| 1 | // node --test scripts/cli-release.test.mjs |
| 2 | import assert from "node:assert/strict"; |
| 3 | import { createPrivateKey } from "node:crypto"; |
| 4 | import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; |
| 5 | import { tmpdir } from "node:os"; |
| 6 | import { join } from "node:path"; |
| 7 | import { test } from "node:test"; |
| 8 | |
| 9 | import { BUILDER, TARGETS, builderArgs, builderScript, manifest, sha256, version } from "./cli-release.mjs"; |
| 10 | import { keygen, signBytes, verifyBytes } from "./runner-release.mjs"; |
| 11 | |
| 12 | test("a workflow's build uses the job's Cargo registry, which the crates cache restores", () => { |
| 13 | const job = builderArgs({ root: "/home/runner/work/repo", env: { GITHUB_ACTIONS: "true" }, home: "/home/node" }); |
| 14 | assert.ok(job.includes("/home/node/.cargo/registry:/usr/local/cargo/registry"), job.join(" ")); |
| 15 | assert.ok(job.includes("/home/runner/work/repo:/src")); |
| 16 | assert.equal(job.at(-1), BUILDER); |
| 17 | // Elsewhere a Docker volume keeps it. |
| 18 | assert.ok(builderArgs({ root: "/x", env: {}, home: "/h" }).includes("g1t-cargo-registry:/usr/local/cargo/registry")); |
| 19 | // The release key's public half goes into the build, for `g1t upgrade`; without it, nothing is passed. |
| 20 | assert.ok(builderArgs({ root: "/x", env: { G1T_RUNNER_RELEASE_KEY: "pub=" }, home: "/h" }).includes("G1T_RUNNER_RELEASE_KEY=pub=")); |
| 21 | assert.ok(!builderArgs({ root: "/x", env: {}, home: "/h" }).some((arg) => arg.includes("RELEASE_KEY"))); |
| 22 | // What the container wrote as root goes back to the user, even when the build fails. |
| 23 | const script = builderScript("x86_64-unknown-linux-musl", "1000:1000"); |
| 24 | assert.match(script, /^trap 'chown -R 1000:1000 \/src\/target\/zig \/usr\/local\/cargo\/registry' EXIT; set -e;/); |
| 25 | assert.ok(!builderScript("t", null).includes("chown")); |
| 26 | }); |
| 27 | |
| 28 | test("the version is crates/g1t's", () => { |
| 29 | assert.match(version(), /^\d+\.\d+\.\d+/); |
| 30 | }); |
| 31 | |
| 32 | test("the manifest and SHA256SUMS name each binary that was built", () => { |
| 33 | const dir = mkdtempSync(join(tmpdir(), "cli-release-")); |
| 34 | try { |
| 35 | writeFileSync(join(dir, TARGETS["linux-x64"].file), "linux"); |
| 36 | writeFileSync(join(dir, TARGETS["windows-x64"].file), "windows"); |
| 37 | const m = manifest(dir, "0.2.0", new Date("2026-10-12T00:00:00Z")); |
| 38 | assert.deepEqual(m, { |
| 39 | version: "0.2.0", |
| 40 | published_at: "2026-10-12T00:00:00.000Z", |
| 41 | files: { |
| 42 | "linux-x64": { name: "g1t-linux-x64", sha256: sha256("linux") }, |
| 43 | "windows-x64": { name: "g1t-windows-x64.exe", sha256: sha256("windows") }, |
| 44 | }, |
| 45 | }); |
| 46 | // The install scripts read `<sha256> <name>` lines. |
| 47 | assert.equal( |
| 48 | readFileSync(join(dir, "SHA256SUMS"), "utf8"), |
| 49 | `${sha256("linux")} g1t-linux-x64\n${sha256("windows")} g1t-windows-x64.exe\n`, |
| 50 | ); |
| 51 | assert.equal(readFileSync(join(dir, "latest.json"), "utf8"), readFileSync(join(dir, "manifest.json"), "utf8")); |
| 52 | const keys = keygen(); |
| 53 | const key = createPrivateKey({ key: Buffer.from(keys.private, "base64"), format: "der", type: "pkcs8" }); |
| 54 | const bytes = readFileSync(join(dir, "latest.json")); |
| 55 | assert.ok(verifyBytes(bytes, signBytes(bytes, key), keys.public)); |
| 56 | } finally { |
| 57 | rmSync(dir, { recursive: true, force: true }); |
| 58 | } |
| 59 | }); |
| 60 | |
| 61 | test("a manifest of nothing is refused", () => { |
| 62 | const dir = mkdtempSync(join(tmpdir(), "cli-release-")); |
| 63 | try { |
| 64 | assert.throws(() => manifest(dir, "0.2.0"), /no binaries/); |
| 65 | } finally { |
| 66 | rmSync(dir, { recursive: true, force: true }); |
| 67 | } |
| 68 | }); |