| 1 | // End-to-end: a real `wrangler dev` Worker, the real git CLI and the real runner agent. |
| 2 | // |
| 3 | // pnpm --filter @diffinery/runner build && pnpm --filter @diffinery/app e2e |
| 4 | // |
| 5 | // Covers: token auth, repo creation, git push/clone/fetch (protocol v2), push |
| 6 | // protection, workflows triggered by push and pull_request and executed by a |
| 7 | // self-hosted runner (the same agent that runs in Cloudflare Containers), |
| 8 | // check runs, branch protection with required checks and human review for |
| 9 | // agent-authored PRs, merging, the REST contents API, the MCP server and |
| 10 | // profile pictures (WASM image processing in the Worker). |
| 11 | import { spawn, spawnSync, execFileSync } from "node:child_process"; |
| 12 | import { mkdtempSync, writeFileSync, mkdirSync, readFileSync, existsSync, rmSync } from "node:fs"; |
| 13 | import { tmpdir } from "node:os"; |
| 14 | import { randomBytes } from "node:crypto"; |
| 15 | import { join, dirname, resolve } from "node:path"; |
| 16 | import { fileURLToPath } from "node:url"; |
| 17 | import { createServer } from "node:net"; |
| 18 | import { crc32, deflateSync } from "node:zlib"; |
| 19 | import { test, before, after } from "node:test"; |
| 20 | import assert from "node:assert/strict"; |
| 21 | |
| 22 | const APP = resolve(dirname(fileURLToPath(import.meta.url)), "../.."); |
| 23 | const AGENT = resolve(APP, "../../containers/runner/dist/agent.mjs"); |
| 24 | const work = mkdtempSync(join(tmpdir(), "diffinery-e2e-")); |
| 25 | let base; |
| 26 | let dev; |
| 27 | let devLog = ""; |
| 28 | let token; |
| 29 | let agentToken; |
| 30 | |
| 31 | const freePort = () => |
| 32 | new Promise((res) => { |
| 33 | const s = createServer(); |
| 34 | s.listen(0, "127.0.0.1", () => { |
| 35 | const { port } = s.address(); |
| 36 | s.close(() => res(port)); |
| 37 | }); |
| 38 | }); |
| 39 | |
| 40 | async function api(method, path, body, tok = token) { |
| 41 | const res = await fetch(`${base}/api/v3${path}`, { |
| 42 | method, |
| 43 | headers: { authorization: `Bearer ${tok}`, "content-type": "application/json" }, |
| 44 | body: body === undefined ? undefined : JSON.stringify(body), |
| 45 | }); |
| 46 | const text = await res.text(); |
| 47 | let json = null; |
| 48 | try { |
| 49 | json = text ? JSON.parse(text) : null; |
| 50 | } catch { |
| 51 | json = text; |
| 52 | } |
| 53 | return { status: res.status, json }; |
| 54 | } |
| 55 | async function ok(method, path, body, tok) { |
| 56 | const r = await api(method, path, body, tok); |
| 57 | assert.ok(r.status >= 200 && r.status < 300, `${method} ${path} -> ${r.status} ${JSON.stringify(r.json)}`); |
| 58 | return r.json; |
| 59 | } |
| 60 | |
| 61 | function git(cwd, args, tok = token, opts = {}) { |
| 62 | const auth = Buffer.from(`x-token:${tok}`).toString("base64"); |
| 63 | return execFileSync("git", ["-c", `http.extraHeader=Authorization: Basic ${auth}`, "-c", "protocol.version=2", ...args], { |
| 64 | cwd, |
| 65 | encoding: "utf8", |
| 66 | stdio: ["ignore", "pipe", "pipe"], |
| 67 | env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_AUTHOR_NAME: "E2E", GIT_AUTHOR_EMAIL: "e2e@example.com", GIT_COMMITTER_NAME: "E2E", GIT_COMMITTER_EMAIL: "e2e@example.com" }, |
| 68 | ...opts, |
| 69 | }); |
| 70 | } |
| 71 | function gitFails(cwd, args, tok) { |
| 72 | try { |
| 73 | git(cwd, args, tok); |
| 74 | } catch (e) { |
| 75 | return `${e.stdout ?? ""}${e.stderr ?? ""}`; |
| 76 | } |
| 77 | assert.fail(`expected git ${args.join(" ")} to fail`); |
| 78 | } |
| 79 | |
| 80 | const sleep = (ms) => new Promise((r) => setTimeout(r, ms)); |
| 81 | async function until(what, fn, timeoutMs = 60_000) { |
| 82 | const end = Date.now() + timeoutMs; |
| 83 | let last; |
| 84 | while (Date.now() < end) { |
| 85 | last = await fn(); |
| 86 | if (last) return last; |
| 87 | await sleep(500); |
| 88 | } |
| 89 | assert.fail(`timed out waiting for ${what}\n--- wrangler log tail ---\n${devLog.slice(-4000)}`); |
| 90 | } |
| 91 | |
| 92 | function spawnAsync(cmd, args, env, timeoutMs) { |
| 93 | return new Promise((done) => { |
| 94 | const child = spawn(cmd, args, { env: { ...process.env, ...env } }); |
| 95 | let stdout = ""; |
| 96 | let stderr = ""; |
| 97 | child.stdout.on("data", (d) => (stdout += d)); |
| 98 | child.stderr.on("data", (d) => (stderr += d)); |
| 99 | const t = setTimeout(() => child.kill("SIGKILL"), timeoutMs); |
| 100 | child.on("close", (status) => { |
| 101 | clearTimeout(t); |
| 102 | done({ status, stdout, stderr }); |
| 103 | }); |
| 104 | }); |
| 105 | } |
| 106 | |
| 107 | /** Claim one waiting self-hosted job and run it with the real agent. */ |
| 108 | async function runOneJob(owner, repo, { allowFailure = false } = {}) { |
| 109 | const claim = await until("a job to claim", async () => { |
| 110 | const r = await api("POST", `/repos/${owner}/${repo}/actions/runners/claim`, { name: "e2e", labels: ["linux"] }); |
| 111 | return r.status === 200 ? r.json : null; |
| 112 | }); |
| 113 | const jobEnv = { DIFFINERY_API_URL: claim.api_url, DIFFINERY_JOB_ID: claim.job_id, DIFFINERY_JOB_TOKEN: claim.token }; |
| 114 | // E2E_RUNNER_IMAGE runs the job inside the real runner image instead of the local agent bundle. |
| 115 | const image = process.env.E2E_RUNNER_IMAGE; |
| 116 | // Spawned asynchronously: a blocked event loop leaves undici holding keep-alive sockets the server already closed. |
| 117 | const r = image |
| 118 | ? await spawnAsync("docker", ["run", "--rm", "--network", "host", ...Object.entries(jobEnv).flatMap(([k, v]) => ["-e", `${k}=${v}`]), image], {}, 300_000) |
| 119 | : await spawnAsync(process.execPath, [AGENT], { ...process.env, ...jobEnv, DIFFINERY_WORK_ROOT: join(work, `job-${claim.job_id}`) }, 180_000); |
| 120 | const out = `${r.stdout}${r.stderr}`; |
| 121 | if (r.status !== 0 && !allowFailure) { |
| 122 | const log = await fetch(`${base}/api/v3/repos/${owner}/${repo}/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } }).then((x) => x.text(), (e) => String(e)); |
| 123 | const job = await api("GET", `/repos/${owner}/${repo}/actions/jobs/${claim.job_id}`).catch((e) => ({ json: String(e) })); |
| 124 | assert.fail(`runner agent exited ${r.status}:\n${out}\n--- job ---\n${JSON.stringify(job.json, null, 2)}\n--- job log ---\n${log}\n--- wrangler log tail ---\n${devLog.slice(-3000)}`); |
| 125 | } |
| 126 | return { claim, out }; |
| 127 | } |
| 128 | |
| 129 | before(async () => { |
| 130 | assert.ok(existsSync(AGENT), `build the runner first: pnpm --filter @diffinery/runner build (missing ${AGENT})`); |
| 131 | const port = await freePort(); |
| 132 | base = `http://127.0.0.1:${port}`; |
| 133 | const persist = join(work, "state"); |
| 134 | execFileSync("pnpm", ["exec", "wrangler", "d1", "migrations", "apply", "diffinery-dev", "--local", "-e", "dev", "--persist-to", persist], { cwd: APP, stdio: "pipe", env: { ...process.env, CI: "1" } }); |
| 135 | // Until the web UI exists, run the same app through the API-only entry. |
| 136 | const entry = existsSync(join(APP, "src/web/routes.tsx")) ? [] : ["test/e2e/entry.ts"]; |
| 137 | dev = spawn("pnpm", ["exec", "wrangler", "dev", ...entry, "-e", "dev", "--ip", "127.0.0.1", "--port", String(port), "--persist-to", persist, "--var", `PUBLIC_URL:${base}`, "--var", `MASTER_KEY:${randomBytes(32).toString("base64")}`, "--show-interactive-dev-session=false"], { |
| 138 | cwd: APP, |
| 139 | env: { ...process.env, CI: "1", WRANGLER_SEND_METRICS: "false" }, |
| 140 | stdio: ["ignore", "pipe", "pipe"], |
| 141 | detached: true, |
| 142 | }); |
| 143 | dev.stdout.on("data", (d) => (devLog += d)); |
| 144 | dev.stderr.on("data", (d) => (devLog += d)); |
| 145 | await until("wrangler dev", async () => { |
| 146 | try { |
| 147 | return (await fetch(`${base}/healthz`)).ok; |
| 148 | } catch { |
| 149 | return false; |
| 150 | } |
| 151 | }, 120_000); |
| 152 | // DEV_AUTH signs requests without credentials in as dev@diffinery.local; mint a real token for everything else. |
| 153 | const res = await fetch(`${base}/api/v3/diffinery/tokens`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "e2e", scopes: ["admin"] }) }); |
| 154 | assert.equal(res.status, 201, await res.clone().text()); |
| 155 | token = (await res.json()).token; |
| 156 | }); |
| 157 | |
| 158 | after(() => { |
| 159 | if (dev?.pid) { |
| 160 | try { |
| 161 | process.kill(-dev.pid, "SIGTERM"); |
| 162 | } catch {} |
| 163 | } |
| 164 | if (process.env.E2E_KEEP !== "1") rmSync(work, { recursive: true, force: true }); |
| 165 | }); |
| 166 | |
| 167 | test("git hosting, Actions, protected PR flow and MCP", async () => { |
| 168 | const me = await ok("GET", "/user"); |
| 169 | const owner = me.login; |
| 170 | assert.ok(me.site_admin, "dev user is a bootstrap admin"); |
| 171 | |
| 172 | // ------------------------------------------------------------ repo + first push |
| 173 | const repo = await ok("POST", "/user/repos", { name: "demo", description: "e2e" }); |
| 174 | assert.equal(repo.full_name, `${owner}/demo`); |
| 175 | const src = join(work, "src"); |
| 176 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 177 | writeFileSync(join(src, "README.md"), "# demo\n"); |
| 178 | writeFileSync(join(src, "app.txt"), "one\ntwo\nthree\n"); |
| 179 | writeFileSync( |
| 180 | join(src, ".github/workflows/ci.yml"), |
| 181 | `name: CI |
| 182 | on: |
| 183 | push: |
| 184 | branches: [main] |
| 185 | pull_request: |
| 186 | jobs: |
| 187 | build: |
| 188 | runs-on: [self-hosted, linux] |
| 189 | steps: |
| 190 | - uses: actions/checkout@v4 |
| 191 | - name: Check files |
| 192 | run: | |
| 193 | test -f README.md |
| 194 | echo "event=\${{ github.event_name }} sha=\${{ github.sha }}" |
| 195 | grep -q bad app.txt && { echo "found bad line"; exit 1; } || true |
| 196 | - id: out |
| 197 | run: echo "lines=$(wc -l < app.txt | tr -d ' ')" >> "$GITHUB_OUTPUT" |
| 198 | - run: echo "app.txt has \${{ steps.out.outputs.lines }} lines" |
| 199 | `, |
| 200 | ); |
| 201 | git(src, ["init", "-q", "-b", "main"]); |
| 202 | git(src, ["add", "-A"]); |
| 203 | git(src, ["commit", "-q", "-m", "initial"]); |
