+        n="$(bump upload)"
+        fail_round=0
+        case "$mode" in
+            upload-fails-once)
+                if [ "$n" -le 1 ]; then fail_round=1; fi
+                ;;
+            upload-never-succeeds)
+                fail_round=1
+                ;;
+        esac
+        if [ "$fail_round" -eq 1 ]; then
+            echo "Error creating asset temp dir" >&2
+            exit 1
+        fi
+
+        for f in "${files[@]}"; do
+            printf '%s' "$(wc -c < "$f" | tr -d '[:space:]')" > "$state/${f##*/}"
+            echo "Uploaded ${f##*/}"
+        done
+        ;;
+
+    *)
+        echo "fake gh: unhandled command '${command_name}'" >&2
+        exit 2
+        ;;
+esac
+STUB
+chmod +x "$STUB_DIR/gh"
+
+# ---- runner -----------------------------------------------------------
+
+RUN_STATUS=0
+RUN_OUTPUT=''
+RUN_STATE=''
+RUN_COUNTS=''
+RUN_LOG=''
+
+# new_run -- fresh release state, command log and counters for one scenario
+new_run() {
+    RUN_STATE="$STUB_DIR/state.$$.$RANDOM"
+    RUN_COUNTS="$STUB_DIR/counts.$$.$RANDOM"
+    RUN_LOG="$STUB_DIR/log.$$.$RANDOM"
+    rm -rf "$RUN_STATE" "$RUN_COUNTS" "$RUN_LOG"
+    mkdir -p "$RUN_STATE" "$RUN_COUNTS"
+    : > "$RUN_LOG"
+}
+
+# seed_asset <name> [<bytes>] -- an asset the release already carries, at the
+# size GitHub reports for it (defaults to the local size, i.e. a good upload)
+seed_asset() {
+    local name="$1" bytes="${2:-}"
+    if [ -z "$bytes" ]; then
+        bytes="$(wc -c < "$ASSET_DIR/$name" | tr -d '[:space:]')"
+    fi
+    printf '%s' "$bytes" > "$RUN_STATE/$name"
+}
+
+# run_script <mode> <timeout> <interval> <settle> [file...]
+run_script() {
+    local mode="$1" timeout="$2" interval="$3" settle="$4"
+    shift 4
+
+    RUN_STATUS=0
+    RUN_OUTPUT="$(
+        FAKE_GH_MODE="$mode" \
+        FAKE_GH_STATE="$RUN_STATE" \
+        FAKE_GH_COUNTS="$RUN_COUNTS" \
+        FAKE_GH_LOG="$RUN_LOG" \
+        PATH="$STUB_DIR:$PATH" \
+        bash "$SCRIPT_UNDER_TEST" \
+            --tag v1.2.3 \
+            --repo owner/repo \
+            --timeout "$timeout" \
+            --interval "$interval" \
+            --settle "$settle" \
+            "$@" 2>&1
+    )" || RUN_STATUS=$?
+}
+
+count_of() {
+    local file="$RUN_COUNTS/$1"
+    if [ -f "$file" ]; then cat "$file"; else printf '0'; fi
+}
+
+upload_calls() { count_of upload; }
+
+# uploaded_names -- every asset name the script asked gh to upload
+uploaded_names() {
+    sed -n 's/^upload //p' "$RUN_LOG" | tr ' ' '\n' | sed '/^$/d' | LC_ALL=C sort
+}
+
+output_has() {
+    case "$RUN_OUTPUT" in
+        *"$1"*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# ---- pre-flight -------------------------------------------------------
+
+cyan  "============================================"
+cyan  " reconcile-release-assets.sh Test Suite"
+cyan  "============================================"
+echo ""
+
+dim "--- Pre-flight ---"
+
+test "file exists" bash -c "[ -f '$SCRIPT_UNDER_TEST' ]"
+test "starts with shebang" bash -c "head -c 20 '$SCRIPT_UNDER_TEST' | grep -q '^#!/bin/bash'"
+test "bash syntax check passes" bash -c "bash -n '$SCRIPT_UNDER_TEST' 2>&1"
+# Byte-oriented on purpose: `grep -P` is unavailable in some environments and
+# decodes the file through the host locale.
