yorickr/plezy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): make cross-platform checks deterministic

Browse Source
This commit is contained in:
edde746
2026-07-25 16:17:25 +02:00
parent 39ddfd2bd9
commit 77da82b648
14 changed files with 458 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check_apple_spm_locks.py
+2 -1
View File
@@ -8,6 +8,7 @@ import json
import re
from pathlib import Path
from urllib.parse import unquote, urlparse
from urllib.request import url2pathname
LOCK_PAIRS = {
"iOS": (
@@ -75,7 +76,7 @@ def _resolved_sentry_root(root: Path, errors: list[str]) -> Path | None:
uri = package["rootUri"]
parsed = urlparse(uri)
if parsed.scheme == "file":
return Path(unquote(parsed.path))
return Path(url2pathname(parsed.path))
if parsed.scheme:
errors.append(f"{config_path}: unsupported sentry_flutter root URI {uri!r}")
return None
scripts/ci_checks.sh
+1
View File
@@ -104,6 +104,7 @@ if python3 scripts/check_build_workflow.py &&
python3 scripts/test_run_maestro.py &&
python3 scripts/test_maestro_flow_contracts.py &&
python3 scripts/test_maestro_jellyfin_proxy.py &&
python3 scripts/test_maestro_real_jellyfin.py &&
python3 scripts/test_check_icon_consistency.py; then
ok "workflow and script guards passed"
else
scripts/ci_website_checks.sh
+1
View File
@@ -5,6 +5,7 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR/website"
bun install --frozen-lockfile
bun run test
bun run check
bun run build
python3 "$ROOT_DIR/scripts/test_check_bun_audit.py"
scripts/generate_relay_protocol.py
+1 -1
View File
@@ -143,7 +143,7 @@ def main() -> None:
spec = json.loads(SPEC_PATH.read_text(encoding="utf-8"))
dart_output = dart_source(spec)
go_output = go_source(spec)
DART_PATH.write_text(dart_output, encoding="utf-8")
DART_PATH.write_text(dart_output, encoding="utf-8", newline="\n")
GO_PATH.write_text(go_output, encoding="utf-8")
scripts/run_maestro_ci.py
+57 -6
View File
@@ -1,9 +1,10 @@
#!/usr/bin/env python3
"""Run the Maestro groups assigned to each CI emulator."""
"""Run automatic Maestro groups and guarded destructive manual targets."""
from __future__ import annotations
import argparse
import sys
from collections.abc import Sequence
import run_maestro
@@ -104,6 +105,30 @@ GROUPS: dict[str, tuple[tuple[str, ...], ...]] = {
}
DESTRUCTIVE_MANUAL_TARGETS: dict[str, tuple[tuple[str, ...], ...]] = {
"profile-regressions": (
(
"basic",
"--flow",
".maestro/regression_flows/01_profile_switch_isolation.yaml",
"--jellyfin-log",
"build/maestro-profile-regressions/profile-switch-isolation-jellyfin.log",
"--diagnostics-dir",
"build/maestro-profile-regressions/profile-switch-isolation-diagnostics",
),
(
"basic",
"--flow",
".maestro/regression_flows/02_profile_teardown.yaml",
"--jellyfin-log",
"build/maestro-profile-regressions/profile-teardown-jellyfin.log",
"--diagnostics-dir",
"build/maestro-profile-regressions/profile-teardown-diagnostics",
),
),
}
def run_android_15_instrumentation() -> None:
print("==> Android 15 filtered instrumentation", flush=True)
run_maestro._run_checked(
@@ -119,9 +144,9 @@ def run_android_15_instrumentation() -> None:
)
def run_group(name: str) -> int:
def run_recipes(recipes: tuple[tuple[str, ...], ...]) -> int:
failed = False
for arguments in GROUPS[name]:
for arguments in recipes:
print(f"==> Maestro {' '.join(arguments)}", flush=True)
exit_status = run_maestro.main(arguments)
if exit_status >= 128:
@@ -130,7 +155,21 @@ def run_group(name: str) -> int:
return 1 if failed else 0
def run_target(name: str) -> int:
def run_group(name: str) -> int:
return run_recipes(GROUPS[name])
def run_target(name: str, *, disposable_emulator: bool = False) -> int:
if name in DESTRUCTIVE_MANUAL_TARGETS:
if not disposable_emulator:
print(