| 204 | git(src, ["remote", "add", "origin", `${base}/${owner}/demo.git`]); |
| 205 | git(src, ["push", "-q", "origin", "main"]); |
| 206 | const mainSha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 207 | |
| 208 | const branch = await ok("GET", `/repos/${owner}/demo/branches/main`); |
| 209 | assert.equal(branch.commit.sha, mainSha); |
| 210 | |
| 211 | // ------------------------------------------------------------ the push ran CI on a self-hosted runner |
| 212 | const pushRun = await until("push run", async () => (await ok("GET", `/repos/${owner}/demo/actions/runs?event=push`)).workflow_runs[0]); |
| 213 | assert.equal(pushRun.head_sha, mainSha); |
| 214 | const job1 = await runOneJob(owner, "demo"); |
| 215 | const finished = await until("push run to complete", async () => { |
| 216 | const r = await ok("GET", `/repos/${owner}/demo/actions/runs/${pushRun.id}`); |
| 217 | return r.status === "completed" ? r : null; |
| 218 | }); |
| 219 | assert.equal(finished.conclusion, "success", job1.out); |
| 220 | const logs = await (await fetch(`${base}/api/v3/repos/${owner}/demo/actions/jobs/${job1.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 221 | assert.match(logs, /event=push/); |
| 222 | assert.match(logs, /app\.txt has 3 lines/); |
| 223 | const checks = await ok("GET", `/repos/${owner}/demo/commits/${mainSha}/check-runs`); |
| 224 | assert.equal(checks.check_runs.find((c) => c.name === "CI / build")?.conclusion, "success"); |
| 225 | |
| 226 | // ------------------------------------------------------------ clone over protocol v2 |
| 227 | const clone = join(work, "clone"); |
| 228 | git(work, ["clone", "-q", `${base}/${owner}/demo.git`, clone]); |
| 229 | assert.equal(readFileSync(join(clone, "app.txt"), "utf8"), "one\ntwo\nthree\n"); |
| 230 | |
| 231 | // ------------------------------------------------------------ secrets are blocked on push |
| 232 | // The key below is a fake that push protection must block in the pushed file; this |
| 233 | // marker exempts only the test source itself: diffinery:allow-secret |
| 234 | writeFileSync(join(clone, "config.env"), "AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPL3\n"); |
| 235 | git(clone, ["add", "-A"]); |
| 236 | git(clone, ["commit", "-q", "-m", "oops"]); |
| 237 | assert.match(gitFails(clone, ["push", "origin", "main"]), /secret|AWS/i); |
| 238 | // Objects from a blocked push are not kept, so retrying (even with push negotiation) is blocked too. |
| 239 | assert.match(gitFails(clone, ["-c", "push.negotiate=true", "push", "origin", "HEAD:refs/heads/fixture"]), /secret|AWS/i); |
| 240 | // A repository admin can push anyway by giving a reason; the bypass is audited. |
| 241 | assert.match(gitFails(clone, ["push", "-o", "allow-secrets=", "origin", "HEAD:refs/heads/fixture"]), /secret|AWS/i); |
| 242 | git(clone, ["push", "-q", "-o", "allow-secrets=fake key used by this test", "origin", "HEAD:refs/heads/fixture"]); |
| 243 | assert.ok((await ok("GET", `/repos/${owner}/demo/branches`)).some((b) => b.name === "fixture")); |
| 244 | git(clone, ["push", "-q", "origin", ":refs/heads/fixture"]); |
| 245 | git(clone, ["reset", "-q", "--hard", "origin/main"]); |
| 246 | |
| 247 | // ------------------------------------------------------------ protect main: PR + green CI + review |
| 248 | await ok("PUT", `/repos/${owner}/demo/branches/main/protection`, { |
| 249 | requirePullRequest: true, |
| 250 | requiredApprovals: 0, |
| 251 | dismissStaleReviews: true, |
| 252 | requiredChecks: ["CI / build"], |
| 253 | allowForcePush: false, |
| 254 | allowDeletion: false, |
| 255 | requireLinearHistory: false, |
| 256 | enforceAdmins: true, |
| 257 | agentsMayPush: false, |
| 258 | agentsMayMerge: false, |
| 259 | }); |
| 260 | writeFileSync(join(clone, "app.txt"), "one\ntwo\nthree\nfour\n"); |
| 261 | git(clone, ["commit", "-q", "-am", "direct push"]); |
| 262 | assert.match(gitFails(clone, ["push", "origin", "main"]), /pull request|protected/i); |
| 263 | git(clone, ["reset", "-q", "--hard", "origin/main"]); |
| 264 | |
| 265 | // ------------------------------------------------------------ an AI agent opens a PR |
| 266 | const created = await ok("POST", "/diffinery/agents", { login: "e2e-bot", name: "E2E Bot" }); |
| 267 | agentToken = created.token.token; |
| 268 | const agentClone = join(work, "agent"); |
| 269 | git(work, ["clone", "-q", `${base}/${owner}/demo.git`, agentClone], agentToken); |
| 270 | git(agentClone, ["checkout", "-q", "-b", "feature"], agentToken); |
| 271 | writeFileSync(join(agentClone, "app.txt"), "one\ntwo\nthree\nfour\n"); |
| 272 | git(agentClone, ["commit", "-q", "-am", "Add a fourth line"], agentToken); |
| 273 | assert.match(gitFails(agentClone, ["push", "origin", "HEAD:main"], agentToken), /agent|protected|pull request/i); |
| 274 | // push.negotiate=true makes git run a protocol v2 fetch with wait-for-done before pushing. |
| 275 | const negotiated = spawnSync("git", ["-c", `http.extraHeader=Authorization: Basic ${Buffer.from(`x-token:${agentToken}`).toString("base64")}`, "-c", "protocol.version=2", "-c", "push.negotiate=true", "push", "-q", "origin", "feature"], { cwd: agentClone, encoding: "utf8", env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } }); |
| 276 | assert.equal(negotiated.status, 0, negotiated.stderr); |
| 277 | assert.doesNotMatch(negotiated.stderr, /negotiation failed|unexpected/i); |
| 278 | const pr = await ok("POST", `/repos/${owner}/demo/pulls`, { title: "Add a fourth line", head: "feature", base: "main", intent: "Extend app.txt for the e2e test" }, agentToken); |
| 279 | assert.equal(pr.number, 1); |
| 280 | |
| 281 | // The pull_request run executes; until then the PR is blocked on the required check. |
| 282 | let m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 283 | assert.equal(m.mergeable, false); |
| 284 | await runOneJob(owner, "demo"); |
| 285 | await until("PR check to pass", async () => { |
| 286 | const r = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 287 | return r.checks?.length > 0 && r.checks.every((c) => c.state === "success") ? r : null; |
| 288 | }); |
| 289 | m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 290 | assert.equal(m.mergeable, false, "agent-authored PRs need a human approval"); |
| 291 | assert.ok(JSON.stringify(m.blockers).match(/approv|human/i), JSON.stringify(m.blockers)); |
| 292 | |
| 293 | // The agent cannot approve or merge its own work. |
| 294 | const agentMerge = await api("PUT", `/repos/${owner}/demo/pulls/1/merge`, { merge_method: "squash" }, agentToken); |
| 295 | assert.ok([403, 405, 409].includes(agentMerge.status), JSON.stringify(agentMerge)); |
| 296 | |
| 297 | // Another agent's approval is advisory and does not unblock the merge. |
| 298 | const reviewer = (await ok("POST", "/diffinery/agents", { login: "e2e-reviewer" })).token.token; |
| 299 | await ok("POST", `/repos/${owner}/demo/pulls/1/reviews`, { event: "APPROVE", body: "bot says ok" }, reviewer); |
| 300 | assert.equal((await ok("GET", `/repos/${owner}/demo/pulls/1/merge`)).mergeable, false); |
| 301 | |
| 302 | // A human reviews (line comment + approval) and merges. |
| 303 | await ok("POST", `/repos/${owner}/demo/pulls/1/reviews`, { event: "APPROVE", body: "LGTM", comments: [{ path: "app.txt", line: 4, body: "nice line" }] }); |
| 304 | m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 305 | assert.equal(m.mergeable, true, JSON.stringify(m)); |
| 306 | const merged = await ok("PUT", `/repos/${owner}/demo/pulls/1/merge`, { merge_method: "squash", delete_branch: true }); |
| 307 | assert.ok(merged.sha); |
| 308 | const prAfter = await ok("GET", `/repos/${owner}/demo/pulls/1`); |
| 309 | assert.equal(prAfter.merged, true); |
| 310 | |
| 311 | // ------------------------------------------------------------ fetch the merge, read through REST |
| 312 | git(clone, ["pull", "-q", "--ff-only", "origin", "main"]); |
| 313 | assert.equal(readFileSync(join(clone, "app.txt"), "utf8"), "one\ntwo\nthree\nfour\n"); |
| 314 | const content = await ok("GET", `/repos/${owner}/demo/contents/app.txt`); |
| 315 | assert.equal(Buffer.from(content.content, "base64").toString(), "one\ntwo\nthree\nfour\n"); |
| 316 | const branches = await ok("GET", `/repos/${owner}/demo/branches`); |
| 317 | assert.ok(!branches.some((b) => b.name === "feature"), "head branch deleted after merge"); |
| 318 | |
| 319 | // ------------------------------------------------------------ shallow clone, then deepen |
| 320 | const shallow = join(work, "shallow"); |
| 321 | git(work, ["clone", "-q", "--depth", "1", `${base}/${owner}/demo.git`, shallow]); |
| 322 | assert.equal(git(shallow, ["rev-list", "--count", "HEAD"]).trim(), "1"); |
| 323 | assert.equal(readFileSync(join(shallow, "app.txt"), "utf8"), "one\ntwo\nthree\nfour\n"); |
| 324 | git(shallow, ["fetch", "-q", "--unshallow"]); |
| 325 | assert.equal(git(shallow, ["rev-list", "--count", "HEAD"]).trim(), "2"); |
| 326 | git(shallow, ["fsck", "--no-progress"]); |
| 327 | |
| 328 | // ------------------------------------------------------------ MCP: the agent works without git |
| 329 | const rpc = async (method, params, id = 1) => { |
| 330 | const r = await fetch(`${base}/mcp`, { method: "POST", headers: { authorization: `Bearer ${agentToken}`, "content-type": "application/json", accept: "application/json, text/event-stream" }, body: JSON.stringify({ jsonrpc: "2.0", id, method, params }) }); |
| 331 | assert.equal(r.status, 200); |
| 332 | return (await r.json()).result; |
| 333 | }; |
| 334 | const init = await rpc("initialize", { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "e2e", version: "1" } }); |
| 335 | assert.equal(init.serverInfo.name, "diffinery"); |
| 336 | const tools = await rpc("tools/list", {}); |
| 337 | assert.ok(tools.tools.some((t) => t.name === "commit_files")); |
| 338 | const file = await rpc("tools/call", { name: "get_file", arguments: { owner, repo: "demo", path: "README.md" } }); |
| 339 | assert.equal(file.isError, false); |
| 340 | assert.equal(file.structuredContent.content, "# demo\n"); |
| 341 | const commit = await rpc("tools/call", { name: "commit_files", arguments: { owner, repo: "demo", branch: "mcp-change", create_branch_from: "main", message: "Edit via MCP", files: [{ path: "docs/notes.md", content: "hello\n" }] } }); |
