xtask/

deploy_render.rs

//! Guards `.forgejo/scripts/deploy.sh`'s handoff to `ci-image`.
//!
//! History, because it explains the shape of these tests. deploy.sh used to render a kaniko Job
//! itself, from an UNQUOTED `<<EOF` heredoc — so the outer shell expanded the inner script before
//! kubectl ever saw it. Nothing in the text looked dangerous while you read it, which was exactly
//! the problem: a backtick in a *comment* became a command, and `$1` became deploy.sh's own
//! argument. Both mistakes shipped, and the first killed the deploy at the heredoc under `set -u`
//! before any Job existed — which is why there were no logs to read.
//!
//! The Job is now rendered by `ci-image` (do-k8s apps/ci/runner-image/ci-image-build.sh), which
//! carries its own manifest-rendering tests. What is left here is the half this repo owns: the
//! prepare script, and whether it reaches ci-image intact. It travels as a QUOTED heredoc into an
//! env value, so the outer shell no longer expands anything — but that is a property worth
//! asserting rather than assuming, since unquoting the heredoc would silently restore the old
//! hazard.
//!
//! So this runs deploy.sh with a `ci-image` shim on PATH and checks what it was actually handed.

#[cfg(test)]
mod tests {
    use std::fs;
    use std::os::unix::fs::PermissionsExt;
    use std::path::{Path, PathBuf};
    use std::process::Command;

    fn repo_root() -> PathBuf {
        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
            .parent()
            .expect("xtask has a parent")
            .to_path_buf()
    }

    fn write_shim(dir: &Path, name: &str, body: &str) {
        let path = dir.join(name);
        fs::write(&path, body).expect("write shim");
        let mut perms = fs::metadata(&path).expect("stat shim").permissions();
        perms.set_mode(0o755);
        fs::set_permissions(&path, perms).expect("chmod shim");
    }

    /// What deploy.sh handed to ci-image: the prepare script, and its environment.
    struct Handoff {
        prep: String,
        env: String,
    }

    /// Runs deploy.sh with shims and returns the ci-image invocation it produced.
    ///
    /// Each call gets its own directory: cargo runs a crate's tests in threads, and a shared one
    /// had every test deleting the others' shims mid-run — which looked exactly like the failure
    /// it is meant to detect.
    fn run_deploy() -> Handoff {
        use std::sync::atomic::{AtomicUsize, Ordering};
        static SEQ: AtomicUsize = AtomicUsize::new(0);
        let unique = format!(
            "{}-{}",
            std::process::id(),
            SEQ.fetch_add(1, Ordering::Relaxed)
        );
        let root = repo_root();
        let script = root.join(".forgejo/scripts/deploy.sh");
        assert!(
            script.exists(),
            "deploy.sh not found at {}",
            script.display()
        );

        let tmp = std::env::temp_dir().join(format!("nomisync-deploy-render-{unique}"));
        let _ = fs::remove_dir_all(&tmp);
        fs::create_dir_all(&tmp).expect("temp dir");
        let prep_file = tmp.join("prep.sh");
        let env_file = tmp.join("env.txt");

        // The ci-image shim records what it was given and returns a well-formed digest, so
        // deploy.sh proceeds exactly as it would in production.
        write_shim(
            &tmp,
            "ci-image",
            &format!(
                "#!/usr/bin/env bash\nprintf '%s' \"$PREP_SCRIPT\" > {}\n\
                 {{ echo \"PROJECT=$PROJECT\"; echo \"TARGET=$TARGET\"; echo \"IMAGE=$IMAGE\"; \
                 echo \"PREP_SECRETS=$PREP_SECRETS\"; echo \"PREP_ENV=$PREP_ENV\"; }} > {}\n\
                 echo 'sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef'\n",
                prep_file.display(),
                env_file.display()
            ),
        );
        // deploy.sh checks it is still master tip; answer with the sha it is given.
        write_shim(
            &tmp,
            "git",
            "#!/usr/bin/env bash\ncase \"$1\" in\n  ls-remote) echo \"$SHA refs/heads/master\";;\nesac\nexit 0\n",
        );
        // The GitOps bump that follows needs a cluster; it is not what this tests.
        write_shim(&tmp, "kubectl", "#!/usr/bin/env bash\nexit 0\n");

