mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-11 18:14:00 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
96 lines
3.2 KiB
Python
96 lines
3.2 KiB
Python
"""The remaining branches: defensive paths, and output shapes.
|
|
|
|
These are the lines a happy-path suite never reaches -- a corrupt input, a
|
|
missing binary, the discretionary half of a report block. They are exactly
|
|
where a gate quietly stops gating, so they are covered deliberately.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import date, timedelta
|
|
import io
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
import pytest
|
|
|
|
from dep_freshness import check, discover, report, resolve
|
|
from dep_freshness.allowlist import _parse_date, load
|
|
from dep_freshness.models import Dep, Exception_, Finding, Severity
|
|
from dep_freshness.registries import cargo, gomod, pub, pypi
|
|
from dep_freshness.registries.http import Offline
|
|
from dep_freshness.tests.conftest import write
|
|
from dep_freshness.versions import newest_stable, parse
|
|
|
|
|
|
def test_yaml_parses_an_unquoted_date_natively():
|
|
"""`expires: 2026-10-15` without quotes arrives as a `datetime.date`."""
|
|
when = date(2026, 10, 15)
|
|
assert _parse_date(when, "x") == when
|
|
|
|
|
|
def test_an_unquoted_expiry_in_yaml_is_accepted(tmp_path):
|
|
when = (date.today() + timedelta(days=10)).isoformat()
|
|
write(tmp_path, "dependency-freshness.allowlist.yaml", f"""\
|
|
exceptions:
|
|
- ecosystem: pypi
|
|
package: x
|
|
pinned: "1.0.0"
|
|
reason: "held"
|
|
blocked_by: "discretionary"
|
|
expires: {when}
|
|
""")
|
|
assert load(tmp_path)[0].expires == when
|
|
|
|
|
|
def test_a_discretionary_entry_has_no_blocker_tuple():
|
|
entry = Exception_("pypi", "x", "1.0.0", "r", "discretionary", expires="2026-10-15")
|
|
assert entry.blocker is None
|
|
|
|
|
|
@pytest.mark.parametrize("module", [cargo, gomod, pub, pypi])
|
|
def test_a_missing_package_is_none_everywhere(monkeypatch, module):
|
|
monkeypatch.setattr(module, "get_json", lambda *_a, **_k: None)
|
|
assert module.latest("nope") is None
|
|
|
|
|
|
def test_pypi_matches_a_version_inside_a_hyphenated_filename(monkeypatch):
|
|
monkeypatch.setattr(pypi, "get_json", lambda *_a, **_k: {
|
|
"versions": ["1.0.0"],
|
|
"files": [{"filename": "my-pkg-1.0.0-py3-none-any.whl", "yanked": False}],
|
|
})
|
|
assert pypi.latest("my-pkg") == "1.0.0"
|
|
|
|
|
|
def test_pypi_ignores_a_file_whose_version_it_cannot_place(monkeypatch):
|
|
monkeypatch.setattr(pypi, "get_json", lambda *_a, **_k: {
|
|
"versions": ["1.0.0"],
|
|
"files": [{"filename": "junk.txt", "yanked": False}],
|
|
})
|
|
assert pypi.latest("pkg") == "1.0.0"
|
|
|
|
|
|
def test_a_semver_prerelease_that_pep440_rejects_still_parses():
|
|
assert parse("1.2.3-a.b.c") == parse("1.2.3")
|
|
|
|
|
|
def test_a_string_that_is_no_kind_of_version_does_not_parse():
|
|
assert parse("stable") is None
|
|
assert parse("1.2.3.4.5-!!!") is None
|
|
|
|
|
|
def test_newest_stable_ignores_a_lower_candidate():
|
|
assert newest_stable(["2.0.0", "1.0.0"]) == "2.0.0"
|
|
|
|
|
|
def test_a_constraint_bound_that_will_not_parse_is_permissive():
|
|
from dep_freshness.constraints import _clause
|
|
assert _clause(">=", "not-a-version", parse("1.0.0"))
|
|
|
|
|
|
def test_a_toolchain_pin_at_latest_passes():
|
|
from dep_freshness.evaluate import judge
|
|
dep = Dep(ecosystem="toolchain", name="flutter", constraint="3.47.2",
|
|
path=Path(".fvmrc"), line=1, pinned="3.47.2")
|
|
assert judge(dep, resolve.Answer("3.47.2")) is None
|