| 342 | assert.equal(commit.isError, false, JSON.stringify(commit)); |
| 343 | const blocked = await rpc("tools/call", { name: "commit_files", arguments: { owner, repo: "demo", branch: "main", message: "sneaky", files: [{ path: "x", content: "y" }] } }); |
| 344 | assert.equal(blocked.isError, true); |
| 345 | const opened = await rpc("tools/call", { name: "create_pull_request", arguments: { owner, repo: "demo", title: "Notes", head: "mcp-change", intent: "Add notes" } }); |
| 346 | assert.equal(opened.isError, false, JSON.stringify(opened)); |
| 347 | assert.equal(opened.structuredContent.number, 2); |
| 348 | |
| 349 | // ------------------------------------------------------------ web UI renders the same data (signed in via DEV_AUTH) |
| 350 | for (const path of ["/", `/${owner}`, `/${owner}/demo`, `/${owner}/demo/blob/main/app.txt`, `/${owner}/demo/commits/main`, `/${owner}/demo/pulls`, `/${owner}/demo/pull/1`, `/${owner}/demo/pull/1/files`, `/${owner}/demo/actions`, `/${owner}/demo/actions/runs/${pushRun.id}`, `/${owner}/demo/actions/runs/${pushRun.id}/job/${job1.claim.job_id}`, `/${owner}/demo/settings/branches`, "/settings/tokens"]) { |
| 351 | const res = await fetch(`${base}${path}`); |
| 352 | const html = await res.text(); |
| 353 | assert.equal(res.status, 200, `${path} -> ${res.status}\n${html.slice(0, 500)}`); |
| 354 | assert.match(res.headers.get("content-type") ?? "", /text\/html/, path); |
| 355 | } |
| 356 | assert.match(await (await fetch(`${base}/${owner}/demo/pull/1`)).text(), /Add a fourth line/); |
| 357 | const forged = await fetch(`${base}/${owner}/demo/issues/1/comment`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", origin: "https://evil.example", "sec-fetch-site": "cross-site" }, body: "body=hi" }); |
| 358 | assert.equal(forged.status, 403); |
| 359 | |
| 360 | // ------------------------------------------------------------ the CLI against the same server |
| 361 | const CLI = resolve(APP, "../cli/dist/diffinery.mjs"); |
| 362 | if (existsSync(CLI)) { |
| 363 | const cli = (...args) => execFileSync(process.execPath, [CLI, ...args], { encoding: "utf8", cwd: clone, env: { ...process.env, DIFFINERY_URL: base, DIFFINERY_TOKEN: token, NO_COLOR: "1", XDG_CONFIG_HOME: join(work, "cfg") } }); |
| 364 | assert.match(cli("whoami"), new RegExp(owner)); |
| 365 | const prs = JSON.parse(cli("pr", "list", "--state", "all", "--json")); |
| 366 | assert.ok(prs.some((p) => p.number === 1)); |
| 367 | assert.match(cli("workflow", "validate"), /ci\.yml/); |
| 368 | } |
| 369 | |
| 370 | // The commit made through MCP carries the agent's identity. |
| 371 | const agentCommit = await ok("GET", `/repos/${owner}/demo/commits/mcp-change`); |
| 372 | assert.match(JSON.stringify(agentCommit), /e2e-bot/); |
| 373 | }); |
| 374 | |
| 375 | test("reusable workflows: inputs, secrets, outputs, nesting and skipped calls", async () => { |
| 376 | const owner = (await ok("GET", "/user")).login; |
| 377 | await ok("POST", "/user/repos", { name: "reuse" }); |
| 378 | await api("PUT", `/repos/${owner}/reuse/actions/secrets/TOPSECRET`, { value: "s3cret" }); |
| 379 | const src = join(work, "reuse"); |
| 380 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 381 | writeFileSync( |
| 382 | join(src, ".github/workflows/lib.yml"), |
| 383 | `on: |
| 384 | workflow_call: |
| 385 | inputs: |
| 386 | greeting: { type: string, required: true } |
| 387 | loud: { type: boolean, default: false } |
| 388 | secrets: |
| 389 | TOPSECRET: { required: true } |
| 390 | outputs: |
| 391 | word: |
| 392 | value: \${{ jobs.shout.outputs.word }} |
| 393 | jobs: |
| 394 | say: |
| 395 | runs-on: [self-hosted, linux] |
| 396 | outputs: |
| 397 | word: \${{ steps.s.outputs.word }} |
| 398 | steps: |
| 399 | - id: s |
| 400 | run: echo "word=\${{ inputs.greeting }}-there" >> "$GITHUB_OUTPUT" |
| 401 | - run: echo "secret ok=\${{ secrets.TOPSECRET == 's3cret' }} loud=\${{ inputs.loud }} job=\${{ github.job }}" |
| 402 | shout: |
| 403 | needs: say |
| 404 | runs-on: [self-hosted, linux] |
| 405 | outputs: |
| 406 | word: \${{ steps.s.outputs.word }} |
| 407 | steps: |
| 408 | - id: s |
| 409 | run: echo "word=\${{ needs.say.outputs.word }}!" >> "$GITHUB_OUTPUT" |
| 410 | `, |
| 411 | ); |
| 412 | writeFileSync( |
| 413 | join(src, ".github/workflows/main.yml"), |
| 414 | `name: Main |
| 415 | on: push |
| 416 | jobs: |
| 417 | call: |
| 418 | name: Greeter |
| 419 | uses: ./.github/workflows/lib.yml |
| 420 | with: |
| 421 | greeting: \${{ github.event_name == 'push' && 'hi' || 'no' }} |
| 422 | loud: true |
| 423 | secrets: inherit |
| 424 | nope: |
| 425 | if: \${{ false }} |
| 426 | uses: ./.github/workflows/lib.yml |
| 427 | with: |
| 428 | greeting: never |
| 429 | secrets: |
| 430 | TOPSECRET: \${{ secrets.TOPSECRET }} |
| 431 | after: |
| 432 | needs: [call, nope] |
| 433 | if: \${{ always() }} |
| 434 | runs-on: [self-hosted, linux] |
| 435 | steps: |
| 436 | - run: echo "got=\${{ needs.call.outputs.word }} call=\${{ needs.call.result }} nope=\${{ needs.nope.result }}" |
| 437 | `, |
| 438 | ); |
| 439 | git(src, ["init", "-q", "-b", "main"]); |
| 440 | git(src, ["add", "."]); |
| 441 | git(src, ["commit", "-q", "-m", "reusable"]); |
| 442 | git(src, ["remote", "add", "origin", `${base}/${owner}/reuse.git`]); |
| 443 | git(src, ["push", "-q", "origin", "main"]); |
| 444 | |
| 445 | const run = await until("reuse run", async () => (await ok("GET", `/repos/${owner}/reuse/actions/runs`)).workflow_runs[0]); |
| 446 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/reuse/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 447 | const say = await runOneJob(owner, "reuse"); |
| 448 | assert.equal(say.claim.name, "Greeter / say"); |
| 449 | const sayLog = await logOf(say.claim.job_id); |
| 450 | assert.match(sayLog, /secret ok=true loud=true job=say/); |
| 451 | assert.doesNotMatch(sayLog, /s3cret/); |
| 452 | const shout = await runOneJob(owner, "reuse"); |
| 453 | assert.equal(shout.claim.name, "Greeter / shout"); |
| 454 | const after = await runOneJob(owner, "reuse"); |
| 455 | assert.equal(after.claim.name, "after"); |
| 456 | assert.match(await logOf(after.claim.job_id), /got=hi-there! call=success nope=skipped/); |
| 457 | const done = await until("reuse run to complete", async () => { |
| 458 | const r = await ok("GET", `/repos/${owner}/reuse/actions/runs/${run.id}`); |
| 459 | return r.status === "completed" ? r : null; |
| 460 | }); |
| 461 | assert.equal(done.conclusion, "success"); |
| 462 | const jobs = (await ok("GET", `/repos/${owner}/reuse/actions/runs/${run.id}/jobs`)).jobs; |
| 463 | assert.deepEqual(jobs.filter((j) => j.conclusion === "skipped").map((j) => j.name).sort(), ["nope / say", "nope / shout"]); |
| 464 | }); |
| 465 | |
| 466 | test("workflow_run: a workflow follows another one on the default branch", async () => { |
| 467 | const owner = (await ok("GET", "/user")).login; |
| 468 | await ok("POST", "/user/repos", { name: "chain" }); |
| 469 | const src = join(work, "chain"); |
| 470 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 471 | writeFileSync(join(src, ".github/workflows/ci.yml"), `name: CI\non: push\njobs:\n build:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo built\n`); |
| 472 | writeFileSync( |
| 473 | join(src, ".github/workflows/after.yml"), |
| 474 | `name: After CI |
| 475 | on: |
| 476 | workflow_run: |
| 477 | workflows: [CI] |
| 478 | types: [completed] |
| 479 | branches: [main] |
| 480 | jobs: |
| 481 | report: |
| 482 | if: \${{ github.event.workflow_run.conclusion == 'success' }} |
| 483 | runs-on: [self-hosted, linux] |
| 484 | steps: |
| 485 | - run: echo "followed \${{ github.event.workflow_run.name }} on \${{ github.event.workflow_run.head_branch }} (\${{ github.event.action }}) ref=\${{ github.ref }}" |
| 486 | `, |
| 487 | ); |
| 488 | git(src, ["init", "-q", "-b", "main"]); |
| 489 | git(src, ["add", "."]); |
| 490 | git(src, ["commit", "-q", "-m", "chain"]); |
| 491 | git(src, ["remote", "add", "origin", `${base}/${owner}/chain.git`]); |
| 492 | git(src, ["push", "-q", "origin", "main"]); |
| 493 | |
| 494 | const runs = async () => (await ok("GET", `/repos/${owner}/chain/actions/runs`)).workflow_runs; |
| 495 | await until("CI run", async () => (await runs()).find((r) => r.name === "CI")); |
| 496 | assert.equal((await runs()).length, 1, "only CI runs before it completes"); |
| 497 | const build = await runOneJob(owner, "chain"); |
| 498 | assert.equal(build.claim.name, "build"); |
| 499 | const follower = await until("follower run", async () => (await runs()).find((r) => r.event === "workflow_run")); |
| 500 | assert.equal(follower.name, "After CI"); |
| 501 | assert.equal(follower.head_branch, "main"); |
| 502 | const report = await runOneJob(owner, "chain"); |
| 503 | assert.equal(report.claim.name, "report"); |
| 504 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/chain/actions/jobs/${report.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 505 | assert.match(log, /followed CI on main \(completed\) ref=refs\/heads\/main/); |
| 506 | const done = await until("follower to complete", async () => { |
| 507 | const r = await ok("GET", `/repos/${owner}/chain/actions/runs/${follower.id}`); |
| 508 | return r.status === "completed" ? r : null; |
| 509 | }); |
| 510 | assert.equal(done.conclusion, "success"); |
| 511 | assert.equal((await runs()).length, 2, "the follower does not trigger itself"); |
| 512 | }); |
| 513 | |
| 514 | test("pull requests: test merge commits, pull_request_target and the merge queue", async () => { |
| 515 | const owner = (await ok("GET", "/user")).login; |
| 516 | await ok("POST", "/user/repos", { name: "queue" }); |
| 517 | await api("PUT", `/repos/${owner}/queue/actions/secrets/TOPSECRET`, { value: "s3cret" }); |
| 518 | const src = join(work, "queue"); |
| 519 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 520 | writeFileSync(join(src, "app.txt"), "a\nb\nc\n"); |
| 521 | writeFileSync( |
| 522 | join(src, ".github/workflows/ci.yml"), |
| 523 | `name: CI |
| 524 | on: |