        let path = format!(
            "{}:{}",
            tmp.display(),
            std::env::var("PATH").unwrap_or_default()
        );
        let _ = Command::new("timeout")
            .args(["25", "bash", &script.to_string_lossy()])
            .env("PATH", path)
            .env("REPO", "rayslava/nomisync")
            .env("SHA", "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef")
            .env("GIT_TOKEN", "token")
            .env("GITHUB_RUN_NUMBER", "1")
            .env("GITHUB_RUN_ID", "1")
            .current_dir(&root)
            .output()
            .expect("run deploy.sh");

        let prep = fs::read_to_string(&prep_file).unwrap_or_else(|_| {
            panic!(
                "deploy.sh never called ci-image — it died before the handoff. \
                 That is what an unterminated heredoc or a bad expansion does."
            )
        });
        let env = fs::read_to_string(&env_file).expect("ci-image env capture");
        let _ = fs::remove_dir_all(&tmp);
        Handoff { prep, env }
    }

    #[test]
    fn deploy_reaches_ci_image_with_a_prepare_script() {
        let _processes = crate::test_support::processes();
        let h = run_deploy();
        assert!(
            h.prep.contains("nomisync-manifest.json"),
            "the prepare script is missing its manifest fetch, so the heredoc was truncated:\n{}",
            h.prep
        );
        assert!(
            h.env.contains("PROJECT=nomisync")
                && h.env.contains("IMAGE=registry.do.rayslava.com/nomisync:"),
            "ci-image was called with the wrong identity:\n{}",
            h.env
        );
    }

    #[test]
    fn the_quoted_heredoc_does_not_eat_inner_dollars() {
        // `print(m$1)` belongs to the CONTAINER's shell. Under the old unquoted heredoc, deploy.sh
        // expanded it — to nothing, or fatally under set -u. A quoted heredoc must pass it through
        // verbatim; if someone unquotes it, this fails.
        let _processes = crate::test_support::processes();
        let h = run_deploy();
        assert!(
            h.prep.contains("print(m$1)"),
            "$1 was expanded away before ci-image saw it — is the PREP heredoc still quoted?\n{}",
            h.prep
        );
    }

    #[test]
    fn the_prepare_heredoc_is_quoted() {
        // Checked in the SOURCE: an unquoted heredoc EXECUTES a backtick and substitutes its
        // output, so a hazard there can vanish before any captured-output check could see it.
        // Quoting is what makes the whole body inert, comments included.
        let source = fs::read_to_string(repo_root().join(".forgejo/scripts/deploy.sh"))
            .expect("read deploy.sh");
        assert!(
            source.contains("PREP_SCRIPT=\"$(cat <<'PREP'"),
            "the prepare heredoc is no longer quoted; the outer shell will expand and execute its body"
        );
    }

    #[test]
    fn the_prepare_script_is_valid_bash() {
        let _processes = crate::test_support::processes();
        let h = run_deploy();
        let dir = std::env::temp_dir().join(format!(
            "nomisync-prepare-{}-{:?}",
            std::process::id(),
            std::thread::current().id()
        ));
        fs::create_dir_all(&dir).expect("temp dir");
        let path = dir.join("prepare.sh");
        fs::write(&path, &h.prep).expect("write prepare");

        let out = Command::new("bash")
            .args(["-n", &path.to_string_lossy()])
            .output()
            .expect("bash -n");
        let _ = fs::remove_dir_all(&dir);

        assert!(
            out.status.success(),
            "the prepare script is not valid bash:\n{}",
            String::from_utf8_lossy(&out.stderr)
        );
    }

