|
2 | 2 | from repo_review.testing import compute_check |
3 | 3 |
|
4 | 4 |
|
| 5 | +def test_gh100() -> None: |
| 6 | + workflows = yaml.safe_load( |
| 7 | + """ |
| 8 | + ci: |
| 9 | + name: CI |
| 10 | + """ |
| 11 | + ) |
| 12 | + assert compute_check("GH100", workflows=workflows).result |
| 13 | + |
| 14 | + |
| 15 | +def test_gh100_missing() -> None: |
| 16 | + assert not compute_check("GH100", workflows={}).result |
| 17 | + |
| 18 | + |
| 19 | +def test_gh101() -> None: |
| 20 | + workflows = yaml.safe_load( |
| 21 | + """ |
| 22 | + ci: |
| 23 | + name: CI |
| 24 | + docs: |
| 25 | + name: Docs |
| 26 | + """ |
| 27 | + ) |
| 28 | + assert compute_check("GH101", workflows=workflows).result |
| 29 | + |
| 30 | + |
| 31 | +def test_gh101_missing_names() -> None: |
| 32 | + workflows = yaml.safe_load( |
| 33 | + """ |
| 34 | + ci: |
| 35 | + name: CI |
| 36 | + docs: |
| 37 | + jobs: {} |
| 38 | + """ |
| 39 | + ) |
| 40 | + assert not compute_check("GH101", workflows=workflows).result |
| 41 | + |
| 42 | + |
| 43 | +def test_gh102() -> None: |
| 44 | + workflows = yaml.safe_load( |
| 45 | + """ |
| 46 | + ci: |
| 47 | + concurrency: |
| 48 | + group: ${{ github.workflow }}-${{ github.ref }} |
| 49 | + cancel-in-progress: true |
| 50 | + """ |
| 51 | + ) |
| 52 | + assert compute_check("GH102", workflows=workflows).result |
| 53 | + |
| 54 | + |
| 55 | +def test_gh102_missing_concurrency() -> None: |
| 56 | + workflows = yaml.safe_load( |
| 57 | + """ |
| 58 | + ci: |
| 59 | + jobs: {} |
| 60 | + """ |
| 61 | + ) |
| 62 | + assert not compute_check("GH102", workflows=workflows).result |
| 63 | + |
| 64 | + |
| 65 | +def test_gh103() -> None: |
| 66 | + workflows = yaml.safe_load( |
| 67 | + """ |
| 68 | + ci: |
| 69 | + on: |
| 70 | + workflow_dispatch: |
| 71 | + """ |
| 72 | + ) |
| 73 | + assert compute_check("GH103", workflows=workflows).result |
| 74 | + |
| 75 | + |
| 76 | +def test_gh103_missing_dispatch() -> None: |
| 77 | + workflows = yaml.safe_load( |
| 78 | + """ |
| 79 | + ci: |
| 80 | + on: |
| 81 | + push: |
| 82 | + """ |
| 83 | + ) |
| 84 | + assert not compute_check("GH103", workflows=workflows).result |
| 85 | + |
| 86 | + |
| 87 | +def test_gh104() -> None: |
| 88 | + workflows = yaml.safe_load( |
| 89 | + """ |
| 90 | + cd: |
| 91 | + jobs: |
| 92 | + wheels: |
| 93 | + strategy: |
| 94 | + matrix: |
| 95 | + python: ["3.11", "3.12"] |
| 96 | + steps: |
| 97 | + - uses: actions/upload-artifact@v4 |
| 98 | + with: |
| 99 | + name: wheels-${{ matrix.python }} |
| 100 | + sdist: |
| 101 | + steps: |
| 102 | + - uses: actions/upload-artifact@v4 |
| 103 | + with: |
| 104 | + name: sdist |
| 105 | + - uses: actions/upload-artifact@v4 |
| 106 | + with: |
| 107 | + name: docs |
| 108 | + """ |
| 109 | + ) |
| 110 | + assert compute_check("GH104", workflows=workflows).result |
| 111 | + |
| 112 | + |
| 113 | +def test_gh104_duplicate_names() -> None: |
| 114 | + workflows = yaml.safe_load( |
| 115 | + """ |
| 116 | + cd: |
| 117 | + jobs: |
| 118 | + wheels: |
| 119 | + steps: |
| 120 | + - uses: actions/upload-artifact@v4 |
| 121 | + with: |
| 122 | + name: wheel |
| 123 | + - uses: actions/upload-artifact@v4 |
| 124 | + with: |
| 125 | + name: wheel |
| 126 | + """ |
| 127 | + ) |
| 128 | + res = compute_check("GH104", workflows=workflows) |
| 129 | + assert not res.result |
| 130 | + assert "Multiple matching upload artifact names" in res.err_msg |
| 131 | + |
| 132 | + |
| 133 | +def test_gh104_matrix_without_substitution() -> None: |
| 134 | + workflows = yaml.safe_load( |
| 135 | + """ |
| 136 | + cd: |
| 137 | + jobs: |
| 138 | + wheels: |
| 139 | + strategy: |
| 140 | + matrix: |
| 141 | + python: ["3.11", "3.12"] |
| 142 | + steps: |
| 143 | + - uses: actions/upload-artifact@v4 |