| 525 | pull_request: |
| 526 | merge_group: |
| 527 | jobs: |
| 528 | test: |
| 529 | runs-on: [self-hosted, linux] |
| 530 | steps: |
| 531 | - uses: actions/checkout@v4 |
| 532 | - run: | |
| 533 | echo "event=\${{ github.event_name }} ref=\${{ github.ref }} sha=\${{ github.sha }} head=$(git rev-parse HEAD)" |
| 534 | echo "parents=$(git rev-list --parents -n1 HEAD)" |
| 535 | echo "app=$(tr '\\n' ' ' < app.txt)" |
| 536 | if [ "\${{ github.event_name }}" = merge_group ] && grep -qs fail notes.txt; then echo "merge group failed"; exit 1; fi |
| 537 | `, |
| 538 | ); |
| 539 | writeFileSync( |
| 540 | join(src, ".github/workflows/target.yml"), |
| 541 | `name: Target |
| 542 | on: pull_request_target |
| 543 | jobs: |
| 544 | t: |
| 545 | runs-on: [self-hosted, linux] |
| 546 | steps: |
| 547 | - run: echo "target from base secret=\${{ secrets.TOPSECRET == 's3cret' }} ref=\${{ github.ref }} head=\${{ github.event.pull_request.head.sha }}" |
| 548 | `, |
| 549 | ); |
| 550 | git(src, ["init", "-q", "-b", "main"]); |
| 551 | git(src, ["add", "."]); |
| 552 | git(src, ["commit", "-q", "-m", "queue"]); |
| 553 | git(src, ["remote", "add", "origin", `${base}/${owner}/queue.git`]); |
| 554 | git(src, ["push", "-q", "origin", "main"]); |
| 555 | const root = git(src, ["rev-parse", "HEAD"]).trim(); |
| 556 | |
| 557 | // f1 changes the first line and tries to rewrite the pull_request_target workflow. |
| 558 | git(src, ["checkout", "-q", "-b", "f1"]); |
| 559 | writeFileSync(join(src, "app.txt"), "A\nb\nc\n"); |
| 560 | writeFileSync(join(src, ".github/workflows/target.yml"), `name: Target\non: pull_request_target\njobs:\n t:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo "PWNED \${{ secrets.TOPSECRET }}"\n`); |
| 561 | git(src, ["commit", "-q", "-am", "f1"]); |
| 562 | git(src, ["push", "-q", "origin", "f1"]); |
| 563 | const f1 = git(src, ["rev-parse", "HEAD"]).trim(); |
| 564 | // main moves on, so the test merge commit differs from both sides. |
| 565 | git(src, ["checkout", "-q", "main"]); |
| 566 | writeFileSync(join(src, "app.txt"), "a\nb\nC\n"); |
| 567 | git(src, ["commit", "-q", "-am", "main moves"]); |
| 568 | git(src, ["push", "-q", "origin", "main"]); |
| 569 | const main1 = git(src, ["rev-parse", "HEAD"]).trim(); |
| 570 | |
| 571 | const pr1 = await ok("POST", `/repos/${owner}/queue/pulls`, { title: "Capitalise a", head: "f1", base: "main" }); |
| 572 | const runs = async (q = "") => (await ok("GET", `/repos/${owner}/queue/actions/runs${q}`)).workflow_runs; |
| 573 | const prRun = await until("pull_request run", async () => (await runs("?event=pull_request"))[0]); |
| 574 | assert.equal(prRun.ref, "refs/pull/1/merge"); |
| 575 | assert.equal(prRun.head_sha, f1, "pull_request runs report on the PR head"); |
| 576 | assert.notEqual(prRun.sha, f1, "pull_request runs check out the test merge commit"); |
| 577 | assert.equal(prRun.head_branch, "f1"); |
| 578 | const targetRun = (await runs("?event=pull_request_target"))[0]; |
| 579 | assert.equal(targetRun.ref, "refs/heads/main"); |
| 580 | assert.equal(targetRun.sha, main1, "pull_request_target runs on the base commit"); |
| 581 | assert.equal(targetRun.head_sha, f1); |
| 582 | // The merge ref is fetchable and its parents are [base, head]; refs/pull is read-only. |
| 583 | git(src, ["fetch", "-q", "origin", "+refs/pull/1/merge:refs/remotes/pr/1"]); |
| 584 | assert.equal(git(src, ["rev-parse", "refs/remotes/pr/1"]).trim(), prRun.sha); |
| 585 | assert.equal(git(src, ["rev-list", "--parents", "-n1", "refs/remotes/pr/1"]).trim(), `${prRun.sha} ${main1} ${f1}`); |
| 586 | assert.match(gitFails(src, ["push", "origin", `${root}:refs/pull/1/head`]), /refs\/pull|managed/); |
| 587 | |
| 588 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/queue/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 589 | const ran = {}; |
| 590 | for (let i = 0; i < 2; i++) { |
| 591 | const j = await runOneJob(owner, "queue"); |
| 592 | ran[j.claim.name] = await logOf(j.claim.job_id); |
| 593 | } |
| 594 | assert.match(ran.test, new RegExp(`event=pull_request ref=refs/pull/1/merge sha=${prRun.sha} head=${prRun.sha}`)); |
| 595 | assert.match(ran.test, /app=A b C/); |
| 596 | assert.match(ran.t, /target from base secret=true ref=refs\/heads\/main/); |
| 597 | assert.match(ran.t, new RegExp(`head=${f1}`)); |
| 598 | assert.doesNotMatch(ran.t, /PWNED/); |
| 599 | await until("PR #1 checks", async () => { |
| 600 | const c = (await ok("GET", `/repos/${owner}/queue/commits/${f1}/check-runs`)).check_runs; |
| 601 | return c.length === 2 && c.every((x) => x.conclusion === "success") ? c : null; |
| 602 | }); |
| 603 | |
| 604 | // ------------------------------------------------------------ merge queue |
| 605 | await ok("PUT", `/repos/${owner}/queue/branches/main/protection`, { requirePullRequest: true, requiredChecks: ["CI / test"], mergeQueue: { method: "merge", buildConcurrency: 5, checkTimeoutMinutes: 30 } }); |
| 606 | const direct = await api("PUT", `/repos/${owner}/queue/pulls/1/merge`, {}); |
| 607 | assert.equal(direct.status, 405); |
| 608 | assert.match(JSON.stringify(direct.json), /merge queue/); |
| 609 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1/merge`)).mergeQueue.method, "merge"); |
| 610 | |
| 611 | // Two more pull requests: one that merges cleanly and one that fails only in its merge group. |
| 612 | const branch = async (name, file, content) => { |
| 613 | git(src, ["checkout", "-q", "-b", name, main1]); |
| 614 | writeFileSync(join(src, file), content); |
| 615 | git(src, ["add", "."]); |
| 616 | git(src, ["commit", "-q", "-m", name]); |
| 617 | git(src, ["push", "-q", "origin", name]); |
| 618 | const sha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 619 | const pr = await ok("POST", `/repos/${owner}/queue/pulls`, { title: name, head: name, base: "main" }); |
| 620 | for (let i = 0; i < 2; i++) await runOneJob(owner, "queue"); |
| 621 | await until(`${name} checks`, async () => (await ok("GET", `/repos/${owner}/queue/commits/${sha}/check-runs`)).check_runs.filter((x) => x.conclusion === "success").length === 2); |
| 622 | return { pr, sha }; |
| 623 | }; |
| 624 | const f2 = await branch("f2", "two.txt", "two\n"); |
| 625 | const f3 = await branch("f3", "notes.txt", "fail\n"); |
| 626 | |
| 627 | const q1 = await ok("PUT", `/repos/${owner}/queue/pulls/1/merge-queue`, { delete_branch: true }); |
| 628 | assert.equal(q1.state, "queued"); |
| 629 | assert.equal(q1.entry.position, 1); |
| 630 | assert.equal(q1.entry.state, "checking"); |
| 631 | const q2 = await ok("PUT", `/repos/${owner}/queue/pulls/${f2.pr.number}/merge-queue`, {}); |
| 632 | const q3 = await ok("PUT", `/repos/${owner}/queue/pulls/${f3.pr.number}/merge-queue`, {}); |
| 633 | assert.equal(q2.entry.merge_group.base_sha, q1.entry.merge_group.head_sha, "each group builds on the one ahead"); |
| 634 | assert.equal(q3.entry.merge_group.base_sha, q2.entry.merge_group.head_sha); |
| 635 | assert.equal(q1.entry.merge_group.head_ref, `refs/heads/gh-readonly-queue/main/pr-1-${f1}`); |
| 636 | const queue = await ok("GET", `/repos/${owner}/queue/merge-queue/main`); |
| 637 | assert.deepEqual(queue.entries.map((e) => e.number), [1, f2.pr.number, f3.pr.number]); |
| 638 | assert.match(gitFails(src, ["push", "origin", `${root}:refs/heads/gh-readonly-queue/main/x`]), /read-only/); |
| 639 | |
| 640 | // Merge groups run merge_group workflows, oldest first. |
| 641 | const groupLogs = []; |
| 642 | for (let i = 0; i < 3; i++) { |
| 643 | const j = await runOneJob(owner, "queue", { allowFailure: i === 2 }); |
| 644 | groupLogs.push(await logOf(j.claim.job_id)); |
| 645 | } |
| 646 | assert.match(groupLogs[0], new RegExp(`event=merge_group ref=refs/heads/gh-readonly-queue/main/pr-1-${f1} sha=${q1.entry.merge_group.head_sha}`)); |
| 647 | assert.match(groupLogs[2], /merge group failed/); |
| 648 | const mainNow = await until("the queue to merge #1 and #2", async () => { |
| 649 | const b = await ok("GET", `/repos/${owner}/queue/branches/main`); |
| 650 | return b.commit.sha === q2.entry.merge_group.head_sha ? b : null; |
| 651 | }); |
| 652 | assert.ok(mainNow); |
| 653 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1`)).merged, true); |
| 654 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/${f2.pr.number}`)).merged, true); |
| 655 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1`)).merge_commit_sha, q1.entry.merge_group.head_sha, "the tested commit is what merged"); |
| 656 | const f3After = await until("#3 to leave the queue", async () => { |
| 657 | const q = await ok("GET", `/repos/${owner}/queue/merge-queue/main`); |
| 658 | return q.entries.length === 0 ? q : null; |
| 659 | }); |
| 660 | assert.ok(f3After); |
| 661 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/${f3.pr.number}`)).merged, false); |
| 662 | const comments = await ok("GET", `/repos/${owner}/queue/issues/${f3.pr.number}/comments`); |
| 663 | assert.match(JSON.stringify(comments), /removed from the merge queue: the required check 'CI \/ test' failed on its merge group/); |
| 664 | git(src, ["fetch", "-q", "origin"]); |
| 665 | assert.equal(git(src, ["show", "origin/main:app.txt"]), "A\nb\nC\n"); |
| 666 | assert.equal(git(src, ["show", "origin/main:two.txt"]), "two\n"); |
| 667 | assert.ok(!(await ok("GET", `/repos/${owner}/queue/branches`)).some((b) => b.name.startsWith("gh-readonly-queue/") || b.name === "f1"), "group branches and f1 are gone"); |
| 668 | |
| 669 | // A pull request that conflicts with its base runs no pull_request workflows (like GitHub), only pull_request_target. |
| 670 | git(src, ["checkout", "-q", "-b", "f4", root]); |
| 671 | writeFileSync(join(src, "app.txt"), "x\nb\nc\n"); |
| 672 | git(src, ["commit", "-q", "-am", "f4"]); |
| 673 | git(src, ["push", "-q", "origin", "f4"]); |
| 674 | const pr4 = await ok("POST", `/repos/${owner}/queue/pulls`, { title: "conflicts", head: "f4", base: "main" }); |
| 675 | const t4 = await until("pull_request_target run for #4", async () => (await runs("?event=pull_request_target")).find((r) => r.pull_request_number === pr4.number)); |
| 676 | assert.ok(t4); |