f"Refusing destructive manual target {name!r}: "
"re-run with --disposable-emulator only on a disposable emulator.",
file=sys.stderr,
)
return 2
print(f"==> DESTRUCTIVE manual Maestro target: {name}", flush=True)
return run_recipes(DESTRUCTIVE_MANUAL_TARGETS[name])
if name == ANDROID_15_INSTRUMENTATION_TARGET:
run_android_15_instrumentation()
return 0
@@ -139,9 +178,21 @@ def run_target(name: str) -> int:
def main(argv: Sequence[str] | None = None) -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("target", choices=(*GROUPS, ANDROID_15_INSTRUMENTATION_TARGET))
parser.add_argument(
"target",
choices=(
*GROUPS,
ANDROID_15_INSTRUMENTATION_TARGET,
*DESTRUCTIVE_MANUAL_TARGETS,
),
)
parser.add_argument(
"--disposable-emulator",
action="store_true",
help="opt in to a destructive manual target on a disposable emulator",
)
args = parser.parse_args(argv)
return run_target(args.target)
return run_target(args.target, disposable_emulator=args.disposable_emulator)
if __name__ == "__main__":
scripts/test_check_apple_spm_locks.py
+8 -3
View File
@@ -29,14 +29,14 @@ class AppleSpmLockCheckerTest(unittest.TestCase):
def tearDown(self) -> None:
self.temporary.cleanup()
def _write_package_config(self) -> None:
def _write_package_config(self, root_uri: str = "../packages/sentry_flutter") -> None:
path = self.root / ".dart_tool/package_config.json"
path.parent.mkdir(parents=True)
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(
json.dumps(
{
"configVersion": 2,
"packages": [{"name": "sentry_flutter", "rootUri": "../packages/sentry_flutter"}],
"packages": [{"name": "sentry_flutter", "rootUri": root_uri}],
}
),
encoding="utf-8",
@@ -84,6 +84,11 @@ class AppleSpmLockCheckerTest(unittest.TestCase):
self.assertEqual(0, completed.returncode, completed.stdout + completed.stderr)
self.assertIn("Apple SwiftPM locks match", completed.stdout)
def test_absolute_file_uri_resolves_sentry_manifests(self) -> None:
self._write_package_config((self.root / "packages/sentry_flutter").resolve().as_uri())
self.assertEqual([], CHECKER.validate(self.root))
def test_reports_project_workspace_version_mismatch(self) -> None:
workspace = CHECKER.LOCK_PAIRS["iOS"][1]
self._write_lock(workspace, "8.58.0", "old")
scripts/test_check_codegen.py
+65 -21
View File
@@ -29,71 +29,97 @@ def executable(path: Path, contents: str) -> None:
class CodegenCheckTest(unittest.TestCase):
def setUp(self) -> None:
self.temp = tempfile.TemporaryDirectory()
self.root = Path(self.temp.name)
temporary_root = Path(self.temp.name)
repository = temporary_root / "repository"
repository.mkdir()
self.codegen_temp = Path(tempfile.mkdtemp(prefix="plezy-codegen-test-temp-"))
subprocess.run(["git", "init", "-q", str(self.root)], check=True)
subprocess.run(["git", "config", "user.email", "fixture@example.invalid"], cwd=self.root, check=True)
subprocess.run(["git", "config", "user.name", "Fixture"], cwd=self.root, check=True)
subprocess.run(["git", "init", "-q"], cwd=repository, check=True)
subprocess.run(["git", "config", "user.email", "fixture@example.invalid"], cwd=repository, check=True)
subprocess.run(["git", "config", "user.name", "Fixture"], cwd=repository, check=True)
subprocess.run(["git", "config", "core.autocrlf", "false"], cwd=repository, check=True)
(self.root / "scripts").mkdir()
shutil.copy2(SCRIPT_DIR / "codegen.sh", self.root / "scripts" / "codegen.sh")
shutil.copy2(SCRIPT_DIR / "check_codegen.py", self.root / "scripts" / "check_codegen.py")
(self.root / "scripts" / "generate_relay_protocol.py").write_text("fixture\n", encoding="utf-8")
(self.root / "source.txt").write_text("version one\n", encoding="utf-8")
shutil.copy2(SCRIPT_DIR.parent / ".gitattributes", repository / ".gitattributes")
(repository / "scripts").mkdir()
