gowalk-cicd 1.0.0

package/action/scripts/test_team_fallback_wiring.py

@@ -0,0 +1,157 @@
+#!/usr/bin/env python3
+"""
+Tests the integration wiring for auto-derived team_id:
+
+  1. ``prepare_signing.main()`` no longer fails with "missing env var: TEAM_ID"
+     when TEAM_ID is empty; it falls back to the team Apple assigned to the
+     provisioning profile (already available via provision_all_bundles).
+
+  2. ``cfg_resolve.derive_team_if_empty`` calls team_resolver.derive_team_id
+     only when input+config yield an empty team, and emits a labeled source
+     (``derived_from_asc_key``).
+
+All ASC network calls are mocked.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import cfg_resolve  # noqa: E402
+import prepare_signing  # noqa: E402
+
+
+class PrepareSigningTeamIdOptionalTests(unittest.TestCase):
+    """prepare_signing.py: TEAM_ID env var must be optional now."""
+
+    def test_main_runs_without_team_id_when_profiles_return_team(self):
+        # Arrange: stub every external side-effect so main() can run end-to-end
+        # without a real Xcode project or ASC API.
+        env_patch = {
+            "ASC_KEY_ID": "KID",
+            "ASC_ISSUER_ID": "ISS",
+            "ASC_KEY_PATH": "/tmp/fake.p8",
+            "RUNNER_TEMP": "/tmp",
+            "PROJECT": "/tmp/fake.xcodeproj",
+            # TEAM_ID deliberately omitted — this is the bug we're fixing.
+        }
+        with mock.patch.dict(os.environ, env_patch, clear=True):
+            with mock.patch.object(prepare_signing, "make_jwt", return_value="T"):
+                with mock.patch.object(
+                    prepare_signing,
+                    "discover_signable_targets",
+                    return_value=[
+                        {
+                            "name": "App",
+                            "bundle_id": "com.example.app",
+                            "config_ids": ["C1"],
+                        }
+                    ],
+                ):
+                    with mock.patch.object(
+                        prepare_signing,
+                        "_load_or_create_cert",
+                        return_value=("CERTID", b"FAKEP12", "password", False),
+                    ):
+                        with mock.patch.object(
+                            prepare_signing,
+                            "provision_all_bundles",
+                            return_value=(
+                                [("com.example.app", "CI-com.example.app", "UUID")],
+                                "DERIVED123",  # effective_team from profile plist
+                            ),
+                        ):
+                            with mock.patch.object(
+                                prepare_signing, "patch_project_signing"
+                            ):
+                                with mock.patch.object(
+                                    prepare_signing, "setup_keychain"
+                                ):
+                                    # Act: must not raise SystemExit.
+                                    prepare_signing.main()
+
+    def test_main_fails_with_actionable_message_when_nothing_yields_team(self):
+        env_patch = {
+            "ASC_KEY_ID": "KID",
+            "ASC_ISSUER_ID": "ISS",
+            "ASC_KEY_PATH": "/tmp/fake.p8",
+            "RUNNER_TEMP": "/tmp",
+            "PROJECT": "/tmp/fake.xcodeproj",
+        }
+        with mock.patch.dict(os.environ, env_patch, clear=True):
+            with mock.patch.object(prepare_signing, "make_jwt", return_value="T"):
+                with mock.patch.object(
+                    prepare_signing,
+                    "discover_signable_targets",
+                    return_value=[
+                        {"name": "A", "bundle_id": "b", "config_ids": ["C"]}
+                    ],
+                ):
+                    with mock.patch.object(
+                        prepare_signing,
+                        "_load_or_create_cert",
+                        return_value=("CID", b"P12", "password", False),
+                    ):
+                        with mock.patch.object(
+                            prepare_signing,
+                            "provision_all_bundles",
+                            # Profile with no TeamIdentifier — impossible in
+                            # practice but we still need a graceful message.
