From 4802be4dd466b0e070d720d2de83e9e70bbe1770 Mon Sep 17 00:00:00 2001 From: Jax Liu Date: Mon, 7 Sep 2026 11:22:23 +0800 Subject: [PATCH] test(genbi): cover managed runtime handoff --- .github/workflows/managed-wren-runtime.yml | 6 +++--- .../scripts/anchor-managed-wren-manifest.mjs | 16 ++++++++++++++++ apps/genbi/test/managed-wren-runtime.test.ts | 10 +++++++++- apps/genbi/test/packaging-contract.test.ts | 3 +++ 4 files changed, 31 insertions(+), 4 deletions(-) create mode 100644 apps/genbi/scripts/anchor-managed-wren-manifest.mjs diff --git a/.github/workflows/managed-wren-runtime.yml b/.github/workflows/managed-wren-runtime.yml index a79a68625..4f9f6957e 100644 --- a/.github/workflows/managed-wren-runtime.yml +++ b/.github/workflows/managed-wren-runtime.yml @@ -41,6 +41,7 @@ jobs: PY curl --fail --location --proto '=https' --tlsv1.2 -o release/python.tar.gz 'https://github.com/astral-sh/python-build-standalone/releases/download/20260901/cpython-3.11.16%2B20260901-aarch64-apple-darwin-install_only.tar.gz' test "$(shasum -a 256 release/python.tar.gz | awk '{print $1}')" = 50424fa409e8ae84b82a3052522f64695b47dff2158b70bb7358e0ebd6c085c9 + /usr/bin/tar -tzf release/python.tar.gz | python -c "import json,sys; paths=[p.strip() for p in sys.stdin if any(x in p.upper() for x in ('LICENSE','COPYING','NOTICE'))]; print(json.dumps({'schema':1,'archiveSha256':'50424fa409e8ae84b82a3052522f64695b47dff2158b70bb7358e0ebd6c085c9','bundledLicenseEvidence':[{'path':p,'declaredLicense':'REVIEW_REQUIRED'} for p in paths]},indent=2))" > release/pbs-license-inventory.json /usr/bin/tar -xzf release/python.tar.gz -C release/runtime release/runtime/python/install/bin/python3.11 -m venv release/runtime/venv python - <<'PY' @@ -53,8 +54,7 @@ jobs: - uses: actions/upload-artifact@v4 with: name: managed-wren-review-metadata - path: | - release/*.json + path: release/*.json publish-approved-runtime: needs: stage @@ -75,7 +75,7 @@ jobs: APPROVAL_DIGEST: ${{ secrets.MANAGED_WREN_APPROVAL_SHA256 }} run: | test -n "$APPROVAL_DIGEST" - test "$APPROVAL_DIGEST" = "$(shasum -a 256 release/managed-wren-manifest.candidate.json | awk '{print $1}')" + test "$APPROVAL_DIGEST" = "$(cat release/managed-wren-manifest.candidate.json release/pbs-license-inventory.json release/wheel-license-inventory.json | shasum -a 256 | awk '{print $1}')" - name: Re-fetch and verify exact release assets run: | mkdir -p release/assets diff --git a/apps/genbi/scripts/anchor-managed-wren-manifest.mjs b/apps/genbi/scripts/anchor-managed-wren-manifest.mjs new file mode 100644 index 000000000..a953cc173 --- /dev/null +++ b/apps/genbi/scripts/anchor-managed-wren-manifest.mjs @@ -0,0 +1,16 @@ +#!/usr/bin/env node +/** Release-only handoff: bind a new npm package to one approved release manifest. */ +import { createHash } from "node:crypto"; +import { readFile, writeFile } from "node:fs/promises"; +import path from "node:path"; + +const [approvedPath, packageRoot] = process.argv.slice(2); +if (!approvedPath || !packageRoot) throw new Error("usage: anchor-managed-wren-manifest.mjs "); +const bytes = await readFile(approvedPath); +const approved = JSON.parse(bytes); +if (approved.activation !== "approved" || approved.licenseApproval?.state !== "approved" || typeof approved.python?.mirror?.url !== "string") throw new Error("approved manifest required"); +const manifestPath = path.join(packageRoot, "managed-wren", "manifest.json"); +const staged = JSON.parse(await readFile(manifestPath, "utf8")); +if (staged.activation !== "staged") throw new Error("package manifest must remain staged"); +staged.approvedManifest = { url: approved.python.mirror.url.replace(/\/[^/]+$/, "/managed-wren-manifest.json"), sha256: createHash("sha256").update(bytes).digest("hex") }; +await writeFile(manifestPath, JSON.stringify(staged, null, 2) + "\n"); diff --git a/apps/genbi/test/managed-wren-runtime.test.ts b/apps/genbi/test/managed-wren-runtime.test.ts index f49a1ff14..f3f5fd6fd 100644 --- a/apps/genbi/test/managed-wren-runtime.test.ts +++ b/apps/genbi/test/managed-wren-runtime.test.ts @@ -1,4 +1,4 @@ -import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs"; +import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs"; import { execFileSync } from "node:child_process"; import { createHash } from "node:crypto"; import { tmpdir } from "node:os"; @@ -101,6 +101,14 @@ describe("managed Wren runtime", () => { } }); + it("accepts a contained PBS/venv-style link and rejects a replacement that escapes generation", () => { + const value = fixture(); + symlinkSync("python", path.join(value.generation, "venv", "bin", "python3")); + expect(resolveManagedWrenRuntime({ packageRoot: value.packageRoot, runtimeRoot: value.runtimeRoot }).launcher).toBe(value.launcher); + rmSync(value.launcher); symlinkSync("/bin/sh", value.launcher); + expect(() => resolveManagedWrenRuntime({ packageRoot: value.packageRoot, runtimeRoot: value.runtimeRoot })).toThrow(ManagedWrenRuntimeError); + }); + it("rejects mutable, unapproved, or non-mirror manifest input before provisioning", () => { const value = fixture(); const manifestPath = path.join(value.packageRoot, "managed-wren", "manifest.json"); diff --git a/apps/genbi/test/packaging-contract.test.ts b/apps/genbi/test/packaging-contract.test.ts index 351336e61..2a5afa1a0 100644 --- a/apps/genbi/test/packaging-contract.test.ts +++ b/apps/genbi/test/packaging-contract.test.ts @@ -35,6 +35,9 @@ describe("installed-package and vendor-contract CI wiring", () => { expect(workflow).toContain("managed-wren-manifest.candidate.json"); expect(workflow).toContain("--no-index --no-deps --require-hashes"); expect(workflow).toContain("gh release create"); + const handoff = readFileSync(path.join(packageRoot, "scripts", "anchor-managed-wren-manifest.mjs"), "utf8"); + expect(handoff).toContain("approvedManifest"); + expect(handoff).toContain("approved manifest required"); }); it("pins the context loader exactly and runs its no-checkout acceptance on the certified macOS target", () => {