| 677 | assert.equal((await runs("?event=pull_request")).filter((r) => r.pull_request_number === pr4.number).length, 0); |
| 678 | await runOneJob(owner, "queue"); |
| 679 | |
| 680 | // The web UI shows the queue. |
| 681 | const page = async (path) => { |
| 682 | const res = await fetch(`${base}${path}`); |
| 683 | assert.equal(res.status, 200, path); |
| 684 | return res.text(); |
| 685 | }; |
| 686 | assert.match(await page(`/${owner}/queue/queue/main`), /The queue is empty/); |
| 687 | assert.match(await page(`/${owner}/queue/pull/${pr4.number}`), /Merge when ready/); |
| 688 | assert.match(await page(`/${owner}/queue/pull/${f3.pr.number}`), /removed from the merge queue/); |
| 689 | assert.match(await page(`/${owner}/queue/settings/branches`), /merge queue/); |
| 690 | }); |
| 691 | |
| 692 | const hasDocker = spawnSync("docker", ["info"], { stdio: "ignore", timeout: 15_000 }).status === 0; |
| 693 | |
| 694 | test("containers: a job container and service containers on a self-hosted runner", { skip: !hasDocker && "Docker is not available" }, async () => { |
| 695 | const owner = (await ok("GET", "/user")).login; |
| 696 | await ok("POST", "/user/repos", { name: "boxes" }); |
| 697 | const src = join(work, "boxes"); |
| 698 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 699 | // Docker Hub rate-limits anonymous pulls; mirror.gcr.io serves the same official images. |
| 700 | writeFileSync( |
| 701 | join(src, ".github/workflows/ci.yml"), |
| 702 | `on: push |
| 703 | jobs: |
| 704 | boxed: |
| 705 | runs-on: [self-hosted, linux] |
| 706 | container: |
| 707 | image: mirror.gcr.io/library/debian:\${{ github.event_name == 'push' && 'bookworm-slim' || 'nope' }} |
| 708 | services: |
| 709 | cache: |
| 710 | image: mirror.gcr.io/library/redis:7-alpine |
| 711 | options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30 |
| 712 | steps: |
| 713 | - run: | |
| 714 | grep -q bookworm /etc/os-release && echo "inside debian" |
| 715 | exec 3<>/dev/tcp/cache/6379 |
| 716 | printf 'PING\\r\\n' >&3 |
| 717 | read -r line <&3 |
| 718 | echo "cache answered \${line%$'\\r'}" |
| 719 | `, |
| 720 | ); |
| 721 | git(src, ["init", "-q", "-b", "main"]); |
| 722 | git(src, ["add", "."]); |
| 723 | git(src, ["commit", "-q", "-m", "containers"]); |
| 724 | git(src, ["remote", "add", "origin", `${base}/${owner}/boxes.git`]); |
| 725 | git(src, ["push", "-q", "origin", "main"]); |
| 726 | |
| 727 | const run = await until("boxes run", async () => (await ok("GET", `/repos/${owner}/boxes/actions/runs`)).workflow_runs[0]); |
| 728 | const boxed = await runOneJob(owner, "boxes"); |
| 729 | assert.equal(boxed.claim.name, "boxed"); |
| 730 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/boxes/actions/jobs/${boxed.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 731 | assert.match(log, /inside debian/); |
| 732 | assert.match(log, /cache answered \+PONG/); |
| 733 | const done = await until("boxes run to complete", async () => { |
| 734 | const r = await ok("GET", `/repos/${owner}/boxes/actions/runs/${run.id}`); |
| 735 | return r.status === "completed" ? r : null; |
| 736 | }); |
| 737 | assert.equal(done.conclusion, "success"); |
| 738 | }); |
| 739 | |
| 740 | test("D1 sessions: bookmarks for token clients and browsers", async () => { |
| 741 | // Token clients get the bookmark in a header and can send it back to read their own writes. |
| 742 | const r = await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}` } }); |
| 743 | assert.equal(r.status, 200); |
| 744 | const bookmark = r.headers.get("x-d1-bookmark"); |
| 745 | assert.match(bookmark ?? "", /^[0-9a-f]+(-[0-9a-f]+)+$/i); |
| 746 | assert.equal(r.headers.get("set-cookie"), null); |
| 747 | const again = await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}`, "x-d1-bookmark": bookmark } }); |
| 748 | assert.equal(again.status, 200); |
| 749 | // A junk bookmark is ignored rather than breaking the request. |
| 750 | assert.equal((await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}`, "x-d1-bookmark": "nope" } })).status, 200); |
| 751 | // Anonymous page views don't get a cookie; a browser that writes (any non-GET) does. |
| 752 | assert.equal((await fetch(`${base}/`)).headers.get("set-cookie")?.includes("__Host-dfy_d1") ?? false, false); |
| 753 | const post = await fetch(`${base}/auth/logout`, { method: "POST", redirect: "manual", headers: { "sec-fetch-site": "same-origin" } }); |
| 754 | assert.match(post.headers.get("set-cookie") ?? "", /__Host-dfy_d1=[0-9a-f-]+; Max-Age=86400; Path=\/; HttpOnly; Secure; SameSite=Lax/); |
| 755 | }); |
| 756 | |
| 757 | test("GitHub REST compatibility: Octokit against releases, statuses, git data, issues, deployments and search", async () => { |
| 758 | const { Octokit } = await import("@octokit/rest"); |
| 759 | const gh = new Octokit({ auth: token, baseUrl: `${base}/api/v3`, userAgent: "diffinery-e2e", request: { retries: 0 } }); |
| 760 | const owner = (await gh.rest.users.getAuthenticated()).data.login; |
| 761 | const repo = "compat"; |
| 762 | const R = { owner, repo }; |
| 763 | |
| 764 | // ------------------------------------------------------------ repository, pushed with git |
| 765 | const created = await gh.rest.repos.createForAuthenticatedUser({ name: repo, description: "Octokit compatibility" }); |
| 766 | assert.equal(created.status, 201); |
| 767 | assert.equal(created.data.full_name, `${owner}/${repo}`); |
| 768 | assert.match(created.data.node_id, /\S/); |
| 769 | assert.equal(created.data.owner.login, owner); |
| 770 | const src = join(work, "compat"); |
| 771 | mkdirSync(join(src, "src"), { recursive: true }); |
| 772 | writeFileSync(join(src, "README.md"), "# compat\n"); |
| 773 | writeFileSync(join(src, "src/main.ts"), "export const x = 1;\n"); |
| 774 | git(src, ["init", "-q", "-b", "main"]); |
| 775 | git(src, ["add", "-A"]); |
| 776 | git(src, ["commit", "-q", "-m", "initial"]); |
| 777 | git(src, ["remote", "add", "origin", `${base}/${owner}/${repo}.git`]); |
| 778 | git(src, ["push", "-q", "origin", "main"]); |
| 779 | const mainSha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 780 | |
| 781 | const r = await gh.rest.repos.get(R); |
| 782 | assert.equal(r.data.default_branch, "main"); |
| 783 | assert.equal(r.data.permissions.admin, true); |
| 784 | assert.equal(r.headers["x-github-media-type"], "github.v3; format=json"); |
| 785 | const rate = await gh.rest.rateLimit.get(); |
| 786 | assert.ok(rate.data.resources.core.remaining > 0); |
| 787 | |
| 788 | // GitHub error bodies: message and documentation_url, surfaced by Octokit's RequestError. |
| 789 | await assert.rejects(gh.rest.repos.getContent({ ...R, path: "missing.txt" }), (e) => e.status === 404 && typeof e.response.data.message === "string" && typeof e.response.data.documentation_url === "string"); |
| 790 | |
| 791 | // ------------------------------------------------------------ contents |
| 792 | const readme = await gh.rest.repos.getContent({ ...R, path: "README.md" }); |
| 793 | assert.equal(readme.data.type, "file"); |
| 794 | assert.equal(Buffer.from(readme.data.content, "base64").toString(), "# compat\n"); |
| 795 | const rawReadme = await gh.rest.repos.getContent({ ...R, path: "README.md", mediaType: { format: "raw" } }); |
| 796 | assert.equal(rawReadme.data, "# compat\n"); |
| 797 | const dir = await gh.rest.repos.getContent({ ...R, path: "src" }); |
| 798 | assert.deepEqual(dir.data.map((e) => e.name), ["main.ts"]); |
| 799 | await assert.rejects(gh.rest.repos.createOrUpdateFileContents({ ...R, path: "README.md", message: "stale", content: Buffer.from("x").toString("base64"), sha: "0".repeat(40) }), (e) => e.status === 409); |
| 800 | const put = await gh.rest.repos.createOrUpdateFileContents({ ...R, path: "README.md", message: "Update README", content: Buffer.from("# compat\n\nUpdated.\n").toString("base64"), sha: readme.data.sha, committer: { name: "Release Bot", email: "bot@example.com" } }); |
| 801 | assert.equal(put.status, 200); |
| 802 | assert.equal(put.data.commit.committer.name, "Release Bot"); |
| 803 | const added = await gh.rest.repos.createOrUpdateFileContents({ ...R, path: "docs/guide.md", message: "Add guide", content: Buffer.from("guide\n").toString("base64") }); |
| 804 | assert.equal(added.status, 201); |
| 805 | const readmeApi = await gh.rest.repos.getReadme(R); |
| 806 | assert.equal(readmeApi.data.path, "README.md"); |
| 807 | |
| 808 | // ------------------------------------------------------------ git data: blob -> tree -> commit -> ref, then git sees it |
| 809 | const headSha = (await gh.rest.git.getRef({ ...R, ref: "heads/main" })).data.object.sha; |
| 810 | assert.equal(headSha, added.data.commit.sha); |
| 811 | const blob = await gh.rest.git.createBlob({ ...R, content: Buffer.from("made with the git data API\n").toString("base64"), encoding: "base64" }); |
| 812 | assert.equal(blob.status, 201); |
| 813 | assert.equal(Buffer.from((await gh.rest.git.getBlob({ ...R, file_sha: blob.data.sha })).data.content, "base64").toString(), "made with the git data API\n"); |
| 814 | const headCommit = await gh.rest.git.getCommit({ ...R, commit_sha: headSha }); |
| 815 | const tree = await gh.rest.git.createTree({ ...R, base_tree: headCommit.data.tree.sha, tree: [{ path: "gitdata/hello.txt", mode: "100644", type: "blob", sha: blob.data.sha }, { path: "inline.txt", mode: "100644", type: "blob", content: "inline\n" }] }); |
| 816 | const full = await gh.rest.git.getTree({ ...R, tree_sha: tree.data.sha, recursive: "true" }); |
| 817 | assert.ok(full.data.tree.some((e) => e.path === "gitdata/hello.txt" && e.type === "blob")); |
| 818 | assert.ok(full.data.tree.some((e) => e.path === "src/main.ts")); |
| 819 | const commit = await gh.rest.git.createCommit({ ...R, message: "Commit from the git data API", tree: tree.data.sha, parents: [headSha], author: { name: "Octo Cat", email: "octo@example.com", date: "2024-05-06T07:08:09Z" } }); |
| 820 | assert.equal(commit.data.author.name, "Octo Cat"); |
| 821 | assert.deepEqual(commit.data.parents.map((p) => p.sha), [headSha]); |
| 822 | const ref = await gh.rest.git.createRef({ ...R, ref: "refs/heads/feature", sha: commit.data.sha }); |
| 823 | assert.equal(ref.data.ref, "refs/heads/feature"); |