+                            return_value=([("b", "CI-b", "UUID")], ""),
+                        ):
+                            with mock.patch.object(
+                                prepare_signing, "patch_project_signing"
+                            ):
+                                with self.assertRaises(SystemExit) as ctx:
+                                    prepare_signing.main()
+                                self.assertIn("team_id", str(ctx.exception).lower())
+
+
+class CfgResolveDeriveTeamTests(unittest.TestCase):
+    """cfg_resolve: derive_team_if_empty wires team_resolver into resolve_app."""
+
+    def test_derive_not_called_when_team_from_config(self):
+        """If config already supplies team_id, no API call is made."""
+        with mock.patch("cfg_resolve.derive_team_id") as m_derive:
+            result = cfg_resolve.derive_team_if_empty(
+                team_val="ABC123",
+                team_src="config",
+                creds={"key_id": "K", "issuer_id": "I", "key_path": "/p"},
+            )
+        self.assertEqual(result, ("ABC123", "config"))
+        m_derive.assert_not_called()
+
+    def test_derive_called_when_team_empty_emits_labeled_source(self):
+        """When team is empty, derive via ASC and label source."""
+        with mock.patch("cfg_resolve.make_jwt", return_value="T"):
+            with mock.patch(
+                "cfg_resolve.derive_team_id", return_value="DERIVED7X8"
+            ) as m_derive:
+                result = cfg_resolve.derive_team_if_empty(
+                    team_val="",
+                    team_src="empty",
+                    creds={"key_id": "K", "issuer_id": "I", "key_path": "/p"},
+                )
+        self.assertEqual(result, ("DERIVED7X8", "derived_from_asc_key"))
+        m_derive.assert_called_once_with("T")
+
+    def test_derive_keeps_empty_when_api_cant_determine(self):
+        """If ASC lookup returns empty, keep empty — prepare_signing falls back."""
+        with mock.patch("cfg_resolve.make_jwt", return_value="T"):
+            with mock.patch("cfg_resolve.derive_team_id", return_value=""):
+                result = cfg_resolve.derive_team_if_empty(
+                    team_val="",
+                    team_src="empty",
+                    creds={"key_id": "K", "issuer_id": "I", "key_path": "/p"},
+                )
+        self.assertEqual(result, ("", "empty"))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_team_resolver.py

@@ -0,0 +1,249 @@
+#!/usr/bin/env python3
+"""
+Tests for team_resolver.derive_team_id — the ASC-API-based Apple developer
+team identifier derivation used when ``team_id`` is omitted from
+``ci.config.yaml``.
+
+Runs offline: every ASC API interaction is stubbed via unittest.mock.
+"""
+
+from __future__ import annotations
+
+import base64
+import datetime
+import plistlib
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+
+# Make sibling scripts importable regardless of the pytest invocation cwd.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import team_resolver  # noqa: E402  (import-after-sys.path modification)
+
+
+def _make_dist_cert_der(team_id: str) -> bytes:
+    """Generate a throwaway DER-encoded Apple-Distribution-style cert with OU=<team_id>."""
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    subject = issuer = x509.Name(
+        [
+            x509.NameAttribute(
+                NameOID.COMMON_NAME,
+                f"Apple Distribution: Test Team ({team_id})",
+            ),
+            x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, team_id),
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Test Team"),
+            x509.NameAttribute(NameOID.COUNTRY_NAME, "US"),
+        ]
+    )
+    now = datetime.datetime.now(datetime.timezone.utc)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(issuer)
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now)
+        .not_valid_after(now + datetime.timedelta(days=365))
+        .sign(key, hashes.SHA256())
+    )
+    return cert.public_bytes(serialization.Encoding.DER)
+
+
+def _make_profile_content(team_id: str) -> bytes:
+    """Build a fake mobileprovision payload (plain plist, not CMS-signed).
+
+    team_resolver falls back to ``plistlib.loads`` directly when the payload
+    isn't a signed blob, so a raw plist is sufficient for the test path.
