Read delivery tokens from files and check selected paths before release

cmd/releasekit/token_file_test.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"go.maximumdirect.net/releasekit/cmd/releasekit/internal/cli"
+)
+
+func TestDeliveryTokenFileSelection(t *testing.T) {
+	for _, test := range []struct {
+		name, env, contents, file, want string
+		status                          int
+	}{
+		{name: "relative file", contents: "fixture-token\n", file: "token", want: "fixture-token"},
+		{name: "absolute file", contents: "fixture-token\n", file: "absolute", want: "fixture-token"},
+		{name: "environment overrides missing file", env: "env-token", file: "missing", want: "env-token"},
+		{name: "blank environment falls back", env: " \t", contents: "fixture-token\n", file: "token", want: "fixture-token"},
+		{name: "missing file", file: "missing", status: 2},
+		{name: "blank file", contents: " \n\t", file: "token", status: 2},
+		{name: "empty file", file: "token", status: 2},
+		{name: "unreadable as file", file: ".", status: 2},
+		{name: "no credential", status: 2},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			repository := t.TempDir()
+			if err := os.WriteFile(filepath.Join(repository, "token"), []byte(test.contents), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			name := test.file
+			if name == "absolute" {
+				name = filepath.Join(repository, "token")
+			}
+			t.Setenv("RELEASEKIT_TEST_TOKEN", test.env)
+			var stderr bytes.Buffer
+			destination, status := deliveryDestination(repository, cli.Settings{Delivery: &cli.DeliverySettings{
+				BaseURL: "https://gitea.example", Owner: "owner", Repository: "example",
+				TokenEnv: "RELEASEKIT_TEST_TOKEN", TokenFile: name,
+			}}, &stderr)
+			if status != test.status || destination.Token != test.want {
+				t.Fatalf("status=%d token matches=%t, want status=%d; diagnostics=%s", status, destination.Token == test.want, test.status, &stderr)
+			}
+			for _, secret := range []string{"fixture-token", "env-token"} {
+				if strings.Contains(stderr.String(), secret) {
+					t.Fatal("diagnostics exposed a token")
+				}
+			}
+		})
+	}
+}
+
+func TestCheckReadsUntrackedFilesSelectionFromProfile(t *testing.T) {
+	repository := newCLIRepository(t)
+	writeDeliveryProfile(t, repository, cli.Settings{
+		Product:    "Example Product",
+		Validation: &cli.ValidationSettings{UntrackedFiles: []string{"token-file"}},
+		Delivery:   &cli.DeliverySettings{BaseURL: "https://gitea.example", Owner: "owner", Repository: "example", TokenFile: "missing-token-file"},
+	})
+	writeRepositoryFile(t, repository, "token-file", "fixture-secret\n")
+	cliGitRun(t, repository, "add", "token-file")
+	cliGitRun(t, repository, "commit", "-m", "capture a selected token path")
+	var stdout, stderr bytes.Buffer
+	status := run(context.Background(), []string{"check", "--repo", repository, "v1.2.3"}, &stdout, &stderr)
+	if status != 1 || !strings.Contains(stderr.String(), "untracked-files") || !strings.Contains(stderr.String(), "token-file") {
+		t.Fatalf("check status=%d output=%s diagnostics=%s", status, &stdout, &stderr)
+	}
+	if strings.Contains(stdout.String()+stderr.String(), "fixture-secret") {
+		t.Fatal("check exposed the token")
+	}
+}
+
+func TestDeliverAndCIDeliverReadTokenFileFromRepositoryRoot(t *testing.T) {
+	for _, command := range []string{"deliver", "ci-deliver"} {
+		t.Run(command, func(t *testing.T) {
+			repository := newCLIRepository(t)
+			state := &deliveryServerState{}
+			server := newDeliveryServer(t, state)
+			defer server.Close()
+			writeDeliveryProfile(t, repository, cli.Settings{
+				Product:  "Example Product",
+				Delivery: &cli.DeliverySettings{BaseURL: server.URL, Owner: "owner", Repository: "example", TokenFile: ".releasekit/token"},
+			})
+			writeRepositoryFile(t, repository, ".gitignore", ".releasekit/\n")
+			cliGitRun(t, repository, "add", ".gitignore")
+			cliGitRun(t, repository, "commit", "-m", "ignore local delivery credentials")
+			commit := pushTaggedCLIRepository(t, repository)
+			state.update(func(data *deliveryServerData) { data.commit = commit })
+			writeRepositoryFile(t, repository, ".releasekit/token", "fixture-token\n")
+			t.Setenv("RELEASEKIT_GITEA_TOKEN", "")
+			var stdout, stderr bytes.Buffer
+			args := []string{command, "--repo", filepath.Join(repository, ".releasekit")}
+			if command == "ci-deliver" {
+				args = append(args, "--commit", commit)
+			}
+			args = append(args, "v1.2.3")
+			if status := run(context.Background(), args, &stdout, &stderr); status != 0 {
+				t.Fatalf("delivery status=%d output=%s diagnostics=%s", status, &stdout, &stderr)
+			}
+			if state.snapshot().releaseCreates != 1 {
+				t.Fatal("token-file delivery did not create the release page")
+			}
+			if strings.Contains(stdout.String()+stderr.String(), "fixture-token") {
+				t.Fatal("delivery exposed the token")
+			}
+		})
+	}
+}