| 824 | assert.equal(ref.data.object.type, "commit"); |
| 825 | await assert.rejects(gh.rest.git.createRef({ ...R, ref: "refs/heads/feature", sha: commit.data.sha }), (e) => e.status === 422); |
| 826 | const matching = await gh.rest.git.listMatchingRefs({ ...R, ref: "heads/f" }); |
| 827 | assert.deepEqual(matching.data.map((x) => x.ref), ["refs/heads/feature"]); |
| 828 | const tag = await gh.rest.git.createTag({ ...R, tag: "v0.1.0", message: "Annotated tag", object: commit.data.sha, type: "commit", tagger: { name: "Octo Cat", email: "octo@example.com", date: "2024-05-06T07:08:09Z" } }); |
| 829 | await gh.rest.git.createRef({ ...R, ref: "refs/tags/v0.1.0", sha: tag.data.sha }); |
| 830 | assert.equal((await gh.rest.git.getTag({ ...R, tag_sha: tag.data.sha })).data.object.sha, commit.data.sha); |
| 831 | assert.equal((await gh.rest.git.getRef({ ...R, ref: "tags/v0.1.0" })).data.object.type, "tag"); |
| 832 | git(src, ["fetch", "-q", "origin", "feature", "--tags"]); |
| 833 | assert.equal(git(src, ["show", "FETCH_HEAD:gitdata/hello.txt"]), "made with the git data API\n"); |
| 834 | assert.equal(git(src, ["cat-file", "-t", "v0.1.0"]).trim(), "tag"); |
| 835 | |
| 836 | // ------------------------------------------------------------ commit statuses count as checks, also for required checks |
| 837 | await ok("PUT", `/repos/${owner}/${repo}/branches/main/protection`, { requirePullRequest: true, requiredChecks: ["ci/external"] }); |
| 838 | const pr = await gh.rest.pulls.create({ ...R, title: "Feature", head: "feature", base: "main", body: "Adds files" }); |
| 839 | assert.equal(pr.status, 201); |
| 840 | const pending = await until("mergeability", async () => { |
| 841 | const p = (await gh.rest.pulls.get({ ...R, pull_number: pr.data.number })).data; |
| 842 | return typeof p.mergeable === "boolean" ? p : null; |
| 843 | }); |
| 844 | assert.equal(pending.mergeable, true); |
| 845 | assert.equal(pending.mergeable_state, "blocked"); |
| 846 | assert.equal(pending.head.sha, commit.data.sha); |
| 847 | const st = await gh.rest.repos.createCommitStatus({ ...R, sha: commit.data.sha, state: "success", context: "ci/external", description: "External CI passed", target_url: "https://ci.example.com/build/1" }); |
| 848 | assert.equal(st.status, 201); |
| 849 | assert.equal(st.data.creator.login, owner); |
| 850 | await assert.rejects(gh.rest.repos.createCommitStatus({ ...R, sha: commit.data.sha, state: "great" }), (e) => e.status === 422); |
| 851 | const combined = await gh.rest.repos.getCombinedStatusForRef({ ...R, ref: "feature" }); |
| 852 | assert.equal(combined.data.state, "success"); |
| 853 | assert.equal(combined.data.total_count, 1); |
| 854 | assert.equal(combined.data.statuses[0].context, "ci/external"); |
| 855 | assert.equal((await gh.rest.repos.listCommitStatusesForRef({ ...R, ref: commit.data.sha })).data.length, 1); |
| 856 | const clean = (await gh.rest.pulls.get({ ...R, pull_number: pr.data.number })).data; |
| 857 | assert.equal(clean.mergeable_state, "clean"); |
| 858 | const prPage = await (await fetch(`${base}/${owner}/${repo}/pull/${pr.data.number}/checks`)).text(); |
| 859 | assert.match(prPage, /ci\/external/); |
| 860 | assert.match(prPage, /https:\/\/ci\.example\.com\/build\/1/); |
| 861 | |
| 862 | // ------------------------------------------------------------ pull request sub-resources |
| 863 | const byHead = await gh.rest.pulls.list({ ...R, head: `${owner}:feature`, state: "open" }); |
| 864 | assert.deepEqual(byHead.data.map((p) => p.number), [pr.data.number]); |
| 865 | assert.equal((await gh.rest.pulls.list({ ...R, base: "other" })).data.length, 0); |
| 866 | const assoc = await gh.rest.repos.listPullRequestsAssociatedWithCommit({ ...R, commit_sha: commit.data.sha }); |
| 867 | assert.deepEqual(assoc.data.map((p) => p.number), [pr.data.number]); |
| 868 | const rc = await gh.rest.pulls.createReviewComment({ ...R, pull_number: pr.data.number, body: "Why this file?", commit_id: commit.data.sha, path: "inline.txt", line: 1, side: "RIGHT" }); |
| 869 | assert.equal(rc.status, 201); |
| 870 | assert.equal(rc.data.path, "inline.txt"); |
| 871 | const reply = await gh.rest.pulls.createReplyForReviewComment({ ...R, pull_number: pr.data.number, comment_id: rc.data.id, body: "For the test." }); |
| 872 | assert.equal(reply.data.in_reply_to_id, rc.data.id); |
| 873 | // Numeric ids, like GitHub's: actions parse them with Number() and pass them back. |
| 874 | assert.equal(typeof rc.data.id, "number"); |
| 875 | assert.equal(typeof rc.data.pull_request_review_id, "number"); |
| 876 | assert.equal((await gh.rest.pulls.listReviewComments({ ...R, pull_number: pr.data.number })).data.length, 2); |
| 877 | await gh.rest.reactions.createForPullRequestReviewComment({ ...R, comment_id: rc.data.id, content: "eyes" }); |
| 878 | const merged = await gh.rest.pulls.merge({ ...R, pull_number: pr.data.number, merge_method: "squash" }); |
| 879 | assert.equal(merged.data.merged, true); |
| 880 | const merges = await gh.rest.issues.listEventsForTimeline({ ...R, issue_number: pr.data.number }); |
| 881 | assert.ok(merges.data.some((e) => e.event === "merged")); |
| 882 | |
| 883 | // ------------------------------------------------------------ releases and assets |
| 884 | const rel = await gh.rest.repos.createRelease({ ...R, tag_name: "v1.0.0", target_commitish: "main", name: "First", generate_release_notes: true }); |
| 885 | assert.equal(rel.status, 201); |
| 886 | assert.match(rel.data.body, /Full Changelog/); |
| 887 | assert.match(rel.data.body, /Feature by @/); |
| 888 | assert.equal(rel.data.author.login, owner); |
| 889 | assert.match(rel.data.upload_url, /\/api\/uploads\/repos\/.+\/releases\/\d+\/assets\{\?name,label\}$/); |
| 890 | assert.match(git(src, ["ls-remote", "--tags", "origin"]), /refs\/tags\/v1\.0\.0/); |
| 891 | const bytes = Buffer.from("hello from a release asset\n"); |
| 892 | const up = await gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "hello.txt", label: "Greeting", data: bytes, url: rel.data.upload_url, headers: { "content-type": "text/plain", "content-length": bytes.length } }); |
| 893 | assert.equal(up.status, 201); |
| 894 | assert.equal(up.data.name, "hello.txt"); |
| 895 | assert.equal(up.data.size, bytes.length); |
| 896 | assert.equal(up.data.state, "uploaded"); |
| 897 | const bin = Buffer.from(randomBytes(70_000)); |
| 898 | const up2 = await gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "tool linux.bin", data: bin, baseUrl: `${base}/api/uploads`, headers: { "content-type": "application/octet-stream", "content-length": bin.length } }); |
| 899 | assert.equal(up2.data.name, "tool.linux.bin"); |
| 900 | await assert.rejects(gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "hello.txt", data: bytes, url: rel.data.upload_url, headers: { "content-type": "text/plain", "content-length": bytes.length } }), (e) => e.status === 422); |
| 901 | const viaApi = await gh.rest.repos.getReleaseAsset({ ...R, asset_id: up2.data.id, headers: { accept: "application/octet-stream" } }); |
| 902 | assert.deepEqual(Buffer.from(viaApi.data), bin); |
| 903 | const browser = await fetch(up.data.browser_download_url); |
| 904 | assert.equal(browser.status, 200); |
| 905 | assert.equal(await browser.text(), bytes.toString()); |
| 906 | assert.match(browser.headers.get("content-disposition") ?? "", /attachment/); |
| 907 | assert.equal((await gh.rest.repos.getReleaseAsset({ ...R, asset_id: up.data.id })).data.download_count, 1); |
| 908 | assert.deepEqual((await gh.rest.repos.listReleaseAssets({ ...R, release_id: rel.data.id })).data.map((a) => a.name), ["hello.txt", "tool.linux.bin"]); |
| 909 | assert.equal((await gh.rest.repos.updateReleaseAsset({ ...R, asset_id: up.data.id, label: "Hello" })).data.label, "Hello"); |
| 910 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.id, rel.data.id); |
| 911 | assert.equal((await gh.rest.repos.getReleaseByTag({ ...R, tag: "v1.0.0" })).data.assets.length, 2); |
| 912 | const notes = await gh.rest.repos.generateReleaseNotes({ ...R, tag_name: "v1.1.0", previous_tag_name: "v1.0.0" }); |
| 913 | assert.match(notes.data.body, /compare\/v1\.0\.0\.\.\.v1\.1\.0/); |
| 914 | await gh.rest.reactions.createForRelease({ ...R, release_id: rel.data.id, content: "rocket" }); |
| 915 | assert.equal((await gh.rest.repos.getRelease({ ...R, release_id: rel.data.id })).data.reactions.rocket, 1); |
| 916 | |
| 917 | // Drafts are for writers only; a read-only token sees neither the draft nor its tag lookup. |
| 918 | const draft = await gh.rest.repos.createRelease({ ...R, tag_name: "v2.0.0-rc.1", name: "Next", draft: true, prerelease: true }); |
| 919 | assert.equal(draft.data.draft, true); |
| 920 | const reader = await ok("POST", "/diffinery/tokens", { name: "reader", scopes: ["read"] }); |
| 921 | const ro = new Octokit({ auth: reader.token, baseUrl: `${base}/api/v3`, request: { retries: 0 } }); |
| 922 | assert.deepEqual((await ro.rest.repos.listReleases(R)).data.map((x) => x.tag_name), ["v1.0.0"]); |
| 923 | await assert.rejects(ro.rest.repos.getRelease({ ...R, release_id: draft.data.id }), (e) => e.status === 404); |
| 924 | await assert.rejects(ro.rest.repos.createRelease({ ...R, tag_name: "v9" }), (e) => e.status === 403 || e.status === 404); |
| 925 | const published = await gh.rest.repos.updateRelease({ ...R, release_id: draft.data.id, draft: false, make_latest: "false" }); |
| 926 | assert.equal(published.data.draft, false); |
| 927 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.tag_name, "v1.0.0"); |
| 928 | await gh.rest.repos.deleteReleaseAsset({ ...R, asset_id: up2.data.id }); |
| 929 | assert.equal((await fetch(`${base}/${owner}/${repo}/releases/download/v1.0.0/tool.linux.bin`)).status, 404); |
| 930 | await gh.rest.repos.deleteRelease({ ...R, release_id: published.data.id }); |
| 931 | await assert.rejects(gh.rest.repos.getReleaseByTag({ ...R, tag: "v2.0.0-rc.1" }), (e) => e.status === 404); |
| 932 | |
| 933 | // Archives |
| 934 | const zipball = await gh.rest.repos.downloadZipballArchive({ ...R, ref: "v1.0.0" }); |
| 935 | assert.equal(Buffer.from(zipball.data).subarray(0, 2).toString(), "PK"); |