+test "no non-ASCII bytes" bash -c "! LC_ALL=C grep -q '[^[:print:][:space:]]' '$SCRIPT_UNDER_TEST'"
+
+echo ""
+
+# ---- behaviour --------------------------------------------------------
+
+# The common case: the publishing action already uploaded everything. The
+# script must cost one listing call, no upload, and say so.
+test_verifies_a_complete_release_without_uploading() {
+    new_run
+    seed_asset "$JAR"
+    seed_asset "$CLI_BIN"
+    seed_asset "$BUNDLE"
+    run_script ok 20 1 0 "${ASSET_PATHS[@]}"
+    [ "$RUN_STATUS" -eq 0 ] || return 1
+    output_has "Verified 3 asset(s) on release v1.2.3" || return 1
+    [ "$(upload_calls)" -eq 0 ] || return 1
+    [ "$(count_of view)" -eq 1 ] || return 1
+}
+
+# The v4.14.0-rc.6 failure: some assets never made it. Only those are sent
+# again -- re-uploading the whole set is what makes the job slow.
+test_uploads_only_the_missing_assets() {
+    new_run
+    seed_asset "$JAR"
+    run_script ok 20 1 0 "${ASSET_PATHS[@]}"
+    [ "$RUN_STATUS" -eq 0 ] || return 1
+    [ "$(uploaded_names)" = "$(printf '%s\n%s\n' "$BUNDLE" "$CLI_BIN" | LC_ALL=C sort)" ] || return 1
+    [ "$(count_of view)" -ge 2 ] || return 1
+}
+
+# A failed upload can leave a partial asset behind: size, not presence, decides.
+test_repairs_a_partial_asset_by_size() {
+    new_run
+    seed_asset "$JAR"
+    seed_asset "$CLI_BIN"
+    seed_asset "$BUNDLE" 7
+    run_script ok 20 1 0 "${ASSET_PATHS[@]}"
+    [ "$RUN_STATUS" -eq 0 ] || return 1
+    output_has "size mismatch: the release has 7 bytes, the file has 303" || return 1
+    [ "$(uploaded_names)" = "$BUNDLE" ] || return 1
+    [ "$(cat "$RUN_STATE/$BUNDLE")" = "$BUNDLE_BYTES" ] || return 1
+}
+
+# The CI failure itself: GitHub answers "Error creating asset temp dir". The
+# round must be retried instead of failing the release.
+test_survives_the_transient_upload_error() {
+    new_run
+    run_script upload-fails-once 20 1 0 "${ASSET_PATHS[@]}"
+    [ "$RUN_STATUS" -eq 0 ] || return 1
+    output_has "Error creating asset temp dir" || return 1
+    output_has "WARN: gh release upload failed" || return 1
+    output_has "Verified 3 asset(s) on release v1.2.3" || return 1
+    [ "$(upload_calls)" -ge 2 ] || return 1
+    [ "$(cat "$RUN_STATE/$BUNDLE")" = "$BUNDLE_BYTES" ] || return 1
+}
+
+# The listing API is just as capable of a 5xx as the upload endpoint.
+test_survives_a_transient_listing_error() {
+    new_run
+    seed_asset "$JAR"
+    seed_asset "$CLI_BIN"
+    seed_asset "$BUNDLE"
+    run_script view-fails-once 20 1 0 "${ASSET_PATHS[@]}"
+    [ "$RUN_STATUS" -eq 0 ] || return 1
+    output_has "WARN: could not list the assets of release v1.2.3" || return 1
+    output_has "Verified 3 asset(s) on release v1.2.3" || return 1
+}
+
+# A missing release is the creation path, not the upload path: say so instead
+# of recreating it here with metadata the workflow did not pass.
+test_fails_when_the_release_does_not_exist() {
+    new_run
+    run_script release-missing 20 1 0 "${ASSET_PATHS[@]}"
+    [ "$RUN_STATUS" -eq 1 ] || return 1
+    output_has "release v1.2.3 does not exist" || return 1
+    output_has "release not found" || return 1
+}
+
+# Uploads that never take effect must fail the job, with the offenders named.
