vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Blame · server/artifacts_test.go

Line attribution on main · 180 line(s)

View file History

213f4d6d Keenan Nemetz 17d ago	1	package server_test
	2
	3	// Workflow artifacts, end to end: a push declares outputs, a real runner expands
	4	// the patterns in its checkout, uploads the bytes over SSH, and reports them with
	5	// the result. The run page and the download are then read-only, like everything
	6	// else on the web.
	7
	8	import (
	9	"io"
	10	"net/http"
	11	"path/filepath"
	12	"strings"
	13	"testing"
	14	"time"
	15
d37d301f Keenan Nemetz 19h ago	16	"rodent.software/vole/ci/runs"
	17	"rodent.software/vole/forge"
	18	"rodent.software/vole/forge/config"
213f4d6d Keenan Nemetz 17d ago	19	)
	20
	21	func artifactWorkflow() map[string]string {
	22	return workflowFile(`version: 1
	23	jobs:
	24	build:
70b70264 Keenan Nemetz 15d ago	25	image: alpine:3.22
213f4d6d Keenan Nemetz 17d ago	26	steps:
	27	- name: build two files
	28	run: mkdir -p dist && printf 'binary bytes\n' > dist/tool-linux && printf 'notes\n' > dist/NOTES.txt
	29	artifacts:
	30	- path: dist/*
	31	`)
	32	}
	33
	34	func TestWorkflowArtifactsArePublished(t *testing.T) {
44530e74 Keenan Nemetz 16d ago	35	t.Parallel()
213f4d6d Keenan Nemetz 17d ago	36	f := newFixtureWith(t, func(c *config.Config) { c.LeaseSeconds = 5 })
	37	f.publish(f.repo)
	38
	39	work := workRepo(t, artifactWorkflow())
	40	if _, errs, err := f.git(work, "push", f.sshURL(f.repo), "main:refs/heads/main"); err != nil {
	41	t.Fatalf("push: %s", errs)
	42	}
	43	f.waitForRun(t, 5time.Second, func(r runs.Run) bool { return r.Status == runs.StatusQueued })
	44	f.runOnce(t)
	45
	46	done := f.waitForRun(t, 10time.Second, func(r runs.Run) bool { return r.Status != runs.StatusQueued && r.Status != runs.StatusRunning })
	47	if done.Status != runs.StatusSuccess {
	48	t.Fatalf("run status = %s (exit %d)", done.Status, done.ExitCode)
	49	}
	50	arts, err := f.srv.Runs.Artifacts(done.ID)
	51	if err != nil {
	52	t.Fatal(err)
	53	}
	54	if len(arts) != 2 \|\| arts[0].Name != "NOTES.txt" \|\| arts[1].Name != "tool-linux" {
	55	t.Fatalf("published %+v, want the two files from dist/", arts)
	56	}
	57
	58	// The run page names them, so a download has a description of its build.
ed03b3d1 Keenan Nemetz 6h ago	59	code, page := f.get("/" + f.repo + "/runs/" + done.ID)
213f4d6d Keenan Nemetz 17d ago	60	if code != 200 {
	61	t.Fatalf("run page = %d", code)
	62	}
	63	for _, want := range []string{"tool-linux", "NOTES.txt", "download", done.Job} {
	64	if !strings.Contains(page, want) {
	65	t.Fatalf("run page does not show %q:\n%s", want, page)
	66	}
	67	}
	68
	69	// The bytes come back out of the store, with the object id as the validator.
ed03b3d1 Keenan Nemetz 6h ago	70	url := f.http.URL + "/" + f.repo + "/runs/" + done.ID + "/artifacts/tool-linux"
213f4d6d Keenan Nemetz 17d ago	71	resp, err := http.Get(url)
	72	if err != nil {
	73	t.Fatal(err)
	74	}
	75	body, _ := io.ReadAll(resp.Body)
	76	resp.Body.Close()
	77	if resp.StatusCode != 200 \|\| string(body) != "binary bytes\n" {
	78	t.Fatalf("artifact download = %d %q", resp.StatusCode, body)
	79	}
	80	if got, want := resp.Header.Get("ETag"), `"`+arts[1].OID+`"`; got != want {
	81	t.Fatalf("ETag = %q, want %q", got, want)
	82	}
	83	if cd := resp.Header.Get("Content-Disposition"); !strings.Contains(cd, "attachment") {
	84	t.Fatalf("Content-Disposition = %q", cd)
	85	}
	86	req, _ := http.NewRequest(http.MethodGet, url, nil)
	87	req.Header.Set("If-None-Match", `"`+arts[1].OID+`"`)
	88	again, err := http.DefaultClient.Do(req)
	89	if err != nil {
	90	t.Fatal(err)
	91	}
	92	again.Body.Close()
	93	if again.StatusCode != http.StatusNotModified {
	94	t.Fatalf("conditional artifact request = %d, want 304", again.StatusCode)
	95	}
	96
ed03b3d1 Keenan Nemetz 6h ago	97	if code, _ := f.get("/" + f.repo + "/runs/" + done.ID + "/artifacts/nope"); code != 404 {
213f4d6d Keenan Nemetz 17d ago	98	t.Fatalf("unknown artifact = %d, want 404", code)
