check-opencloud-security 1.22.2__tar.gz → 1.22.4__tar.gz

{check_opencloud_security-1.22.2 → check_opencloud_security-1.22.4}/CHANGELOG.md

@@ -12,6 +12,35 @@ entry to `RELEASE.md` and uses it as the body of the GitHub release.
 
 ## [Unreleased]
 
+## [1.22.4] - 2026-09-13
+
+### Changed
+
+- **A pull request documents itself in `CHANGELOG.md` alone.**
+  `scripts/check_pull_request.py` no longer requires `RELEASE.md` to change or
+  its heading to name the version in `pyproject.toml`, and the test that
+  compared the two in the repository is gone. The release workflow writes
+  `RELEASE.md` from `## [Unreleased]` and overwrites it, so an entry copied
+  there by hand was discarded, and between a bump and its release the file
+  rightly still names the last release - which failed the suite on a branch
+  with nothing wrong in it. `AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md` and the
+  pull request template now say to leave it to the release. See ADR 0048.
+
+### Fixed
+
+- **A Docker setup wizard downloaded on its own writes the Authentik
+  blueprints.** `docker/README.md` says to `curl` just `setup-wizard.py`, but
+  the wizard copied the blueprints from a checkout beside it and skipped any
+  it could not find without a word. The generated stack mounted
+  `./authentik/blueprints` anyway, Docker created it empty, and Authentik
+  started with no provider: `/mcp` refused every token, and the forward auth
+  in front of `/admin` answered 404, which nginx turns into a 500. The wizard
+  now carries the four blueprints itself, generated into it from
+  `authentik/blueprints/` by `scripts/embed_wizard_blueprints.py`, and a test
+  fails when the embedded copies differ from those files. A deployment set up
+  with an earlier download gets them by re-running the wizard.
+- Fixed version bump.
+
 ## [1.22.2] - 2026-09-13
 
 ### Added

{check_opencloud_security-1.22.2 → check_opencloud_security-1.22.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: check-opencloud-security
-Version: 1.22.2
+Version: 1.22.4
 Summary: Check the security level of your OpenCloud instance with a built-in scanner - no API access required
 Project-URL: Homepage, https://github.com/sowoi/check-opencloud-security
 Project-URL: Live demo, https://scan.okxo.de

{check_opencloud_security-1.22.2 → check_opencloud_security-1.22.4}/adr/README.md

@@ -51,9 +51,10 @@ project. Read the accepted records that affect an area before changing it.
 | [0042](0042-every-resolved-address-is-compared-only-when-the-operator-asks.md) | Every resolved address is compared only when the operator asks | Accepted |
 | [0043](0043-an-operators-exclusion-outranks-every-allowance.md) | An operator's exclusion outranks every allowance | Accepted |
 | [0044](0044-the-operator-area-may-write-the-exclusions.md) | The operator's area may write the exclusions, and nothing else | Accepted |
-| [0045](0045-a-release-is-rehearsed-on-the-pull-request-and-publishes-last.md) | A release is rehearsed on the pull request and publishes last | Accepted; its pull request policy superseded by ADR 0046 |
-| [0046](0046-a-release-needs-no-label-and-the-pull-request-policy-is-local.md) | A release needs no label, and the pull request policy is local | Accepted |
+| [0045](0045-a-release-is-rehearsed-on-the-pull-request-and-publishes-last.md) | A release is rehearsed on the pull request and publishes last | Accepted; its pull request policy superseded by ADR 0046, its `RELEASE.md` requirement by ADR 0048 |
+| [0046](0046-a-release-needs-no-label-and-the-pull-request-policy-is-local.md) | A release needs no label, and the pull request policy is local | Accepted; its `RELEASE.md` requirement superseded by ADR 0048 |
 | [0047](0047-the-bundled-provider-requires-a-second-factor-and-provisions-its-accounts.md) | The bundled provider requires a second factor and provisions its accounts | Accepted |
+| [0048](0048-release-md-is-written-by-the-release-not-by-a-pull-request.md) | RELEASE.md is written by the release, not by a pull request | Accepted |
 
 ## Writing a new record
 

{check_opencloud_security-1.22.2 → check_opencloud_security-1.22.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "check-opencloud-security"
-version = "1.22.2"
+version = "1.22.4"
 description = "Check the security level of your OpenCloud instance with a built-in scanner - no API access required"
 authors = [{ name = "Massoud Ahmed" }]
 requires-python = ">=3.10"

{check_opencloud_security-1.22.2 → check_opencloud_security-1.22.4}/tests/test_check_pull_request.py

@@ -1,7 +1,7 @@
 """Tests for scripts/check_pull_request.py.
 