| 936 | const tarball = await gh.rest.repos.downloadTarballArchive({ ...R, ref: "main" }); |
| 937 | assert.deepEqual([...Buffer.from(tarball.data).subarray(0, 2)], [0x1f, 0x8b]); |
| 938 | const tgz = join(work, "compat.tar.gz"); |
| 939 | writeFileSync(tgz, Buffer.from(tarball.data)); |
| 940 | assert.match(execFileSync("tar", ["tzf", tgz], { encoding: "utf8" }), /\/gitdata\/hello\.txt/); |
| 941 | |
| 942 | // The web UI: releases list, the release page and the form (CSRF, Kumo controls, multipart upload). |
| 943 | const list = await (await fetch(`${base}/${owner}/${repo}/releases`)).text(); |
| 944 | assert.match(list, /First/); |
| 945 | assert.match(list, /hello\.txt/); |
| 946 | const form = await fetch(`${base}/${owner}/${repo}/releases/new`); |
| 947 | const html = await form.text(); |
| 948 | assert.doesNotMatch(html, /<select|type="checkbox"|type="radio"/); |
| 949 | const csrf = /name="_csrf" value="([^"]+)"/.exec(html)?.[1]; |
| 950 | const cookie = /dfy_csrf=([^;]+)/.exec(form.headers.get("set-cookie") ?? "")?.[1]; |
| 951 | assert.ok(csrf && cookie); |
| 952 | const fd = new FormData(); |
| 953 | for (const [k, v] of Object.entries({ _csrf: csrf, tag: "", new_tag: "v3.0.0", target: "main", name: "From the web", body: "Notes from the form.", latest: "1", action: "publish" })) fd.append(k, v); |
| 954 | fd.append("assets", new Blob(["web upload\n"], { type: "text/plain" }), "web.txt"); |
| 955 | const submit = await fetch(`${base}/${owner}/${repo}/releases`, { method: "POST", body: fd, redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}` } }); |
| 956 | assert.equal(submit.status, 303, await submit.text()); |
| 957 | assert.equal(submit.headers.get("location"), `/${owner}/${repo}/releases/tag/v3.0.0`); |
| 958 | assert.equal(await (await fetch(`${base}/${owner}/${repo}/releases/download/v3.0.0/web.txt`)).text(), "web upload\n"); |
| 959 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.tag_name, "v3.0.0"); |
| 960 | assert.match(await (await fetch(`${base}/${owner}/${repo}`)).text(), /From the web/); |
| 961 | |
| 962 | // ------------------------------------------------------------ issues: labels, assignees, lock, reactions, events, pagination |
| 963 | await gh.rest.issues.createLabel({ ...R, name: "bug", color: "d73a4a", description: "Something is broken" }); |
| 964 | await assert.rejects(gh.rest.issues.createLabel({ ...R, name: "bug", color: "d73a4a" }), (e) => e.status === 422); |
| 965 | const issue = await gh.rest.issues.create({ ...R, title: "Crash on start", body: "It crashes.", labels: ["bug"], assignees: [owner] }); |
| 966 | assert.deepEqual(issue.data.labels.map((l) => [l.name, l.color]), [["bug", "d73a4a"]]); |
| 967 | assert.equal(issue.data.assignees[0].login, owner); |
| 968 | assert.equal(issue.data.user.login, owner); |
| 969 | assert.match(issue.data.html_url, new RegExp(`/${owner}/${repo}/issues/${issue.data.number}$`)); |
| 970 | const n = issue.data.number; |
| 971 | await gh.rest.issues.addLabels({ ...R, issue_number: n, labels: ["triage"] }); |
| 972 | assert.deepEqual((await gh.rest.issues.listLabelsOnIssue({ ...R, issue_number: n })).data.map((l) => l.name).sort(), ["bug", "triage"]); |
| 973 | await gh.rest.issues.removeLabel({ ...R, issue_number: n, name: "triage" }); |
| 974 | await gh.rest.issues.removeAssignees({ ...R, issue_number: n, assignees: [owner] }); |
| 975 | await gh.rest.issues.addAssignees({ ...R, issue_number: n, assignees: [owner] }); |
| 976 | assert.equal((await gh.rest.issues.checkUserCanBeAssigned({ ...R, assignee: owner })).status, 204); |
| 977 | const comment = await gh.rest.issues.createComment({ ...R, issue_number: n, body: "Same here." }); |
| 978 | assert.equal(typeof comment.data.id, "number"); |
| 979 | assert.equal((await gh.rest.issues.getComment({ ...R, comment_id: comment.data.id })).data.body, "Same here."); |
| 980 | await gh.rest.issues.updateComment({ ...R, comment_id: comment.data.id, body: "Same here!" }); |
| 981 | assert.equal((await gh.rest.issues.getComment({ ...R, comment_id: String(comment.data.id) })).data.body, "Same here!"); |
| 982 | await gh.rest.reactions.createForIssue({ ...R, issue_number: n, content: "+1" }); |
| 983 | const heart = await gh.rest.reactions.createForIssueComment({ ...R, comment_id: comment.data.id, content: "heart" }); |
| 984 | assert.equal(heart.status, 201); |
| 985 | assert.equal((await gh.rest.reactions.createForIssueComment({ ...R, comment_id: comment.data.id, content: "heart" })).status, 200); |
| 986 | assert.deepEqual((await gh.rest.reactions.listForIssue({ ...R, issue_number: n })).data.map((x) => x.content), ["+1"]); |
| 987 | assert.equal((await gh.rest.issues.get({ ...R, issue_number: n })).data.reactions["+1"], 1); |
| 988 | await gh.rest.issues.lock({ ...R, issue_number: n, lock_reason: "resolved" }); |
| 989 | const locked = await gh.rest.issues.get({ ...R, issue_number: n }); |
| 990 | assert.equal(locked.data.locked, true); |
| 991 | assert.equal(locked.data.active_lock_reason, "resolved"); |
| 992 | await gh.rest.issues.unlock({ ...R, issue_number: n }); |
| 993 | await gh.rest.issues.update({ ...R, issue_number: n, title: "Crash on startup", state: "closed", state_reason: "completed" }); |
| 994 | const events = (await gh.rest.issues.listEvents({ ...R, issue_number: n })).data.map((e) => e.event); |
| 995 | for (const e of ["labeled", "unlabeled", "unassigned", "assigned", "locked", "unlocked", "renamed", "closed"]) assert.ok(events.includes(e), `${e} in ${events}`); |
| 996 | const timeline = (await gh.rest.issues.listEventsForTimeline({ ...R, issue_number: n })).data; |
| 997 | assert.ok(timeline.some((e) => e.event === "commented" && e.body === "Same here!" && e.id === comment.data.id)); |
| 998 | assert.ok((await gh.rest.issues.listCommentsForRepo(R)).data.some((x) => x.id === comment.data.id)); |
| 999 | await gh.rest.issues.deleteComment({ ...R, comment_id: comment.data.id }); |
| 1000 | await assert.rejects(gh.rest.issues.getComment({ ...R, comment_id: comment.data.id }), (e) => e.status === 404); |
| 1001 | |
| 1002 | for (let i = 0; i < 3; i++) await gh.rest.issues.create({ ...R, title: `Paged ${i}` }); |
| 1003 | const page1 = await gh.rest.issues.listForRepo({ ...R, state: "all", per_page: 2 }); |
| 1004 | assert.equal(page1.data.length, 2); |
| 1005 | assert.match(page1.headers.link ?? "", /rel="next"/); |
| 1006 | const all = await gh.paginate(gh.rest.issues.listForRepo, { ...R, state: "all", per_page: 2 }); |
| 1007 | assert.equal(new Set(all.map((x) => x.number)).size, all.length); |
| 1008 | assert.ok(all.length >= 5, `paginated ${all.length} issues and pull requests`); |
| 1009 | |
| 1010 | // ------------------------------------------------------------ search, over readable repositories only |
| 1011 | const found = await until("issue search", async () => { |
| 1012 | const s = await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:issue label:bug crash` }); |
| 1013 | return s.data.total_count ? s.data : null; |
| 1014 | }); |
| 1015 | assert.deepEqual(found.items.map((x) => x.number), [n]); |
| 1016 | assert.equal((await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:pr is:merged` })).data.items[0].number, pr.data.number); |
| 1017 | assert.equal((await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:issue -label:bug Paged`, sort: "created", order: "asc" })).data.items.map((x) => x.title).join(","), "Paged 0,Paged 1,Paged 2"); |
| 1018 | await gh.rest.repos.replaceAllTopics({ ...R, names: ["octokit", "e2e"] }); |
| 1019 | assert.deepEqual((await gh.rest.repos.getAllTopics(R)).data.names, ["octokit", "e2e"]); |
| 1020 | const repos = await gh.rest.search.repos({ q: `topic:octokit user:${owner}` }); |
| 1021 | assert.deepEqual(repos.data.items.map((x) => x.full_name), [`${owner}/${repo}`]); |
| 1022 | assert.ok("TypeScript" in (await gh.rest.repos.listLanguages(R)).data); |
| 1023 | |
| 1024 | // ------------------------------------------------------------ deployments and environments |
| 1025 | const env = await gh.rest.repos.createOrUpdateEnvironment({ ...R, environment_name: "staging" }); |
| 1026 | assert.equal(env.data.name, "staging"); |
| 1027 | const dep = await gh.rest.repos.createDeployment({ ...R, ref: "main", environment: "staging", auto_merge: false, required_contexts: [], payload: { region: "eu" }, description: "Deploy to staging" }); |
| 1028 | assert.equal(dep.status, 201); |
| 1029 | assert.equal(dep.data.sha, (await gh.rest.git.getRef({ ...R, ref: "heads/main" })).data.object.sha); |
| 1030 | assert.deepEqual(dep.data.payload, { region: "eu" }); |
| 1031 | await gh.rest.repos.createDeploymentStatus({ ...R, deployment_id: dep.data.id, state: "in_progress" }); |
| 1032 | const ds = await gh.rest.repos.createDeploymentStatus({ ...R, deployment_id: dep.data.id, state: "success", environment_url: "https://staging.example.com", log_url: "https://ci.example.com/deploy/1" }); |
| 1033 | assert.equal(ds.data.state, "success"); |
| 1034 | assert.deepEqual((await gh.rest.repos.listDeploymentStatuses({ ...R, deployment_id: dep.data.id })).data.map((x) => x.state), ["success", "in_progress"]); |
| 1035 | assert.equal((await gh.rest.repos.listDeployments({ ...R, environment: "staging" })).data.length, 1); |
| 1036 | assert.ok((await gh.rest.repos.getAllEnvironments(R)).data.environments.some((e) => e.name === "staging")); |
| 1037 | await gh.rest.actions.createEnvironmentVariable({ ...R, environment_name: "staging", name: "REGION", value: "eu" }); |
| 1038 | assert.equal((await gh.rest.actions.getEnvironmentVariable({ ...R, environment_name: "staging", name: "REGION" })).data.value, "eu"); |
| 1039 | await gh.rest.repos.deleteAnEnvironment({ ...R, environment_name: "staging" }); |
| 1040 | |
| 1041 | // ------------------------------------------------------------ repository_dispatch and repository variables |
| 1042 | assert.equal((await gh.rest.repos.createDispatchEvent({ ...R, event_type: "deploy", client_payload: { env: "prod" } })).status, 204); |
| 1043 | await gh.rest.actions.createRepoVariable({ ...R, name: "COLOR", value: "blue" }); |