+    """
+    plist_dict = {
+        "AppIDName": "Test",
+        "TeamIdentifier": [team_id],
+        "Name": "CI-com.example.test",
+        "UUID": "00000000-0000-0000-0000-000000000000",
+    }
+    return plistlib.dumps(plist_dict)
+
+
+class DeriveTeamIdFromCertificateTests(unittest.TestCase):
+    """Happy path: ASC returns at least one Distribution cert."""
+
+    def test_derives_team_from_cert_ou_when_cert_exists(self):
+        team_id = "QYVMNH6654"
+        cert_der = _make_dist_cert_der(team_id)
+        cert_b64 = base64.b64encode(cert_der).decode()
+        asc_response = {
+            "data": [
+                {
+                    "id": "CERT123",
+                    "attributes": {
+                        "certificateType": "DISTRIBUTION",
+                        "certificateContent": cert_b64,
+                    },
+                }
+            ]
+        }
+        with mock.patch.object(
+            team_resolver, "get_json", return_value=asc_response
+        ) as m_get:
+            derived = team_resolver.derive_team_id("jwt-token")
+        self.assertEqual(derived, team_id)
+        m_get.assert_any_call(
+            "/certificates",
+            "jwt-token",
+            params={"limit": "1", "sort": "-id"},
+        )
+
+    def test_returns_team_even_when_cert_type_is_development(self):
+        team_id = "VD3WNXP8BH"
+        cert_der = _make_dist_cert_der(team_id)
+        cert_b64 = base64.b64encode(cert_der).decode()
+        asc_response = {
+            "data": [
+                {
+                    "id": "DEVCERT",
+                    "attributes": {
+                        "certificateType": "DEVELOPMENT",
+                        "certificateContent": cert_b64,
+                    },
+                }
+            ]
+        }
+        with mock.patch.object(team_resolver, "get_json", return_value=asc_response):
+            derived = team_resolver.derive_team_id("jwt-token")
+        self.assertEqual(derived, team_id)
+
+
+class DeriveTeamIdFromProfileFallbackTests(unittest.TestCase):
+    """Fallback when no certs exist: use an existing provisioning profile's plist."""
+
+    def test_falls_back_to_profile_when_no_certs(self):
+        team_id = "ABC1234567"
+        profile_b64 = base64.b64encode(_make_profile_content(team_id)).decode()
+        cert_response = {"data": []}
+        profile_response = {
+            "data": [
+                {
+                    "id": "PROF123",
+                    "attributes": {
+                        "name": "CI-com.example.test",
+                        "profileContent": profile_b64,
+                    },
+                }
+            ]
+        }
+
+        def fake_get_json(path, token, *, params=None):
+            if path.startswith("/certificates"):
+                return cert_response
+            if path.startswith("/profiles"):
+                return profile_response
+            raise AssertionError(f"unexpected path {path}")
+
+        with mock.patch.object(team_resolver, "get_json", side_effect=fake_get_json):
+            derived = team_resolver.derive_team_id("jwt-token")
+        self.assertEqual(derived, team_id)
+
+    def test_handles_cms_signed_profile_via_security_tool(self):
+        """Realistic profiles are CMS-signed; plistlib.loads raises.
+
+        team_resolver must shell out to ``security cms -D`` to decode them.
+        """
+        team_id = "TEAM987654"
+        # Produce a blob that plistlib.loads can't parse directly.
+        fake_cms_blob = b"\x30\x82\x01\x00" + b"NOT-A-PLIST" * 20
+        profile_response = {
+            "data": [
+                {
+                    "id": "P1",
+                    "attributes": {
+                        "name": "CI-com.example.test",
+                        "profileContent": base64.b64encode(fake_cms_blob).decode(),
+                    },
+                }
+            ]
+        }
+
+        def fake_get_json(path, token, *, params=None):
+            if path.startswith("/certificates"):
+                return {"data": []}
+            return profile_response
+
+        decoded_plist = plistlib.dumps({"TeamIdentifier": [team_id]})
+
+        def fake_check_output(args, *a, **kw):
+            # args[0] == "security", args[1:3] == ("cms", "-D")
+            self.assertEqual(args[0], "security")
+            self.assertIn("cms", args)
+            return decoded_plist
+
+        with mock.patch.object(team_resolver, "get_json", side_effect=fake_get_json):
+            with mock.patch.object(
+                subprocess, "check_output", side_effect=fake_check_output
+            ):
+                derived = team_resolver.derive_team_id("jwt-token")
+        self.assertEqual(derived, team_id)
+
+
+class DeriveTeamIdFailureTests(unittest.TestCase):
+    """Absolute failure path — no certs AND no profiles."""