+test_fails_when_uploads_never_take_effect() {
+    new_run
+    run_script upload-never-succeeds 2 1 0 "${ASSET_PATHS[@]}"
+    [ "$RUN_STATUS" -eq 1 ] || return 1
+    output_has "still does not match the build output after 2s" || return 1
+    output_has "  - $BUNDLE: missing from the release" || return 1
+    output_has "Re-run the failed jobs of this workflow" || return 1
+}
+
+# ... and it must give up on time rather than sleep past its budget.
+test_respects_the_time_budget() {
+    local started elapsed
+    new_run
+    started=$SECONDS
+    run_script upload-never-succeeds 2 1 0 "${ASSET_PATHS[@]}"
+    elapsed=$((SECONDS - started))
+    [ "$RUN_STATUS" -eq 1 ] || return 1
+    [ "$elapsed" -le 10 ] || return 1
+}
+
+# The release workflow hands over the manifest it already builds: one asset
+# path per line, with blank lines and CRLF tolerated.
+test_reads_a_newline_separated_manifest() {
+    local manifest="$STUB_DIR/manifest.txt"
+    {
+        printf '%s\r\n' "${ASSET_PATHS[0]}"
+        printf '\n'
+        printf '%s\n%s\n' "${ASSET_PATHS[1]}" "${ASSET_PATHS[2]}"
+    } > "$manifest"
+
+    new_run
+    seed_asset "$JAR"
+    seed_asset "$CLI_BIN"
+    seed_asset "$BUNDLE"
+    run_script ok 20 1 0 --files-from "$manifest"
+    [ "$RUN_STATUS" -eq 0 ] || return 1
+    output_has "Verified 3 asset(s) on release v1.2.3" || return 1
+    [ "$(upload_calls)" -eq 0 ] || return 1
+}
+
+test_rejects_a_missing_asset_file() {
+    new_run
+    run_script ok 20 1 0 "$ASSET_DIR/not-built.tar.gz"
+    [ "$RUN_STATUS" -eq 1 ] || return 1
+    output_has "does not exist" || return 1
+    [ "$(count_of view)" -eq 0 ] || return 1
+}
+
+test_requires_a_tag() {
+    local output status
+    output="$(PATH="$STUB_DIR:$PATH" bash "$SCRIPT_UNDER_TEST" "${ASSET_PATHS[@]}" 2>&1)" && status=0 || status=$?
+    [ "$status" -ne 0 ] || return 1
+    [[ "$output" == *"--tag is required"* ]] || return 1
+    [[ "$output" == *"Usage:"* ]] || return 1
+}
+
+test_requires_asset_files() {
+    local output status
+    output="$(PATH="$STUB_DIR:$PATH" bash "$SCRIPT_UNDER_TEST" --tag v1.2.3 2>&1)" && status=0 || status=$?
+    [ "$status" -ne 0 ] || return 1
+    [[ "$output" == *"no asset files given"* ]] || return 1
+    [[ "$output" == *"Usage:"* ]] || return 1
+}
+
+dim "--- Behaviour ---"
+
+test "complete release: verified, nothing uploaded" test_verifies_a_complete_release_without_uploading
+test "uploads only the missing assets" test_uploads_only_the_missing_assets
+test "repairs a partial asset by size" test_repairs_a_partial_asset_by_size
+test "survives the transient upload error that failed v4.14.0-rc.6" test_survives_the_transient_upload_error
+test "survives a transient listing error" test_survives_a_transient_listing_error
+test "fails when the release does not exist" test_fails_when_the_release_does_not_exist
+test "fails when uploads never take effect" test_fails_when_uploads_never_take_effect
+test "respects the time budget" test_respects_the_time_budget
+test "reads a newline-separated manifest" test_reads_a_newline_separated_manifest
+test "rejects a missing asset file" test_rejects_a_missing_asset_file
+test "requires a tag" test_requires_a_tag
+test "requires asset files" test_requires_asset_files
+
+# ---- summary ----------------------------------------------------------
+
+echo ""
+cyan "============================================"
+if [ "$FAIL" -eq 0 ]; then
+    green " All $PASS tests passed"
+else
+    red   " $FAIL of $((PASS + FAIL)) tests failed"
+fi
+cyan "============================================"
+
+[ "$FAIL" -eq 0 ]