    #[test]
    fn the_prepare_script_keeps_its_provenance_checks() {
        // These are the reason the prepare script exists. It fetches by content-addressed key and
        // re-verifies, and it refuses a manifest belonging to another commit or run. Losing any of
        // them while moving the script around would deploy unverified bytes and still go green.
        let _processes = crate::test_support::processes();
        let h = run_deploy();
        for needle in [
            "manifest commit",
            "manifest run",
            "hash mismatch against the manifest",
            "sha256sum -c -",
        ] {
            assert!(
                h.prep.contains(needle),
                "the prepare script lost its check for {needle:?}:\n{}",
                h.prep
            );
        }
    }

    #[test]
    fn the_run_id_reaches_the_prepare_container() {
        // The manifest cross-check compares against GITHUB_RUN_ID. ci-image does not forward it on
        // its own, so it must be passed via PREP_ENV — absent, the check would compare against an
        // empty string and pass vacuously.
        let _processes = crate::test_support::processes();
        let h = run_deploy();
        assert!(
            h.env.contains("PREP_ENV=GITHUB_RUN_ID="),
            "GITHUB_RUN_ID is not being passed to the prepare container:\n{}",
            h.env
        );
    }

    #[test]
    fn both_deployments_are_pinned_by_digest() {
        // A tag can be re-pointed at other bytes. ci-image returns the digest this run pushed, and
        // both Deployments share one image, so both references must carry it.
        let source = fs::read_to_string(repo_root().join(".forgejo/scripts/deploy.sh"))
            .expect("read deploy.sh");
        assert!(
            source.contains("${SHA}@${DIGEST}"),
            "the GitOps bump writes a bare tag; it should pin the digest ci-image returned"
        );
        assert!(
            source.contains("MANIFESTS=\"$WEB_MANIFEST $SSHD_MANIFEST\""),
            "both Deployments must start in the same edit set, or web and sshd can split"
        );
        assert!(
            source.contains("sed -i -E") && source.contains("$MANIFESTS"),
            "the bump must rewrite that whole set in one sed"
        );
    }

    #[test]
    fn the_fleet_migration_job_is_bumped_with_the_deployments() {
        // The Job runs the migrations compiled into THIS image. Left on a stale
        // tag it would migrate the fleet with a different release's migration
        // set — the schema drift the migrator exists to prevent, caused by the
        // migrator itself.
        let source = fs::read_to_string(repo_root().join(".forgejo/scripts/deploy.sh"))
            .expect("read deploy.sh");
        assert!(
            source.contains("JOB_MANIFEST="),
            "the fleet migration Job is not part of the GitOps bump"
        );
        assert!(
            source.contains("[ -f \"$JOB_MANIFEST\" ] && MANIFESTS=\"$MANIFESTS $JOB_MANIFEST\""),
            "the Job must join the edit set when its manifest exists, and be skipped \
             — not fatal — while it does not, exactly as the Deployments bootstrap"
        );
    }

    #[test]
    fn the_release_artifact_carries_the_fleet_migrator() {
        // The Dockerfile COPYs it, so an image build fails outright if packaging
        // drops it — after a successful push, which is the expensive place to
        // find out.
        let source = fs::read_to_string(repo_root().join(".forgejo/scripts/deploy.sh"))
            .expect("read deploy.sh");
        assert!(
            source.contains("release-fleet-migrate"),
            "deploy.sh does not assert the migrator binary survived the tarball"
        );

        let dockerfile =
            fs::read_to_string(repo_root().join("Dockerfile")).expect("read Dockerfile");
        assert!(
            dockerfile.contains("COPY release-fleet-migrate"),
            "the image does not carry the migrator the Job runs"
        );
        assert!(
            dockerfile.contains("ENTRYPOINT [\"/web\"]"),
            "the migrator must be a Job command, never the container entrypoint"
        );
    }
}