	99	}
	100	// The repository page links the run, so the artifacts are reachable by clicking.
ed03b3d1 Keenan Nemetz 6h ago	101	if _, repoPage := f.get("/" + f.repo); !strings.Contains(repoPage, "/runs/"+done.ID) {
213f4d6d Keenan Nemetz 17d ago	102	t.Fatalf("repository page does not link the run:\n%s", repoPage)
	103	}
	104	}
	105
	106	// TestRunArtifactsSurviveTheSweep pins the reachability rule: nothing in git names
	107	// a build output, so the run queue is the only thing keeping it.
	108	func TestRunArtifactsSurviveTheSweep(t *testing.T) {
44530e74 Keenan Nemetz 16d ago	109	t.Parallel()
213f4d6d Keenan Nemetz 17d ago	110	f := newFixtureWith(t, func(c *config.Config) { c.LeaseSeconds = 5 })
	111	f.publish(f.repo)
	112	work := workRepo(t, artifactWorkflow())
	113	if _, errs, err := f.git(work, "push", f.sshURL(f.repo), "main:refs/heads/main"); err != nil {
	114	t.Fatalf("push: %s", errs)
	115	}
	116	f.waitForRun(t, 5time.Second, func(r runs.Run) bool { return r.Status == runs.StatusQueued })
	117	f.runOnce(t)
	118	done := f.waitForRun(t, 10time.Second, func(r runs.Run) bool { return r.Status == runs.StatusSuccess })
	119	arts, err := f.srv.Runs.Artifacts(done.ID)
	120	if err != nil \|\| len(arts) == 0 {
	121	t.Fatalf("no artifacts to protect: %+v %v", arts, err)
	122	}
	123
	124	oids, err := f.srv.Runs.ArtifactOIDs()
	125	if err != nil {
	126	t.Fatal(err)
	127	}
c5902451 Keenan Nemetz 16d ago	128	res, err := forge.GC(forge.GCOptions{
c5902451 Keenan Nemetz 16d ago	129	Repos: []forge.GCRepo{{Name: f.repo, Dir: filepath.Join(f.cfg.ReposDir(), f.repo+".git")}},
213f4d6d Keenan Nemetz 17d ago	130	Store: f.srv.LFS,
	131	RunOIDs: oids,
	132	Now: time.Now().Add(48 * time.Hour), // past every grace period
	133	})
	134	if err != nil {
	135	t.Fatalf("gc: %v", err)
	136	}
	137	for _, a := range arts {
65b88b3b Keenan Nemetz 16d ago	138	if !f.srv.LFS.Has(f.repo, a.OID) {
213f4d6d Keenan Nemetz 17d ago	139	t.Fatalf("gc swept run artifact %q (%+v)", a.Name, res)
	140	}
	141	}
	142	}
	143
	144	func TestRunArtifactsArePrivateForPrivateRepos(t *testing.T) {
44530e74 Keenan Nemetz 16d ago	145	t.Parallel()
213f4d6d Keenan Nemetz 17d ago	146	f := newFixtureWith(t, func(c *config.Config) { c.LeaseSeconds = 5 })
	147	// Deliberately not published: an anonymous reader may not see it exists.
	148	work := workRepo(t, artifactWorkflow())
	149	if _, errs, err := f.git(work, "push", f.sshURL(f.repo), "main:refs/heads/main"); err != nil {
	150	t.Fatalf("push: %s", errs)
	151	}
	152	f.waitForRun(t, 5time.Second, func(r runs.Run) bool { return r.Status == runs.StatusQueued })
	153	f.runOnce(t)
	154	done := f.waitForRun(t, 10time.Second, func(r runs.Run) bool { return r.Status == runs.StatusSuccess })
	155
	156	for _, path := range []string{
ed03b3d1 Keenan Nemetz 6h ago	157	"/" + f.repo + "/runs/" + done.ID,
ed03b3d1 Keenan Nemetz 6h ago	158	"/" + f.repo + "/runs/" + done.ID + "/artifacts/tool-linux",
213f4d6d Keenan Nemetz 17d ago	159	} {
	160	if code, _ := f.get(path); code != 404 {
	161	t.Fatalf("%s on a private repo = %d, want 404", path, code)
	162	}
	163	}
25343521 Keenan Nemetz 3d ago	164
	165	// An authorized reader may fetch the page and the bytes; a shared cache must
	166	// not keep either and serve it to an anonymous reader.
	167	_, cookie := f.browserSession(t, f.ownerID)
	168	for _, path := range []string{
ed03b3d1 Keenan Nemetz 6h ago	169	"/" + f.repo + "/runs/" + done.ID,
ed03b3d1 Keenan Nemetz 6h ago	170	"/" + f.repo + "/runs/" + done.ID + "/artifacts/tool-linux",
25343521 Keenan Nemetz 3d ago	171	} {
	172	resp, _ := f.browserGet(t, path, cookie)
	173	if resp.StatusCode != http.StatusOK {
	174	t.Fatalf("%s = %d, want 200 for the owner", path, resp.StatusCode)
	175	}
	176	if cc := resp.Header.Get("Cache-Control"); strings.Contains(cc, "public") {
	177	t.Fatalf("%s: Cache-Control = %q on a private repository", path, cc)
	178	}
	179	}
213f4d6d Keenan Nemetz 17d ago	180	}