 Two rules used to live only as checkboxes in the pull request template: that
-every change is written up in CHANGELOG.md and RELEASE.md, and that a version
+every change is written up in CHANGELOG.md, and that a version
 bump - which publishes to PyPI the moment it lands - moves forward and says
 what it is. These tests hold the script that checks them to failing when it
 should, and to staying quiet when it should.
@@ -52,13 +52,12 @@ RELEASE = "## check-opencloud-security {version}\n\n{body}\n"
 def documented(**overrides: object) -> dict:
     """A pull request that documents itself, so a test can break one thing."""
     arguments: dict = {
-        "changed_files": ["webapp/app.py", "CHANGELOG.md", "RELEASE.md"],
+        "changed_files": ["webapp/app.py", "CHANGELOG.md"],
         "labels": set(),
         "author": "a-contributor",
         "version": "1.1.0",
         "base_changelog": CHANGELOG.format(unreleased=""),
         "head_changelog": CHANGELOG.format(unreleased="### Fixed\n\n- A thing."),
-        "head_release": RELEASE.format(version="1.1.0", body="- A thing."),
     }
     arguments.update(overrides)
     return arguments
@@ -108,21 +107,18 @@ def test_an_entry_under_the_declared_version_counts():
     assert script.check_changelog(**documented(base_changelog=base, head_changelog=head)) == []
 
 
-def test_a_change_missing_from_release_md_is_refused():
-    """AGENTS.md asks for both files; the release body comes from the second."""
-    problems = script.check_changelog(**documented(changed_files=["webapp/app.py", "CHANGELOG.md"]))
-
-    assert any("RELEASE.md is unchanged" in p for p in problems)
-    assert not any("CHANGELOG.md" in p and "no new entry" in p for p in problems)
-
-
-def test_release_md_written_for_another_version_is_refused():
-    """Entries under a stale heading are notes for a release that already went out."""
+def test_release_md_is_not_asked_of_a_pull_request():
+    """The release workflow writes RELEASE.md from the changelog and overwrites it."""
+    assert script.check_changelog(**documented()) == []
+    # Touching it is not a substitute for the changelog entry it is written from.
     problems = script.check_changelog(
-        **documented(head_release=RELEASE.format(version="1.0.0", body="- A thing."))
+        **documented(
+            changed_files=["webapp/app.py", "RELEASE.md"],
+            head_changelog=CHANGELOG.format(unreleased=""),
+        )
     )
-
-    assert any("RELEASE.md is written for 1.0.0" in p for p in problems)
+    assert any("CHANGELOG.md has no new entry" in p for p in problems)
+    assert not any("RELEASE.md" in p for p in problems)
 
 
 @pytest.mark.parametrize(
@@ -196,14 +192,6 @@ def test_the_project_version_ignores_other_tables():
     assert script.project_version(PYPROJECT.format(version="1.2.3")) == "1.2.3"
 
 
-def test_the_repository_documents_releases_under_the_heading_the_check_reads():
-    """Checked against the real files, so a renamed heading fails here, not on every pull request."""
-    pyproject = (REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8")
-    release = (REPO_ROOT / "RELEASE.md").read_text(encoding="utf-8")
-
-    assert script.release_heading_version(release) == script.project_version(pyproject)
-
-
 # --- the whole script, against a real repository -----------------------------
 
 
@@ -236,11 +224,13 @@ def test_the_script_passes_a_documented_bump_end_to_end(repo, capsys):
     """Everything wired together: diff, versions, tags and commit subjects."""
     (repo / "app.py").write_text("x = 2\n", encoding="utf-8")
     (repo / "CHANGELOG.md").write_text(CHANGELOG.format(unreleased="### Fixed\n\n- x."), encoding="utf-8")
-    (repo / "RELEASE.md").write_text(RELEASE.format(version="1.0.0", body="- First.\n- x."), encoding="utf-8")
     _git(repo, "commit", "-qam", "fix: x")
     (repo / "pyproject.toml").write_text(PYPROJECT.format(version="1.1.0"), encoding="utf-8")
-    (repo / "RELEASE.md").write_text(RELEASE.format(version="1.1.0", body="- x."), encoding="utf-8")
     _git(repo, "commit", "-qam", "chore(release): bump to version 1.1.0")
+    # RELEASE.md still describes 1.0.0, as it does until the release rewrites it.
+    assert (repo / "RELEASE.md").read_text(encoding="utf-8").startswith(
+        "## check-opencloud-security 1.0.0"
+    )
 
