mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 21:27:14 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
106 lines
3.2 KiB
Python
106 lines
3.2 KiB
Python
"""Registry adapters, driven by fixtures rather than the live internet.
|
|
|
|
Each ecosystem has one documented way to leak a pre-release into "latest";
|
|
these tests are the only thing that catches that, because a leak fails *green*
|
|
and the end-to-end run reports the repo as up to date.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from dep_freshness.registries import cargo, gomod, npmjs, pub, pypi
|
|
|
|
|
|
@pytest.fixture
|
|
def answer(monkeypatch):
|
|
"""Install a canned payload for the next `get_json` call."""
|
|
def install(payload, module):
|
|
monkeypatch.setattr(module, "get_json", lambda *_a, **_k: payload)
|
|
return install
|
|
|
|
|
|
def test_npm_rejects_a_prerelease_published_to_dist_tags_latest(answer):
|
|
answer({
|
|
"dist-tags": {"latest": "3.0.0-rc.1"},
|
|
"versions": {"2.4.1": {}, "3.0.0-rc.1": {}},
|
|
}, npmjs)
|
|
assert npmjs.latest("some-pkg") == "2.4.1"
|
|
|
|
|
|
def test_npm_uses_dist_tags_when_it_is_stable(answer):
|
|
answer({"dist-tags": {"latest": "5.1.0"}, "versions": {"5.1.0": {}}}, npmjs)
|
|
assert npmjs.latest("some-pkg") == "5.1.0"
|
|
|
|
|
|
def test_npm_missing_package_is_none(answer):
|
|
answer(None, npmjs)
|
|
assert npmjs.latest("nope") is None
|
|
|
|
|
|
def test_cargo_prefers_max_stable_over_max_version(answer):
|
|
answer({"crate": {"max_version": "2.0.0-beta.3",
|
|
"max_stable_version": "1.0.229"}}, cargo)
|
|
assert cargo.latest("serde") == "1.0.229"
|
|
|
|
|
|
def test_cargo_falls_back_to_unyanked_versions(answer):
|
|
answer({
|
|
"crate": {},
|
|
"versions": [{"num": "1.2.0", "yanked": True}, {"num": "1.1.0"}],
|
|
}, cargo)
|
|
assert cargo.latest("thing") == "1.1.0"
|
|
|
|
|
|
def test_pub_uses_latest_when_stable(answer):
|
|
answer({"latest": {"version": "1.6.0"}}, pub)
|
|
assert pub.latest("http") == "1.6.0"
|
|
|
|
|
|
def test_pub_falls_back_when_latest_is_a_prerelease(answer):
|
|
answer({
|
|
"latest": {"version": "2.0.0-dev.1"},
|
|
"versions": [{"version": "1.9.0"}, {"version": "2.0.0-dev.1"}],
|
|
}, pub)
|
|
assert pub.latest("thing") == "1.9.0"
|
|
|
|
|
|
def test_pypi_skips_versions_whose_files_are_all_yanked(answer):
|
|
answer({
|
|
"versions": ["1.0.0", "1.1.0"],
|
|
"files": [
|
|
{"filename": "pkg-1.0.0-py3-none-any.whl", "yanked": False},
|
|
{"filename": "pkg-1.1.0-py3-none-any.whl", "yanked": True},
|
|
{"filename": "pkg-1.1.0.tar.gz", "yanked": True},
|
|
],
|
|
}, pypi)
|
|
assert pypi.latest("pkg") == "1.0.0"
|
|
|
|
|
|
def test_pypi_ignores_prereleases(answer):
|
|
answer({
|
|
"versions": ["1.0.0", "2.0.0rc1"],
|
|
"files": [
|
|
{"filename": "pkg-1.0.0.tar.gz", "yanked": False},
|
|
{"filename": "pkg-2.0.0rc1.tar.gz", "yanked": False},
|
|
],
|
|
}, pypi)
|
|
assert pypi.latest("pkg") == "1.0.0"
|
|
|
|
|
|
def test_pypi_falls_back_to_the_version_list_without_files(answer):
|
|
answer({"versions": ["1.0.0", "1.4.2"]}, pypi)
|
|
assert pypi.latest("pkg") == "1.4.2"
|
|
|
|
|
|
def test_go_rejects_incompatible_and_prerelease(answer):
|
|
answer({"Version": "v3.0.0+incompatible"}, gomod)
|
|
assert gomod.latest("example.com/m") is None
|
|
answer({"Version": "v1.2.0-rc1"}, gomod)
|
|
assert gomod.latest("example.com/m") is None
|
|
|
|
|
|
def test_go_strips_the_v_prefix(answer):
|
|
answer({"Version": "v1.9.4"}, gomod)
|
|
assert gomod.latest("example.com/m") == "1.9.4"
|