| 1 | package main |
| 2 | |
| 3 | import ( |
| 4 | "fmt" |
| 5 | "reflect" |
| 6 | "testing" |
| 7 | ) |
| 8 | |
| 9 | func TestRepositoryReleaseSigningContract(t *testing.T) { |
| 10 | root := "../.." |
| 11 | contract, err := loadAndValidate(root) |
| 12 | if err != nil { |
| 13 | t.Fatal(err) |
| 14 | } |
| 15 | fingerprint, err := contractFingerprint(root, contract) |
| 16 | if err != nil { |
| 17 | t.Fatal(err) |
| 18 | } |
| 19 | if got := fmt.Sprintf("%x", fingerprint); len(got) != 64 { |
| 20 | t.Fatalf("fingerprint length = %d, want 64", len(got)) |
| 21 | } |
| 22 | } |
| 23 | |
| 24 | func TestTopLevelSignPathWorkflowCallGraph(t *testing.T) { |
| 25 | got, err := discoverTopLevelSigningWorkflows("../..") |
| 26 | if err != nil { |
| 27 | t.Fatal(err) |
| 28 | } |
| 29 | want := []string{ |
| 30 | ".github/workflows/release-desktop.yml", |
| 31 | ".github/workflows/release-stable.yml", |
| 32 | } |
| 33 | if !reflect.DeepEqual(got, want) { |
| 34 | t.Fatalf("top-level workflows that reach SignPath = %v, want %v", got, want) |
| 35 | } |
| 36 | } |
| 37 | |
| 38 | func TestReleaseSigningContractRejectsWildcards(t *testing.T) { |
| 39 | contract, err := loadAndValidate("../..") |
| 40 | if err != nil { |
| 41 | t.Fatal(err) |
| 42 | } |
| 43 | contract.AllowedBuildDefinitions = []string{".github/workflows/release-*.yml"} |
| 44 | if err := validateContract("../..", contract); err == nil { |
| 45 | t.Fatal("wildcard build definition unexpectedly passed validation") |
| 46 | } |
| 47 | } |
| 48 | |
| 49 | func TestWorkflowUsingSignPathTokenIsSigningEntryPoint(t *testing.T) { |
| 50 | workflow := []byte(` |
| 51 | on: workflow_dispatch |
| 52 | jobs: |
| 53 | sign: |
| 54 | runs-on: windows-latest |
| 55 | steps: |
| 56 | - shell: pwsh |
| 57 | env: |
| 58 | SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} |
| 59 | run: ./submit-signing-request.ps1 |
| 60 | `) |
| 61 | info, err := parseWorkflow(workflow) |
| 62 | if err != nil { |
| 63 | t.Fatal(err) |
| 64 | } |
| 65 | if !info.externallyTriggered || !info.directSigning { |
| 66 | t.Fatalf("token-backed workflow was not classified as a signing entry point: %+v", info) |
| 67 | } |
| 68 | } |
| 69 |