mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 20:27:15 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
123 lines
3.6 KiB
Python
123 lines
3.6 KiB
Python
"""The network layer: one probe per host, and failures that never raise out.
|
|
|
|
The gate is called from a pre-commit hook the user may not bypass, so every
|
|
transport error has to arrive as `Offline` -- something the caller can answer
|
|
with a cached value -- rather than as a traceback.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import io
|
|
import socket
|
|
from urllib.error import HTTPError, URLError
|
|
|
|
import pytest
|
|
|
|
from dep_freshness.registries import http
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def real_probe(monkeypatch):
|
|
"""Undo conftest's blanket `host_reachable` stub for this module."""
|
|
monkeypatch.undo()
|
|
http.reset_probes()
|
|
http.force_offline(False)
|
|
yield
|
|
http.reset_probes()
|
|
http.force_offline(False)
|
|
|
|
|
|
def test_the_probe_is_made_once_per_host(monkeypatch):
|
|
calls = []
|
|
|
|
def fake_connect(address, timeout=None):
|
|
calls.append(address)
|
|
return io.BytesIO()
|
|
|
|
monkeypatch.setattr(socket, "create_connection", fake_connect)
|
|
assert http.host_reachable("https://pub.dev/a")
|
|
assert http.host_reachable("https://pub.dev/b")
|
|
assert len(calls) == 1
|
|
assert calls[0] == ("pub.dev", 443)
|
|
|
|
|
|
def test_an_unreachable_host_is_remembered_as_unreachable(monkeypatch):
|
|
monkeypatch.setattr(socket, "create_connection", _refuse)
|
|
assert not http.host_reachable("https://nowhere.invalid/x")
|
|
|
|
|
|
def test_force_offline_short_circuits_even_a_known_good_host(monkeypatch):
|
|
monkeypatch.setattr(socket, "create_connection", lambda *a, **k: io.BytesIO())
|
|
assert http.host_reachable("https://pub.dev/a")
|
|
http.force_offline(True)
|
|
assert not http.host_reachable("https://pub.dev/a")
|
|
|
|
|
|
def test_get_json_raises_offline_when_the_host_is_down(monkeypatch):
|
|
monkeypatch.setattr(socket, "create_connection", _refuse)
|
|
with pytest.raises(http.Offline):
|
|
http.get_json("https://nowhere.invalid/x")
|
|
|
|
|
|
def test_a_404_means_the_package_does_not_exist(monkeypatch):
|
|
_reachable(monkeypatch)
|
|
monkeypatch.setattr(http, "urlopen", _raiser(
|
|
HTTPError("u", 404, "Not Found", {}, None)))
|
|
assert http.get_json("https://pub.dev/api/packages/nope") is None
|
|
|
|
|
|
def test_a_500_degrades_to_offline_rather_than_a_missing_package(monkeypatch):
|
|
_reachable(monkeypatch)
|
|
monkeypatch.setattr(http, "urlopen", _raiser(
|
|
HTTPError("u", 500, "Boom", {}, None)))
|
|
with pytest.raises(http.Offline):
|
|
http.get_json("https://pub.dev/api/packages/x")
|
|
|
|
|
|
def test_a_transport_error_degrades_to_offline(monkeypatch):
|
|
_reachable(monkeypatch)
|
|
monkeypatch.setattr(http, "urlopen", _raiser(URLError("reset")))
|
|
with pytest.raises(http.Offline):
|
|
http.get_json("https://pub.dev/api/packages/x")
|
|
|
|
|
|
def test_a_successful_body_is_decoded(monkeypatch):
|
|
_reachable(monkeypatch)
|
|
monkeypatch.setattr(http, "urlopen", lambda *a, **k: _Response(b'{"a": 1}'))
|
|
assert http.get_json("https://pub.dev/x", accept="application/json") == {"a": 1}
|
|
|
|
|
|
def test_undecodable_json_degrades_to_offline(monkeypatch):
|
|
_reachable(monkeypatch)
|
|
monkeypatch.setattr(http, "urlopen", lambda *a, **k: _Response(b"not json"))
|
|
with pytest.raises(http.Offline):
|
|
http.get_json("https://pub.dev/x")
|
|
|
|
|
|
def _refuse(*_args, **_kwargs):
|
|
raise OSError("connection refused")
|
|
|
|
|
|
def _reachable(monkeypatch):
|
|
monkeypatch.setattr(http, "host_reachable", lambda _url: True)
|
|
|
|
|
|
def _raiser(error):
|
|
def raise_it(*_args, **_kwargs):
|
|
raise error
|
|
return raise_it
|
|
|
|
|
|
class _Response:
|
|
def __init__(self, body: bytes) -> None:
|
|
self._body = body
|
|
|
|
def read(self) -> bytes:
|
|
return self._body
|
|
|
|
def __enter__(self):
|
|
return self
|
|
|
|
def __exit__(self, *_exc):
|
|
return False
|