+
+    def test_returns_empty_when_neither_cert_nor_profile_found(self):
+        def fake_get_json(path, token, *, params=None):
+            return {"data": []}
+
+        with mock.patch.object(team_resolver, "get_json", side_effect=fake_get_json):
+            derived = team_resolver.derive_team_id("jwt-token")
+        self.assertEqual(derived, "")
+
+    def test_returns_empty_on_certificate_without_ou(self):
+        """Malformed cert with no OU attribute — must not crash, must return ''."""
+        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        subject = x509.Name(
+            [x509.NameAttribute(NameOID.COMMON_NAME, "Malformed")]
+        )
+        now = datetime.datetime.now(datetime.timezone.utc)
+        cert = (
+            x509.CertificateBuilder()
+            .subject_name(subject)
+            .issuer_name(subject)
+            .public_key(key.public_key())
+            .serial_number(1)
+            .not_valid_before(now)
+            .not_valid_after(now + datetime.timedelta(days=30))
+            .sign(key, hashes.SHA256())
+        )
+        cert_b64 = base64.b64encode(
+            cert.public_bytes(serialization.Encoding.DER)
+        ).decode()
+        cert_response = {
+            "data": [
+                {
+                    "id": "BAD",
+                    "attributes": {
+                        "certificateType": "DISTRIBUTION",
+                        "certificateContent": cert_b64,
+                    },
+                }
+            ]
+        }
+
+        def fake_get_json(path, token, *, params=None):
+            if path.startswith("/certificates"):
+                return cert_response
+            return {"data": []}
+
+        with mock.patch.object(team_resolver, "get_json", side_effect=fake_get_json):
+            derived = team_resolver.derive_team_id("jwt-token")
+        self.assertEqual(derived, "")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/tests_common.py

@@ -0,0 +1,167 @@
+#!/usr/bin/env python3
+"""
+Shared test helpers for the manage_marketing_version test suite.
+
+Imports the production module via `manage_marketing_version` so test
+patches at the `mmv` namespace propagate through helper code paths
+(``mmv.fetch_versions``, ``mmv.get_combined_floor``, etc. are seam
+re-exports the helpers exercise late-bound).
+"""
+
+from __future__ import annotations
+
+import io
+import os
+import sys
+from contextlib import redirect_stderr
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import manage_marketing_version as mmv  # noqa: E402
+
+
+def _v(version: str, state: str, vid: str = "", created: str = "") -> dict:
+    """Build a minimal versions-list entry matching fetch_versions() shape."""
+    return {
+        "versionString": version,
+        "state": state,
+        "id": vid or f"id-{version}-{state}",
+        "createdDate": created,
+    }
+
+
+class _Env:
+    """Scoped override of an env var so tests don't leak state."""
+
+    def __init__(self, name: str, value: str | None) -> None:
+        self._name = name
+        self._value = value
+        self._prev: str | None = None
+        self._had: bool = False
+
+    def __enter__(self) -> "_Env":
+        self._had = self._name in os.environ
+        self._prev = os.environ.get(self._name)
+        if self._value is None:
+            os.environ.pop(self._name, None)
+        else:
+            os.environ[self._name] = self._value
+        return self
+
+    def __exit__(self, *_exc) -> None:
+        if self._had:
+            os.environ[self._name] = self._prev or ""
+        else:
+            os.environ.pop(self._name, None)
+
+
+_BUILD_SETTING_TOKENS = (
+    "project.yml", "Info.plist", "xcconfig",
+    "MARKETING_VERSION", "CFBundleShortVersionString",
+)
+
+
+def _assert_mentions_build_setting_source(test, stderr: str) -> None:
+    """The cross-check error message MUST name at least one build-setting
+    source so the user knows what to edit in their project."""