shutil.copy2(SCRIPT_DIR / "codegen.sh", repository / "scripts" / "codegen.sh")
shutil.copy2(SCRIPT_DIR / "check_codegen.py", repository / "scripts" / "check_codegen.py")
(repository / "scripts" / "generate_relay_protocol.py").write_text("fixture\n", encoding="utf-8")
(repository / "source.txt").write_text("version one\n", encoding="utf-8")
for relative in GENERATED_PATHS:
path = self.root / relative
path = repository / relative
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text("version one\n", encoding="utf-8")
self.bin = self.root / "fake-bin"
self.bin = temporary_root / "fake-bin"
self.bin.mkdir()
executable(
self.bin / "python3",
"""#!/usr/bin/env bash
write_lf() { tr -d '\\r' < source.txt > "$1"; }
if [[ "$1" == *check_codegen.py ]]; then exec "$REAL_PYTHON" "$@"; fi
mkdir -p lib/watch_together/services server
cp source.txt lib/watch_together/services/relay_protocol.g.dart
write_lf lib/watch_together/services/relay_protocol.g.dart
cp source.txt server/relay_protocol_gen.go
""",
)
executable(
self.bin / "dart",
"""#!/usr/bin/env bash
write_lf() { tr -d '\\r' < source.txt > "$1"; }
if [ "${FAIL_DART:-0}" -ne 0 ]; then exit "$FAIL_DART"; fi
case "$*" in
*"generate_ducet_ranks.dart")
mkdir -p lib/data
cp source.txt lib/data/ducet_order.dart
write_lf lib/data/ducet_order.dart
;;
*"generate_hid_key_labels.dart")
mkdir -p lib/data
cp source.txt lib/data/hid_key_labels.dart
write_lf lib/data/hid_key_labels.dart
;;
*"generate_iso_639_data.dart")
mkdir -p lib/data
cp source.txt lib/data/iso_639_data.dart
write_lf lib/data/iso_639_data.dart
;;
"run slang")
mkdir -p lib/i18n
cp source.txt lib/i18n/strings.g.dart
write_lf lib/i18n/strings.g.dart
;;
*"build_runner"*)
mkdir -p lib/models
cp source.txt lib/models/model.g.dart
cp source.txt lib/models/model.freezed.dart
write_lf lib/models/model.g.dart
write_lf lib/models/model.freezed.dart
printf '%s\n' "$*" > build-runner-args.txt
;;
esac
""",
)
subprocess.run(["git", "add", "."], cwd=self.root, check=True)
subprocess.run(["git", "commit", "-qm", "fixture"], cwd=self.root, check=True)
subprocess.run(
["git", "add", ".gitattributes", "scripts", "source.txt", "lib", "server"],
cwd=repository,
check=True,
)
subprocess.run(["git", "commit", "-qm", "fixture"], cwd=repository, check=True)
self.root = temporary_root / "worktree"
subprocess.run(
[
"git",
"clone",
"-q",
"-c",
"core.autocrlf=true",
str(repository),
str(self.root),
],
check=True,
)
self.env = os.environ | {
"PATH": f"{self.bin}:{os.environ['PATH']}",
"REAL_PYTHON": sys.executable,
"TMPDIR": str(self.codegen_temp),
}
def tearDown(self) -> None:
self.temp.cleanup()
shutil.rmtree(self.codegen_temp, ignore_errors=True)
@@ -139,6 +165,25 @@ esac
self.assertEqual(worktrees.count("worktree "), 1)
self.assertEqual(list(self.codegen_temp.glob("plezy-codegen-check-*")), [])
def test_crlf_worktree_keeps_generated_dart_lf_and_comparisons_byte_exact(self) -> None:
self.assertIn(b"\r\n", (self.root / "source.txt").read_bytes())
dart_outputs = [
self.root / relative
for relative in GENERATED_PATHS
if relative.endswith(".dart")
]
self.assertTrue(dart_outputs)
self.assertTrue(all(b"\r\n" not in path.read_bytes() for path in dart_outputs))
self.assertEqual(self.run_codegen("--check").returncode, 0)
drifted = self.root / "lib/models/model.g.dart"
drifted.write_bytes(drifted.read_bytes().replace(b"\n", b"\r\n"))
result = self.run_codegen("--check")
self.assertEqual(result.returncode, 1)
self.assertIn("lib/models/model.g.dart", result.stderr)
self.assertIn(b"\r\n", drifted.read_bytes())
def test_stale_check_reports_sorted_paths_without_changing_caller(self) -> None:
(self.root / "source.txt").write_text("version two\n", encoding="utf-8")
