ea7c11265b
repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its own secrets_required (account platform-readonly.space:platform, a read-only Gitea deploy key), and stages the key before cloning. workflow-script/v1 no longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated: credential layers in the composite must declare write_targets: []. Bug 45a48685-23e9-4605-af1f-d93306108cef Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
36 lines
1.2 KiB
Python
36 lines
1.2 KiB
Python
"""workflow-script/v1 composite: exact layer order and credential env export.
|
|
|
|
Script nodes get their CP write credential only through this composite
|
|
(the legacy WF-COMP-26 mount is removed), so the layering is load-bearing.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
|
|
|
|
|
|
def _load(kind_dir: str, name: str) -> dict:
|
|
return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
|
|
|
|
|
|
def test_workflow_script_layers_shared_variables_cp_service_token_repo_readonly():
|
|
doc = _load("composites", "workflow-script")
|
|
assert doc["layers"] == [
|
|
{"context": "shared-variables/v1"},
|
|
{"context": "cp-service-token/v1"},
|
|
{"context": "repo-readonly/v1"},
|
|
]
|
|
|
|
|
|
def test_workflow_script_env_exports_cp_service_token_file():
|
|
doc = _load("composites", "workflow-script")
|
|
env: dict = dict(doc.get("env") or {})
|
|
for layer in doc["layers"]:
|
|
(kind, ref), = layer.items()
|
|
name = ref.split("/")[0]
|
|
env.update(_load(kind + "s", name).get("env") or {})
|
|
assert env["CP_SERVICE_TOKEN_FILE"] == "/run/agent/cp-service-token/token"
|