     assert script.main(["--base", "main"]) == 0
     assert "version 1.1.0 is in order" in capsys.readouterr().out
@@ -250,7 +240,6 @@ def test_the_script_refuses_a_mislabelled_bump_commit_end_to_end(repo, capsys):
     """The subject check reads the version each commit actually set, from git."""
     (repo / "CHANGELOG.md").write_text(CHANGELOG.format(unreleased="### Fixed\n\n- x."), encoding="utf-8")
     (repo / "pyproject.toml").write_text(PYPROJECT.format(version="1.1.0"), encoding="utf-8")
-    (repo / "RELEASE.md").write_text(RELEASE.format(version="1.1.0", body="- x."), encoding="utf-8")
     _git(repo, "commit", "-qam", "Bump to version 1.3.3")
 
     assert script.main(["--base", "main"]) == 1

{check_opencloud_security-1.22.2 → check_opencloud_security-1.22.4}/tests/test_docker_wizard.py

@@ -437,7 +437,9 @@ def test_the_wizard_names_no_real_host(tmp_path: Path) -> None:
     """Placeholders only, in the questions as well as in the generated files."""
     import re
 
-    source = WIZARD_PATH.read_text(encoding="utf-8")
+    # Without escapes: the embedded blueprints carry redirect URIs as regular
+    # expressions, and `127\.0\.0\.1` is still the loopback address.
+    source = WIZARD_PATH.read_text(encoding="utf-8").replace("\\", "")
     allowed = {
         "127.0.0.1",
         "0.0.0.0",
@@ -581,6 +583,81 @@ def test_the_blueprint_travels_beside_the_compose_file_that_mounts_it(
     assert not (tmp_path / "plain" / "authentik").exists()
 
 
+def test_a_wizard_downloaded_on_its_own_still_writes_every_blueprint(
+    tmp_path: Path,
+) -> None:
+    """The README says to curl the one file; the blueprints must not need a checkout."""
+    download = tmp_path / "download"
+    download.mkdir()
+    lone_wizard = download / "setup-wizard.py"
+    lone_wizard.write_bytes(WIZARD_PATH.read_bytes())
+    assert not (tmp_path / "authentik").exists()
+
+    spec = importlib.util.spec_from_file_location("lone_setup_wizard", lone_wizard)
+    assert spec and spec.loader
+    lone = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = lone
+    try:
+        spec.loader.exec_module(lone)
+        setup = lone.Setup(
+            enable_mcp=True,
+            mcp_auth_enabled=True,
+            admin_enabled=True,
+            admin_users="okko",
+            deploy_authentik=True,
+            public_base_url="https://scan.example.com",
+        )
+        lone._generate_unattended(setup)
+        lone._finalise(setup)
+        output = tmp_path / "deployment"
+        written = lone.write_files(
+            setup, output / "docker-compose.yml", output / ".env"
+        )
+    finally:
+        del sys.modules[spec.name]
+
+    repository_blueprints = WIZARD_PATH.parent.parent / "authentik" / "blueprints"
+    blueprints = output / "authentik" / "blueprints"
+    names = sorted(path.name for path in blueprints.iterdir())
+    assert names == [
+        "opencloud-admin.yaml",
+        "opencloud-enrollment.yaml",
+        "opencloud-mfa.yaml",
+        "opencloud-scanner.yaml",
+    ]
+    for name in names:
+        assert (blueprints / name).read_text(encoding="utf-8") == (
+            repository_blueprints / name
+        ).read_text(encoding="utf-8")
+        assert any(item.endswith(name) for item in written)
+    # Nothing was read from, or written to, where a checkout would have been.
+    assert not (tmp_path / "authentik").exists()
+
+
+def test_the_embedded_blueprints_are_the_ones_in_the_repository() -> None:
+    """A blueprint edited without re-embedding would ship the old one to every download."""
+    spec = importlib.util.spec_from_file_location(
+        "embed_wizard_blueprints",
+        WIZARD_PATH.parent.parent / "scripts" / "embed_wizard_blueprints.py",
+    )
+    assert spec and spec.loader
+    embed = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(embed)
+
+    assert embed.is_current(), "run python scripts/embed_wizard_blueprints.py"
+
+    # And the check does notice a block that has fallen behind: an edit inside
+    # it is what regenerating puts right, and nothing outside it is touched.
+    source = WIZARD_PATH.read_text(encoding="utf-8")
+    block_start = source.index(embed.START_MARKER)
+    stale = source[:block_start] + source[block_start:].replace(
+        "authentik_", "stale_", 1
+    )
+    assert stale != source
+    assert embed.render_wizard(stale) == source
+    assert set(wizard_module.EMBEDDED_BLUEPRINTS) == set(embed.BLUEPRINT_NAMES)
+
+
 def test_a_mail_server_is_configured_without_its_password_reaching_the_compose_file(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None: