INNER CODE UNIT · Go

TestCISeparatesContainerBuildFromRegistryWrite

minekube/gate · ci_write_token_isolation_test.go:249

func TestCISeparatesContainerBuildFromRegistryWrite(t *testing.T) {
	workflow, _ := readCIIsolationWorkflowAt(t, trustedReleaseWorkflowPath)
	build := ciIsolationJob(t, workflow, "image-build")
	publish := ciIsolationJob(t, workflow, "publish-images")

	if got := publish.Permissions; len(got) != 2 ||
		got["actions"] != "read" || got["packages"] != "write" {
		t.Errorf("container publisher permissions are %v; expected actions: read and packages: write only", got)
	}
	if len(publish.Needs) != 3 || publish.Needs[0] != "image-build" ||
		publish.Needs[1] != "release-build" || publish.Needs[2] != "verify-release-tag" {
		t.Errorf("container publisher needs %v; it must await both verified build jobs", publish.Needs)
	}
	if got := fmt.Sprint(publish.Steps[0].With["name"]); got != "gate-container-images" {
		t.Errorf("container publisher artifact name is %q; it must consume the allowlisted image artifact", got)
	}

	buildRaw := fmt.Sprint(build.Steps)

View source record →