mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 20:27:15 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
62 lines
1.9 KiB
Python
62 lines
1.9 KiB
Python
"""Shared fixtures. Nothing here may touch the network.
|
|
|
|
Every registry answer is a fixture: the gate's worst failure mode is reporting
|
|
"up to date" against a pre-release, and a test that hits the real registry
|
|
cannot pin that behaviour down.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
|
|
import pytest
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
|
|
|
|
|
|
@pytest.fixture
|
|
def repo(tmp_path: Path) -> Path:
|
|
"""A throwaway git repo, so git-ignore lookups behave as in real use."""
|
|
subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
|
|
return tmp_path
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def no_network(monkeypatch):
|
|
"""Fail loudly if a test reaches for a socket instead of a fixture.
|
|
|
|
Imported inside the fixture, not at module top: the sys.path insert above
|
|
is what makes the package importable at all, and a top-level import after
|
|
it is a lint violation this repo does not suppress.
|
|
"""
|
|
from dep_freshness.registries import http
|
|
|
|
def forbidden(*_args, **_kwargs):
|
|
raise AssertionError("test tried to open a real connection")
|
|
|
|
# Every host is reachable unless a test asked for offline mode, so
|
|
# `--offline` behaves in tests exactly as it does in a real run.
|
|
monkeypatch.setattr(
|
|
http, "host_reachable", lambda _url: not http._forced_offline
|
|
)
|
|
monkeypatch.setattr(http, "urlopen", forbidden)
|
|
http.reset_probes()
|
|
http.force_offline(False)
|
|
|
|
|
|
@pytest.fixture
|
|
def cache_dir(tmp_path, monkeypatch) -> Path:
|
|
"""Point the on-disk registry snapshot at a scratch directory."""
|
|
target = tmp_path / "cache"
|
|
monkeypatch.setenv("DEP_FRESHNESS_CACHE", str(target))
|
|
return target
|
|
|
|
|
|
def write(root: Path, relative: str, body: str) -> Path:
|
|
path = root / relative
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(body, encoding="utf-8")
|
|
return path
|