admin
175ecfcdd2
gates / gates (push) Successful in 30s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
80 lines
2.8 KiB
Go
80 lines
2.8 KiB
Go
package osupdates
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
var engineSet = []Package{{Name: "docker-ce", Version: "5:29.8.2-1~debian.13~trixie", Origin: "Docker"},
|
|
{Name: "containerd.io", Version: "2.3.6-1~debian.13~trixie", Origin: "Docker"}}
|
|
|
|
func (f *fix) dockerNight(t *testing.T, host string, healthy bool) {
|
|
t.Helper()
|
|
out := "nothing"
|
|
if !healthy {
|
|
out = "health_failed"
|
|
}
|
|
f.ingest(t, host, Report{Layer: LayerDocker, Trigger: "night", Mode: "apply", Outcome: out, Healthy: healthy,
|
|
Installed: append([]Package{pk("libc6", "x")}, engineSet...)})
|
|
}
|
|
|
|
// The Docker set is NEVER approved automatically (`11` §5.8: the operator approves it). Red-proof: add LayerDocker to
|
|
// Layers (the auto-approved list) and this fails.
|
|
func TestDocker_NeverAutoApproved(t *testing.T) {
|
|
f := newFix(t)
|
|
for i := 0; i < 3; i++ {
|
|
f.dockerNight(t, "hp", true)
|
|
f.dockerNight(t, "n100", true)
|
|
f.now = f.now.Add(25 * time.Hour)
|
|
f.s.Evaluate()
|
|
}
|
|
if rel, _ := f.s.Store.LatestOSRelease(LayerDocker); rel != nil {
|
|
t.Fatalf("a Docker set was auto-approved: %+v", rel)
|
|
}
|
|
}
|
|
|
|
// The operator's button works only after every ring-0 box ran the set 2 healthy nights; an unhealthy step blocks it.
|
|
// The candidate is the six engine packages only. Red-proof: compare nights against 1 instead of DockerNights and the
|
|
// one-night step approves.
|
|
func TestDocker_ApproveNeedsTwoHealthyNightsOnEveryRing0Box(t *testing.T) {
|
|
f := newFix(t)
|
|
f.dockerNight(t, "hp", true)
|
|
f.dockerNight(t, "n100", true)
|
|
if _, err := f.s.ApproveDocker(); err == nil || !strings.Contains(err.Error(), "1 of 2") {
|
|
t.Fatalf("approved after one night: %v", err)
|
|
}
|
|
f.now = f.now.Add(24 * time.Hour)
|
|
f.dockerNight(t, "hp", true)
|
|
if _, err := f.s.ApproveDocker(); err == nil {
|
|
t.Fatal("approved while n100 had only one night")
|
|
}
|
|
f.dockerNight(t, "n100", true)
|
|
id, err := f.s.ApproveDocker()
|
|
if err != nil || !strings.HasPrefix(id, "os-docker-") {
|
|
t.Fatalf("%q %v", id, err)
|
|
}
|
|
rel, _ := f.s.Store.LatestOSRelease(LayerDocker)
|
|
if rel.ApprovedBy != "operator" || !strings.Contains(rel.PackagesJSON, "docker-ce") || strings.Contains(rel.PackagesJSON, "libc6") {
|
|
t.Fatalf("release %+v", rel)
|
|
}
|
|
if len(f.bumps) != 0 {
|
|
t.Fatalf("a Docker approval must nudge no box (ring 1 takes it by a signed job): %v", f.bumps)
|
|
}
|
|
if b := f.s.DesiredBlock("cust1"); b.Release != nil || b.HostRelease != nil {
|
|
t.Fatalf("the Docker set leaked into the desired block: %+v", b)
|
|
}
|
|
}
|
|
|
|
func TestDocker_UnhealthyStepBlocksTheButton(t *testing.T) {
|
|
f := newFix(t)
|
|
f.dockerNight(t, "hp", true)
|
|
f.dockerNight(t, "n100", true)
|
|
f.now = f.now.Add(24 * time.Hour)
|
|
f.dockerNight(t, "hp", false)
|
|
f.dockerNight(t, "n100", true)
|
|
if _, err := f.s.ApproveDocker(); err == nil || !strings.Contains(err.Error(), "health_failed") {
|
|
t.Fatalf("an unhealthy Docker step did not block: %v", err)
|
|
}
|
|
}
|