before = self.generated_state()
@@ -253,6 +298,5 @@ esac
"run build_runner build --build-filter=lib/models/**\n",
)
if __name__ == "__main__":
unittest.main()
scripts/test_generate_relay_protocol.py
+19
View File
@@ -22,6 +22,25 @@ class RelayProtocolGeneratorTest(unittest.TestCase):
)
self.assertIn("func validRelayID(value string, maxLength int) bool", go_output)
def test_main_writes_canonical_lf_dart_output(self) -> None:
with tempfile.TemporaryDirectory() as temporary_directory:
root = Path(temporary_directory)
spec_path = root / "relay_protocol.json"
dart_path = root / "relay_protocol.g.dart"
go_path = root / "relay_protocol_gen.go"
spec_path.write_text(json.dumps(self.spec), encoding="utf-8")
with (
mock.patch.object(generator, "SPEC_PATH", spec_path),
mock.patch.object(generator, "DART_PATH", dart_path),
mock.patch.object(generator, "GO_PATH", go_path),
):
generator.main()
dart_bytes = dart_path.read_bytes()
self.assertIn(b"\n", dart_bytes)
self.assertNotIn(b"\r\n", dart_bytes)
def test_changed_pattern_fails_before_writing_either_target(self) -> None:
changed_spec = copy.deepcopy(self.spec)
changed_spec["idPattern"] = r"^[A-Za-z0-9_.-]+$"
scripts/test_run_maestro.py
+208 -5
View File
@@ -2,10 +2,12 @@
from __future__ import annotations
import ast
from contextlib import redirect_stderr, redirect_stdout
from dataclasses import replace
import io
from pathlib import Path
import shlex
import subprocess
import sys
import unittest
@@ -17,6 +19,112 @@ import run_maestro # noqa: E402
import run_maestro_ci # noqa: E402
ROOT_DIR = Path(__file__).resolve().parent.parent
SCRIPTS_DIR = ROOT_DIR / "scripts"
LOCAL_SCRIPT_TEST_DISPATCHER = SCRIPTS_DIR / "ci_checks.sh"
CI_SCRIPT_TEST_DISPATCHER = ROOT_DIR / ".github/workflows/ci.yml"
E2E_WORKFLOW = ROOT_DIR / ".github/workflows/e2e.yml"
SCRIPT_TEST_DISPATCHERS = (
LOCAL_SCRIPT_TEST_DISPATCHER,
CI_SCRIPT_TEST_DISPATCHER,
SCRIPTS_DIR / "ci_website_checks.sh",
)
REGRESSION_FLOWS_DIR = ROOT_DIR / ".maestro/regression_flows"
def _is_main_guard(expression: ast.expr) -> bool:
if (
not isinstance(expression, ast.Compare)
or len(expression.ops) != 1
or not isinstance(expression.ops[0], ast.Eq)
or len(expression.comparators) != 1
):
return False
left = expression.left
right = expression.comparators[0]
return (
isinstance(left, ast.Name)
and left.id == "__name__"
and isinstance(right, ast.Constant)
and right.value == "__main__"
) or (
isinstance(right, ast.Name)
and right.id == "__name__"
and isinstance(left, ast.Constant)
and left.value == "__main__"
)
def _executable_script_tests() -> set[str]:
executable = set()
for path in SCRIPTS_DIR.glob("test_*.py"):
module = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
if any(isinstance(node, ast.If) and _is_main_guard(node.test) for node in module.body):
executable.add(path.name)
return executable
def _dispatched_script_tests(path: Path) -> list[str]:
dispatched = []
for line in path.read_text(encoding="utf-8").splitlines():
try:
command = shlex.split(line.strip(), comments=True)
except ValueError:
continue
if len(command) < 2 or Path(command[0]).name not in {"python", "python3"}:
continue
script_name = Path(command[1]).name
if script_name.startswith("test_") and script_name.endswith(".py"):
dispatched.append(script_name)
return dispatched
def _dispatched_maestro_ci_targets(path: Path) -> set[str]:
targets = set()
for line in path.read_text(encoding="utf-8").splitlines():
try:
command = shlex.split(line.strip(), comments=True)
except ValueError:
continue
for index, token in enumerate(command[:-1]):
if Path(token).name == "run_maestro_ci.py":
targets.add(command[index + 1])
return targets
def _registered_regression_flows(
targets: dict[str, tuple[tuple[str, ...], ...]],
) -> set[str]:
registered = set()
for recipes in targets.values():
for arguments in recipes:
flow_target = run_maestro.parse_config(arguments, {}).flow_target
if flow_target.parent == REGRESSION_FLOWS_DIR:
registered.add(flow_target.relative_to(ROOT_DIR).as_posix())
return registered
class ScriptTestDispatchTests(unittest.TestCase):
def test_every_executable_script_test_has_a_dispatcher(self) -> None:
dispatched = {
script
for dispatcher in SCRIPT_TEST_DISPATCHERS
for script in _dispatched_script_tests(dispatcher)
}
self.assertSetEqual(dispatched, _executable_script_tests())
def test_real_jellyfin_fixture_test_is_in_local_and_ci_guards(self) -> None:
for dispatcher in (LOCAL_SCRIPT_TEST_DISPATCHER, CI_SCRIPT_TEST_DISPATCHER):
with self.subTest(dispatcher=dispatcher):
self.assertEqual(
_dispatched_script_tests(dispatcher).count(
"test_maestro_real_jellyfin.py"
),
1,
)
class ParseConfigTests(unittest.TestCase):
def test_basic_defaults(self) -> None:
config = run_maestro.parse_config([], {})
@@ -198,11 +306,106 @@ class CiGroupTests(unittest.TestCase):
self.assertEqual(exit_status, 0)
instrumentation.assert_called_once_with()
def test_group_recipes_are_valid_runner_invocations(self) -> None:
for recipes in run_maestro_ci.GROUPS.values():
for arguments in recipes:
with self.subTest(arguments=arguments):
run_maestro.parse_config(arguments, {})
def test_all_automatic_and_manual_recipes_are_valid_runner_invocations(
self,
) -> None:
target_sets = (
("automatic", run_maestro_ci.GROUPS),
("destructive-manual", run_maestro_ci.DESTRUCTIVE_MANUAL_TARGETS),
)
for classification, targets in target_sets:
for target, recipes in targets.items():
for arguments in recipes:
with self.subTest(
classification=classification,
target=target,
arguments=arguments,
):
run_maestro.parse_config(arguments, {})
def test_top_level_regression_flow_inventory_is_complete(self) -> None:
inventory = {
path.relative_to(ROOT_DIR).as_posix()
for path in REGRESSION_FLOWS_DIR.glob("*.yaml")
}
automatic = _registered_regression_flows(run_maestro_ci.GROUPS)
destructive_manual = _registered_regression_flows(
run_maestro_ci.DESTRUCTIVE_MANUAL_TARGETS
)
self.assertFalse(automatic & destructive_manual)
self.assertSetEqual(automatic | destructive_manual, inventory)
def test_profile_regressions_are_only_in_the_destructive_manual_target(self) -> None:
profile_flows = {
".maestro/regression_flows/01_profile_switch_isolation.yaml",
".maestro/regression_flows/02_profile_teardown.yaml",
}
manual_profile_flows = _registered_regression_flows(
{
"profile-regressions": run_maestro_ci.DESTRUCTIVE_MANUAL_TARGETS[
"profile-regressions"
]
}
)
self.assertSetEqual(manual_profile_flows, profile_flows)
self.assertTrue(
profile_flows.isdisjoint(
_registered_regression_flows(run_maestro_ci.GROUPS)
)
)
def test_destructive_manual_targets_are_not_automatic_pr_targets(self) -> None:
automatic_pr_targets = _dispatched_maestro_ci_targets(E2E_WORKFLOW)
self.assertTrue(
set(run_maestro_ci.DESTRUCTIVE_MANUAL_TARGETS).isdisjoint(
automatic_pr_targets
)
)
def test_destructive_manual_recipes_have_distinct_diagnostics(self) -> None:
for target, recipes in run_maestro_ci.DESTRUCTIVE_MANUAL_TARGETS.items():
with self.subTest(target=target):
configs = [
run_maestro.parse_config(arguments, {}) for arguments in recipes
]
self.assertEqual(
len({config.jellyfin_log for config in configs}), len(configs)
)
self.assertEqual(
len({config.diagnostics_dir for config in configs}), len(configs)
)
def test_destructive_manual_target_requires_disposable_emulator_opt_in(
self,
) -> None:
with (
patch.object(run_maestro_ci.run_maestro, "main") as run,
redirect_stderr(io.StringIO()) as error_output,
):
exit_status = run_maestro_ci.main(["profile-regressions"])
