base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Verify releases use original Git objects

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 03:14:01 +00:00
parent 7e6e0cc7d1
commit 94aedacf05
5 changed files with 141 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
publish_test.go
View File

@@ -93,6 +93,7 @@ func TestCandidateOperationsDiscoverGoOnlyWhenLaterWorkNeedsIt(t *testing.T) {
func TestPublishPushesOnlyTheCapturedAnnotatedTag(t *testing.T) {
repo := newPublishFixture(t)
gitRun(t, repo.work, "config", "push.recurseSubmodules", "only")
gitRun(t, repo.work, "replace", repo.unrelatedCommit, repo.commit)
suiteRuns := filepath.Join(t.TempDir(), "suite-runs")
t.Setenv("RELEASEKIT_FIXTURE_SUITE_RUNS", suiteRuns)
refsBefore := gitText(t, repo.bare, "show-ref", "--heads", "--tags")
@@ -162,6 +163,36 @@ func TestPublishPushesOnlyTheCapturedAnnotatedTag(t *testing.T) {
}
}
func TestPublishRejectsReplacementDerivedCheckout(t *testing.T) {
repo := newPublishFixture(t)
writeFile(t, repo.work, "broken.go", "package fixture\nfunc broken(\n")
gitRun(t, repo.work, "add", "broken.go")
gitRun(t, repo.work, "commit", "-m", "Original source does not compile")
original := gitText(t, repo.work, "rev-parse", "HEAD")
gitRun(t, repo.work, "-c", "remote.origin.mirror=false", "push", "origin", "HEAD:refs/heads/main")
writeFile(t, repo.work, "broken.go", "package fixture\nfunc valid() {}\n")
writeFile(t, repo.work, "docs/releases/v1.2.3.md", "# Sample App v1.2.3\n\nReplacement note.\n")
gitRun(t, repo.work, "add", "broken.go", "docs/releases/v1.2.3.md")
gitRun(t, repo.work, "commit", "-m", "Replacement source")
replacement := gitText(t, repo.work, "rev-parse", "HEAD")
gitRun(t, repo.work, "reset", "--hard", original)
gitRun(t, repo.work, "replace", original, replacement)
gitRun(t, repo.work, "reset", "--hard", original)
contents, err := os.ReadFile(filepath.Join(repo.work, "broken.go"))
if err != nil || !strings.Contains(string(contents), "func valid") {
t.Fatalf("replacement checkout = %q, error = %v", contents, err)
}
result, err := releasekit.Publish(context.Background(), releasekit.ReleaseRequest{
RepositoryDir: repo.work, Product: "Sample App", Version: "v1.2.3",
})
if err == nil || !strings.Contains(err.Error(), "clean") || result.State != releasekit.PublicationNotAttempted {
t.Fatalf("publication = %#v, error = %v; want dirty source rejection", result, err)
}
if err := exec.Command("git", "-C", repo.bare, "show-ref", "--verify", "--quiet", "refs/tags/v1.2.3").Run(); err == nil {
t.Fatal("replacement-derived source was published")
}
}
func TestPublishUsesSeparateFullTagsForModulesAtOneCommit(t *testing.T) {
repo := newPublishFixture(t)
firstDir, secondDir := "integrations/first", "integrations/second"