settings-action/test.py at main · 030/settings-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
import json

from click.testing import CliRunner

from main import cli


def test_branch_protection_rules_default_output(tmp_path, monkeypatch):
    monkeypatch.chdir(tmp_path)
    runner = CliRunner()

    result = runner.invoke(cli, ["branch-protection-rules"])

    assert result.exit_code == 0

    output_file = tmp_path / "update-branch-protection-rule.json"
    assert output_file.exists()

    data = json.loads(output_file.read_text())
    assert data["enforce_admins"] is True
    assert data["required_conversation_resolution"] is True
    assert data["required_pull_request_reviews"] == {
        "required_approving_review_count": 1
    }
    assert data["required_status_checks"] is None
    assert data["restrictions"] is None


def test_branch_protection_rules_zero_required_approving_review_count(
    tmp_path, monkeypatch
):
    monkeypatch.chdir(tmp_path)
    runner = CliRunner()

    result = runner.invoke(
        cli,
        [
            "branch-protection-rules",
            "--required-approving-review-count",
            "0",
        ],
    )

    assert result.exit_code == 0

    data = json.loads(
        (tmp_path / "update-branch-protection-rule.json").read_text()
    )
    # required_pull_request_reviews stays None when the count is 0
    assert data["required_pull_request_reviews"] is None


def test_actions_permissions_all_does_not_write_selected_actions_file(
    tmp_path, monkeypatch
):
    monkeypatch.chdir(tmp_path)
    runner = CliRunner()

    result = runner.invoke(
        cli,
        [
            "actions-permissions",
            "--allowed-actions",
            "all",
            "--require-sha-pinning",
            "true",
        ],
    )

    assert result.exit_code == 0

    permissions_file = tmp_path / "update-actions-permissions.json"
    assert permissions_file.exists()

    data = json.loads(permissions_file.read_text())
    assert data == {
        "enabled": True,
        "allowed_actions": "all",
        "sha_pinning_required": True,
    }

    # selected-actions payload is only relevant when allowed_actions == "selected"
    assert not (tmp_path / "update-actions-selected-actions.json").exists()


def test_actions_permissions_selected_writes_both_files(tmp_path, monkeypatch):
    monkeypatch.chdir(tmp_path)
    runner = CliRunner()

    result = runner.invoke(
        cli,
        [
            "actions-permissions",
            "--allowed-actions",
            "selected",
            "--github-owned-allowed",
            "true",
            "--verified-allowed",
            "false",
            "--patterns-allowed",
            "030/*,actions/checkout@*",
            "--require-sha-pinning",
            "true",
        ],
    )

    assert result.exit_code == 0

    permissions_data = json.loads(
        (tmp_path / "update-actions-permissions.json").read_text()
    )
    assert permissions_data == {
        "enabled": True,
        "allowed_actions": "selected",
        "sha_pinning_required": True,
    }

    selected_data = json.loads(
        (tmp_path / "update-actions-selected-actions.json").read_text()
    )
    assert selected_data == {
        "github_owned_allowed": True,
        "verified_allowed": False,
        "patterns_allowed": ["030/*", "actions/checkout@*"],
    }
    # sha_pinning_required must never end up in the selected-actions payload
    assert "sha_pinning_required" not in selected_data


def test_actions_permissions_empty_patterns_allowed_filtered_out(
    tmp_path, monkeypatch
):
    monkeypatch.chdir(tmp_path)
    runner = CliRunner()

    result = runner.invoke(
        cli,
        [
            "actions-permissions",
            "--allowed-actions",
            "selected",
            "--patterns-allowed",
            "",
        ],
    )

    assert result.exit_code == 0

    selected_data = json.loads(
        (tmp_path / "update-actions-selected-actions.json").read_text()
    )
    assert selected_data["patterns_allowed"] == []


def test_actions_permissions_rejects_invalid_allowed_actions(
    tmp_path, monkeypatch
):
    monkeypatch.chdir(tmp_path)
    runner = CliRunner()

    result = runner.invoke(
        cli,
        ["actions-permissions", "--allowed-actions", "not-a-real-choice"],
    )

    assert result.exit_code != 0