self.assertEqual(exit_status, 2)
run.assert_not_called()
self.assertIn("Refusing destructive manual target", error_output.getvalue())
self.assertIn("--disposable-emulator", error_output.getvalue())
def test_destructive_manual_target_runs_after_explicit_opt_in(self) -> None:
recipes = run_maestro_ci.DESTRUCTIVE_MANUAL_TARGETS["profile-regressions"]
with (
patch.object(run_maestro_ci.run_maestro, "main", return_value=0) as run,
redirect_stdout(io.StringIO()),
):
exit_status = run_maestro_ci.main(
["profile-regressions", "--disposable-emulator"]
)
self.assertEqual(exit_status, 0)
self.assertEqual(
[invocation.args[0] for invocation in run.call_args_list], list(recipes)
)
def test_group_stops_after_interruption(self) -> None:
with (
scripts/test_verify_runtime_inputs.py
+54 -3
View File
@@ -1,5 +1,6 @@
#!/usr/bin/env python3
import hashlib
import importlib.util
import json
import shutil
@@ -34,12 +35,35 @@ FIXTURES = (
class RuntimeInputVerifierTest(unittest.TestCase):
def setUp(self) -> None:
self.temporary = tempfile.TemporaryDirectory()
self.root = Path(self.temporary.name)
for relative in FIXTURES:
temporary_root = Path(self.temporary.name)
repository = temporary_root / "repository"
repository.mkdir()
for relative in (".gitattributes", *FIXTURES):
source = REPOSITORY / relative
destination = self.root / relative
destination = repository / relative
destination.parent.mkdir(parents=True, exist_ok=True)
shutil.copy2(source, destination)
(repository / "crlf-control.txt").write_bytes(b"control\n")
subprocess.run(["git", "init", "-q"], cwd=repository, check=True)
subprocess.run(["git", "config", "user.email", "fixture@example.invalid"], cwd=repository, check=True)
subprocess.run(["git", "config", "user.name", "Fixture"], cwd=repository, check=True)
subprocess.run(["git", "config", "core.autocrlf", "false"], cwd=repository, check=True)
subprocess.run(["git", "add", "."], cwd=repository, check=True)
subprocess.run(["git", "commit", "-qm", "fixture"], cwd=repository, check=True)
self.root = temporary_root / "worktree"
subprocess.run(
[
"git",
"clone",
"-q",
"-c",
"core.autocrlf=true",
str(repository),
str(self.root),
],
check=True,
)
def tearDown(self) -> None:
self.temporary.cleanup()
@@ -61,6 +85,33 @@ class RuntimeInputVerifierTest(unittest.TestCase):
self.assertEqual(0, completed.returncode, completed.stdout + completed.stderr)
self.assertIn("verified offline", completed.stdout)
def test_crlf_worktree_preserves_canonical_lf_provenance_inputs(self) -> None:
self.assertIn(b"\r\n", (self.root / "crlf-control.txt").read_bytes())
provenance = self._json("packages/wakelock_plus/provenance.json")
for relative, expected in provenance["artifacts"].items():
contents = (self.root / "packages/wakelock_plus" / relative).read_bytes()
self.assertNotIn(b"\r\n", contents, relative)
self.assertEqual(expected, hashlib.sha256(contents).hexdigest(), relative)
self.assertEqual([], CHECKER.validate(self.root))
def test_crlf_artifact_drift_is_not_normalized_before_hashing(self) -> None:
relative = "pigeons/messages.dart"
path = self.root / "packages/wakelock_plus" / relative
canonical = path.read_bytes()
self.assertIn(b"\n", canonical)
path.write_bytes(canonical.replace(b"\n", b"\r\n"))
errors = CHECKER.validate(self.root)
self.assertTrue(any(str(path) in error and "SHA-256 drift" in error for error in errors))
provenance = self._json("packages/wakelock_plus/provenance.json")
self.assertNotEqual(
provenance["artifacts"][relative],
hashlib.sha256(path.read_bytes()).hexdigest(),
)
def test_rejects_linux_cmake_checksum_drift(self) -> None:
path = self.root / "linux/CMakeLists.txt"
path.write_text(path.read_text(encoding="utf-8").replace("9fe4d6f5", "0fe4d6f5"), encoding="utf-8")