| 144 | + with: |
| 145 | + name: wheel |
| 146 | + """ |
| 147 | + ) |
| 148 | + res = compute_check("GH104", workflows=workflows) |
| 149 | + assert not res.result |
| 150 | + assert "No variable substitutions were detected" in res.err_msg |
| 151 | + |
| 152 | + |
5 | 153 | def test_gh105_trusted_publishing() -> None: |
6 | 154 | workflows = yaml.safe_load( |
7 | 155 | """ |
@@ -30,3 +178,113 @@ def test_gh105_token_based_upload() -> None: |
30 | 178 | res = compute_check("GH105", workflows=workflows) |
31 | 179 | assert not res.result |
32 | 180 | assert "Token-based publishing" in res.err_msg |
| 181 | + |
| 182 | + |
| 183 | +def test_gh200() -> None: |
| 184 | + dependabot = yaml.safe_load( |
| 185 | + """ |
| 186 | + version: 2 |
| 187 | + updates: |
| 188 | + - package-ecosystem: github-actions |
| 189 | + directory: "/" |
| 190 | + schedule: |
| 191 | + interval: weekly |
| 192 | + """ |
| 193 | + ) |
| 194 | + assert compute_check("GH200", dependabot=dependabot).result |
| 195 | + |
| 196 | + |
| 197 | +def test_gh200_missing() -> None: |
| 198 | + assert not compute_check("GH200", dependabot={}).result |
| 199 | + |
| 200 | + |
| 201 | +def test_gh210() -> None: |
| 202 | + dependabot = yaml.safe_load( |
| 203 | + """ |
| 204 | + version: 2 |
| 205 | + updates: |
| 206 | + - package-ecosystem: github-actions |
| 207 | + directory: "/" |
| 208 | + schedule: |
| 209 | + interval: weekly |
| 210 | + """ |
| 211 | + ) |
| 212 | + assert compute_check("GH210", dependabot=dependabot).result |
| 213 | + |
| 214 | + |
| 215 | +def test_gh210_missing_github_actions() -> None: |
| 216 | + dependabot = yaml.safe_load( |
| 217 | + """ |
| 218 | + version: 2 |
| 219 | + updates: |
| 220 | + - package-ecosystem: pip |
| 221 | + directory: "/" |
| 222 | + schedule: |
| 223 | + interval: weekly |
| 224 | + """ |
| 225 | + ) |
| 226 | + assert not compute_check("GH210", dependabot=dependabot).result |
| 227 | + |
| 228 | + |
| 229 | +def test_gh211() -> None: |
| 230 | + dependabot = yaml.safe_load( |
| 231 | + """ |
| 232 | + version: 2 |
| 233 | + updates: |
| 234 | + - package-ecosystem: github-actions |
| 235 | + directory: "/" |
| 236 | + schedule: |
| 237 | + interval: weekly |
| 238 | + ignore: |
| 239 | + - dependency-name: pypa/cibuildwheel |
| 240 | + """ |
| 241 | + ) |
| 242 | + assert compute_check("GH211", dependabot=dependabot).result |
| 243 | + |
| 244 | + |
| 245 | +def test_gh211_pins_major_core_actions() -> None: |
| 246 | + dependabot = yaml.safe_load( |
| 247 | + """ |
| 248 | + version: 2 |
| 249 | + updates: |
| 250 | + - package-ecosystem: github-actions |
| 251 | + directory: "/" |
| 252 | + schedule: |
| 253 | + interval: weekly |
| 254 | + ignore: |
| 255 | + - dependency-name: actions/* |
| 256 | + """ |
| 257 | + ) |
| 258 | + assert not compute_check("GH211", dependabot=dependabot).result |
| 259 | + |
| 260 | + |
| 261 | +def test_gh212() -> None: |
| 262 | + dependabot = yaml.safe_load( |
| 263 | + """ |
| 264 | + version: 2 |
| 265 | + updates: |
| 266 | + - package-ecosystem: github-actions |
| 267 | + directory: "/" |
| 268 | + schedule: |
| 269 | + interval: weekly |
| 270 | + groups: |
| 271 | + actions: |
| 272 | + patterns: |
| 273 | + - "*" |
| 274 | + """ |
| 275 | + ) |
| 276 | + assert compute_check("GH212", dependabot=dependabot).result |
| 277 | + |
| 278 | + |
| 279 | +def test_gh212_missing_groups() -> None: |
| 280 | + dependabot = yaml.safe_load( |
| 281 | + """ |
| 282 | + version: 2 |
| 283 | + updates: |
| 284 | + - package-ecosystem: github-actions |
| 285 | + directory: "/" |
| 286 | + schedule: |
| 287 | + interval: weekly |
| 288 | + """ |
| 289 | + ) |
| 290 | + assert not compute_check("GH212", dependabot=dependabot).result |
0 commit comments