+    test.assertTrue(
+        any(tok in stderr for tok in _BUILD_SETTING_TOKENS),
+        f"error must reference a build-setting source; got {stderr!r}",
+    )
+
+
+def _patch_floor(
+    ground_truth: str | None,
+    combined_floor: str | None = None,
+    *,
+    per_source: dict[str, str | None] | None = None,
+):
+    """Context-manager bundle for the two mmv-level floor seams. Tests use
+    this to control what _assert_above_ground_truth sees without reaching
+    into asc_version_fetch.
+
+    `per_source` overrides the per-source breakdown surfaced in the
+    error message; defaults to attributing the floor to appStoreVersions
+    only so legacy tests stay green."""
+    cf = combined_floor if combined_floor is not None else ground_truth
+    breakdown = per_source if per_source is not None else {
+        "appStoreVersions": cf,
+        "preReleaseVersions": None,
+        "buildsViaPreRelease": None,
+    }
+    return (
+        mock.patch.object(mmv, "get_ground_truth_floor", return_value=ground_truth),
+        mock.patch.object(mmv, "get_combined_floor", return_value=(cf, breakdown)),
+    )
+
+
+def _run_decide_for_version(
+    target_version: str,
+    versions: list[dict],
+    *,
+    new_id: str = "new-created-id",
+    ground_truth: str | None = None,
+    combined_floor: str | None = None,
+    per_source: dict[str, str | None] | None = None,
+):
+    """
+    Invoke decide_for_version() with create_or_reuse stubbed to return
+    `new_id`. Returns (result, stderr_text, create_calls).
+
+    `combined_floor` controls what mmv.get_combined_floor returns; if None,
+    `ground_truth` doubles as the combined value too. `per_source` lets the
+    test inject a real breakdown so message-content assertions can verify
+    the binding-source name actually surfaces (the production path).
+    """
+    buf = io.StringIO()
+    gt_patch, cf_patch = _patch_floor(
+        ground_truth, combined_floor, per_source=per_source,
+    )
+    with mock.patch.object(
+                mmv, "create_or_reuse_with_stale", return_value=new_id) as cor, \
+            gt_patch, cf_patch, \
+            redirect_stderr(buf):
+        result = mmv.decide_for_version(
+            target_version, versions, app_id="111", token="tok"
+        )
+    return result, buf.getvalue(), cor.call_args_list
+
+
+def _assert_decide_exits(
+    test, target: str, versions: list[dict],
+    *, ground_truth: str | None, combined_floor: str | None = None,
+    per_source: dict[str, str | None] | None = None,
+    expected_code: int = 2,
+) -> str:
+    """Run decide_for_version expecting SystemExit. Returns the stderr text
+    so the caller can make message-content assertions."""
+    buf = io.StringIO()
+    gt_patch, cf_patch = _patch_floor(
+        ground_truth, combined_floor, per_source=per_source,
+    )
+    with gt_patch, cf_patch, redirect_stderr(buf):
+        with test.assertRaises(SystemExit) as ctx:
+            mmv.decide_for_version(target, versions, app_id="111", token="tok")
+    test.assertEqual(ctx.exception.code, expected_code)
+    return buf.getvalue()
+
+
+class _FakeResponse:
+    """Minimal stand-in for requests.Response."""
+
+    def __init__(self, payload: dict, status_code: int = 200) -> None:
+        self._payload = payload
+        self.status_code = status_code
+        self.text = ""
+
+    def json(self) -> dict:
+        return self._payload
+
+
+def _mk_prerelease_entry(version: str, pid: str = "") -> dict:
+    return {
+        "id": pid or f"pr-{version}",
+        "attributes": {"version": version, "platform": "IOS"},
+    }