| 1044 | await gh.rest.actions.updateRepoVariable({ ...R, name: "COLOR", value: "green" }); |
| 1045 | assert.equal((await gh.rest.actions.getRepoVariable({ ...R, name: "COLOR" })).data.value, "green"); |
| 1046 | }); |
| 1047 | |
| 1048 | /** A small opaque RGBA PNG (a gradient), built by hand so the test needs no image tools. */ |
| 1049 | function pngGradient(width, height) { |
| 1050 | const chunk = (type, body) => { |
| 1051 | const out = Buffer.alloc(12 + body.length); |
| 1052 | out.writeUInt32BE(body.length, 0); |
| 1053 | out.write(type, 4, "latin1"); |
| 1054 | body.copy(out, 8); |
| 1055 | out.writeUInt32BE(crc32(out.subarray(4, 8 + body.length)), 8 + body.length); |
| 1056 | return out; |
| 1057 | }; |
| 1058 | const ihdr = Buffer.alloc(13); |
| 1059 | ihdr.writeUInt32BE(width, 0); |
| 1060 | ihdr.writeUInt32BE(height, 4); |
| 1061 | ihdr.set([8, 6, 0, 0, 0], 8); |
| 1062 | const raw = Buffer.alloc((width * 4 + 1) * height); |
| 1063 | for (let y = 0; y < height; y++) |
| 1064 | for (let x = 0; x < width; x++) raw.set([(x * 255) / width, (y * 255) / height, 128, 255], y * (width * 4 + 1) + 1 + x * 4); |
| 1065 | return Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]), chunk("IHDR", ihdr), chunk("IDAT", deflateSync(raw)), chunk("IEND", Buffer.alloc(0))]); |
| 1066 | } |
| 1067 | |
| 1068 | /** Width and height of a lossy or extended WebP, or null when it is not one. */ |
| 1069 | function webpSize(b) { |
| 1070 | if (b.toString("latin1", 0, 4) !== "RIFF" || b.toString("latin1", 8, 12) !== "WEBP") return null; |
| 1071 | const chunk = b.toString("latin1", 12, 16); |
| 1072 | if (chunk === "VP8 ") return { width: b.readUInt16LE(26) & 0x3fff, height: b.readUInt16LE(28) & 0x3fff }; |
| 1073 | if (chunk === "VP8X") return { width: b.readUIntLE(24, 3) + 1, height: b.readUIntLE(27, 3) + 1 }; |
| 1074 | return null; |
| 1075 | } |
| 1076 | |
| 1077 | test("people and profiles: visibility, repository invitations, blank names and usernames", async () => { |
| 1078 | const me = await ok("GET", "/user"); |
| 1079 | // A form post as the signed-in dev user, with the CSRF double-submit pair taken from `page`. |
| 1080 | const submit = async (page, action, fields) => { |
| 1081 | const res = await fetch(`${base}${page}`); |
| 1082 | const csrf = /name="_csrf" value="([^"]+)"/.exec(await res.text())?.[1]; |
| 1083 | const cookie = /dfy_csrf=([^;]+)/.exec(res.headers.get("set-cookie") ?? "")?.[1]; |
| 1084 | assert.ok(csrf && cookie, `no CSRF pair on ${page}`); |
| 1085 | return fetch(`${base}${action}`, { method: "POST", body: new URLSearchParams({ _csrf: csrf, ...fields }), redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}`, "sec-fetch-site": "same-origin" } }); |
| 1086 | }; |
| 1087 | const flashOf = (res) => decodeURIComponent(decodeURIComponent(res.headers.get("set-cookie") ?? "")); |
| 1088 | |
| 1089 | // "internal" is gone: creating and updating refuse it the same way. |
| 1090 | const created = await api("POST", "/user/repos", { name: "people-rules", visibility: "internal" }); |
| 1091 | assert.equal(created.status, 422); |
| 1092 | await ok("POST", "/user/repos", { name: "people-rules" }); |
| 1093 | const patched = await api("PATCH", `/repos/${me.login}/people-rules`, { visibility: "internal" }); |
| 1094 | assert.equal(patched.status, 422); |
| 1095 | assert.equal(created.json.message, patched.json.message); |
| 1096 | assert.deepEqual(created.json.errors, patched.json.errors); |
| 1097 | |
| 1098 | // Inviting the same email to a repository twice (any letter case) is refused. |
| 1099 | const access = `/${me.login}/people-rules/settings/access`; |
| 1100 | const first = await submit(access, `${access}/people`, { who: "newcomer@example.com", role: "read" }); |
| 1101 | assert.equal(first.status, 200, flashOf(first)); |
| 1102 | assert.match(await first.text(), /newcomer@example\.com/); |
| 1103 | const second = await submit(access, `${access}/people`, { who: "NewComer@Example.com", role: "write" }); |
| 1104 | assert.equal(second.status, 303); |
| 1105 | assert.match(flashOf(second), /already has a pending invitation/); |
| 1106 | |
| 1107 | // A blank display name falls back to the username. |
| 1108 | const saved = await submit("/settings", "/settings/profile", { login: me.login, name: " " }); |
| 1109 | assert.match(flashOf(saved), /Profile saved\./); |
| 1110 | assert.equal((await ok("GET", `/users/${me.login}`)).name, null); |
| 1111 | assert.match(await (await fetch(`${base}/${me.login}`)).text(), new RegExp(`<h1[^>]*>${me.login}</h1>`)); |
| 1112 | |
| 1113 | // Usernames: the browser's pattern and the server agree that dots aren't allowed. |
| 1114 | const settings = await (await fetch(`${base}/settings`)).text(); |
| 1115 | const pattern = /name="login"[^>]*pattern="([^"]+)"/.exec(settings)?.[1]; |
| 1116 | assert.ok(pattern, "the username field has a pattern"); |
| 1117 | assert.equal(new RegExp(`^(?:${pattern.replaceAll("&", "&")})$`, "v").test("dot.name"), false); |
| 1118 | assert.equal((await api("POST", "/user/orgs", { login: "dot.name" })).status, 422); |
| 1119 | }); |
| 1120 | |
| 1121 | test("profile pictures: upload, resize, serve, cache headers and removal", async () => { |
| 1122 | const me = await ok("GET", "/user"); |
| 1123 | const avatar = async (login, query = "") => { |
| 1124 | const r = await fetch(`${base}/api/avatars/${login}${query}`); |
| 1125 | assert.equal(r.status, 200); |
| 1126 | return { type: r.headers.get("content-type"), cache: r.headers.get("cache-control"), csp: r.headers.get("content-security-policy"), body: Buffer.from(await r.arrayBuffer()) }; |
| 1127 | }; |
| 1128 | const put = (path, body, tok = token) => fetch(`${base}/api/v3${path}`, { method: "PUT", headers: { authorization: `Bearer ${tok}`, "content-type": "image/png" }, body }); |
| 1129 | |
| 1130 | // Before any upload: generated initials, also for logins that don't exist. |
| 1131 | const initials = await avatar(me.login, "?s=64"); |
| 1132 | assert.match(initials.type, /^image\/svg\+xml/); |
| 1133 | assert.equal(initials.csp, "default-src 'none'; style-src 'unsafe-inline'"); |
| 1134 | assert.match((await avatar("no-such-user-here")).type, /^image\/svg\+xml/); |
| 1135 | |
| 1136 | // REST upload: a 600×400 PNG becomes centred square WebPs. |
| 1137 | const up = await put("/user/avatar", pngGradient(600, 400)); |
| 1138 | assert.equal(up.status, 200, await up.clone().text()); |
| 1139 | const { avatar_url } = await up.json(); |
| 1140 | const version = new URL(avatar_url).searchParams.get("v"); |
| 1141 | assert.match(version ?? "", /^\d+$/); |
| 1142 | for (const s of [64, 128, 256]) { |
| 1143 | const a = await avatar(me.login, `?s=${s}&v=${version}`); |
| 1144 | assert.equal(a.type, "image/webp"); |
| 1145 | assert.deepEqual(webpSize(a.body), { width: s, height: s }); |
| 1146 | assert.ok(a.body.length < 10_000, `${s}px WebP is ${a.body.length} bytes`); |
| 1147 | assert.match(a.cache, /immutable/); |
| 1148 | } |
| 1149 | const current = await avatar(me.login, "?s=64"); |
| 1150 | assert.equal(current.type, "image/webp"); |
| 1151 | assert.match(current.cache, /max-age=600/); |
| 1152 | |
| 1153 | // Only JPEG, PNG and WebP, sniffed from the bytes. |
| 1154 | const gif = await put("/user/avatar", Buffer.from("GIF89a\x01\x00\x01\x00\x00\x00\x00;", "latin1")); |
| 1155 | assert.equal(gif.status, 422); |
| 1156 | assert.equal((await gif.json()).message, "Use a JPEG, PNG or WebP image."); |
| 1157 | // Read-only tokens can't change a profile. |
| 1158 | const ro = (await ok("POST", "/diffinery/tokens", { name: "ro", scopes: ["read"] })).token; |
| 1159 | assert.equal((await put("/user/avatar", pngGradient(8, 8), ro)).status, 403); |
| 1160 | |
| 1161 | // The web form (multipart, CSRF double-submit) takes the original file and the server resizes it. |
| 1162 | const page = await fetch(`${base}/settings`); |
| 1163 | const csrf = /name="_csrf" value="([^"]+)"/.exec(await page.text())?.[1]; |
| 1164 | const cookie = /dfy_csrf=([^;]+)/.exec(page.headers.get("set-cookie") ?? "")?.[1]; |
| 1165 | assert.ok(csrf && cookie); |
| 1166 | const form = new FormData(); |
| 1167 | form.set("_csrf", csrf); |
| 1168 | form.set("avatar", new Blob([pngGradient(300, 500)], { type: "image/png" }), "me.png"); |
| 1169 | const posted = await fetch(`${base}/settings/avatar`, { method: "POST", body: form, redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}`, "sec-fetch-site": "same-origin" } }); |
| 1170 | assert.equal(posted.status, 303); |
| 1171 | assert.match(decodeURIComponent(decodeURIComponent(posted.headers.get("set-cookie") ?? "")), /"kind":"notice","message":"Profile picture updated\."/); |
| 1172 | const settings = await (await fetch(`${base}/settings`)).text(); |
| 1173 | const newVersion = /\/api\/avatars\/[^"?]+\?s=256&v=(\d+)/.exec(settings)?.[1]; |
| 1174 | assert.ok(newVersion && newVersion !== version, "the settings page links the new version"); |
| 1175 | // An old version's URL gets the current picture, but not as an immutable response. |
| 1176 | assert.match((await avatar(me.login, `?s=64&v=${version}`)).cache, /max-age=600/); |
| 1177 | |
| 1178 | // Organizations: owners (admins get a 403; see the security tests). |
| 1179 | await ok("POST", "/user/orgs", { login: "picture-org" }); |
| 1180 | const org = await put("/orgs/picture-org/avatar", pngGradient(64, 64)); |
| 1181 | assert.equal(org.status, 200, await org.clone().text()); |
| 1182 | assert.equal((await avatar("picture-org", "?s=128")).type, "image/webp"); |
| 1183 | assert.equal((await fetch(`${base}/api/v3/orgs/picture-org/avatar`, { method: "DELETE", headers: { authorization: `Bearer ${token}` } })).status, 200); |
| 1184 | assert.match((await avatar("picture-org", "?s=128")).type, /^image\/svg\+xml/); |
| 1185 | |
| 1186 | // Removal falls back to initials straight away (the cached copies are purged). |
| 1187 | const del = await fetch(`${base}/api/v3/user/avatar`, { method: "DELETE", headers: { authorization: `Bearer ${token}` } }); |
| 1188 | assert.deepEqual(await del.json(), { avatar_url: `${base}/api/avatars/${me.login}` }); |
| 1189 | assert.match((await avatar(me.login, "?s=64")).type, /^image\/svg\+xml/); |
| 1190 | }); |