|
| 1 | +#!/bin/bash |
| 2 | +# |
| 3 | +# Licensed to the Apache Software Foundation (ASF) under one or more |
| 4 | +# contributor license agreements. See the NOTICE file distributed with |
| 5 | +# this work for additional information regarding copyright ownership. |
| 6 | +# The ASF licenses this file to You under the Apache License, Version 2.0 |
| 7 | +# (the "License"); you may not use this file except in compliance with |
| 8 | +# the License. You may obtain a copy of the License at |
| 9 | +# |
| 10 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | +# |
| 12 | +# Unless required by applicable law or agreed to in writing, software |
| 13 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 14 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 15 | +# See the License for the specific language governing permissions and |
| 16 | +# limitations under the License. |
| 17 | +# |
| 18 | +# Exercises check-code-scanning-available.sh against a stubbed `curl`, |
| 19 | +# covering the "not enabled" rejection and the fail-open branches so the |
| 20 | +# output contract (available=true|false) can't silently regress. Run |
| 21 | +# directly, no extra tooling required: |
| 22 | +# bash .github/workflows/scripts/check-code-scanning-available.test.sh |
| 23 | + |
| 24 | +set -euo pipefail |
| 25 | + |
| 26 | +script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" |
| 27 | +script_under_test="${script_dir}/check-code-scanning-available.sh" |
| 28 | + |
| 29 | +failures=0 |
| 30 | + |
| 31 | +# Runs the script under test with a stubbed `curl` that replies with HTTP |
| 32 | +# status $2 and body $3 and exits with $4, asserting that GITHUB_OUTPUT ends |
| 33 | +# up containing exactly $5. |
| 34 | +run_case() { |
| 35 | + local case_name="$1" |
| 36 | + local http_status="$2" |
| 37 | + local response_body="$3" |
| 38 | + local curl_exit_code="$4" |
| 39 | + local expected_line="$5" |
| 40 | + |
| 41 | + local workdir |
| 42 | + workdir="$(mktemp -d)" |
| 43 | + trap 'rm -rf "${workdir}"' RETURN |
| 44 | + |
| 45 | + # Fake `curl` that replays a canned response regardless of arguments, so |
| 46 | + # the script under test never touches the network. The status follows the |
| 47 | + # body on its own line, as the real `--write-out` format produces. |
| 48 | + printf '%s\n%s' "${response_body}" "${http_status}" >"${workdir}/response" |
| 49 | + cat >"${workdir}/curl" <<EOF |
| 50 | +#!/bin/bash |
| 51 | +cat '${workdir}/response' |
| 52 | +exit ${curl_exit_code} |
| 53 | +EOF |
| 54 | + chmod +x "${workdir}/curl" |
| 55 | + |
| 56 | + local output_file="${workdir}/github_output" |
| 57 | + : >"${output_file}" |
| 58 | + |
| 59 | + if PATH="${workdir}:${PATH}" \ |
| 60 | + GITHUB_OUTPUT="${output_file}" \ |
| 61 | + GITHUB_REPOSITORY="apache/superset" \ |
| 62 | + GH_TOKEN="fake-token" \ |
| 63 | + bash "${script_under_test}" >/dev/null; then |
| 64 | + : |
| 65 | + else |
| 66 | + echo "FAIL (${case_name}): script exited non-zero" |
| 67 | + failures=$((failures + 1)) |
| 68 | + return |
| 69 | + fi |
| 70 | + |
| 71 | + local actual |
| 72 | + actual="$(cat "${output_file}")" |
| 73 | + if [ "${actual}" = "${expected_line}" ]; then |
| 74 | + echo "PASS (${case_name})" |
| 75 | + else |
| 76 | + echo "FAIL (${case_name}): expected '${expected_line}', got '${actual}'" |
| 77 | + failures=$((failures + 1)) |
| 78 | + fi |
| 79 | +} |
| 80 | + |
| 81 | +run_case "alerts are readable" \ |
| 82 | + 200 '[{"number":1,"state":"open"}]' 0 \ |
| 83 | + "available=true" |
| 84 | + |
| 85 | +run_case "no alerts yet" \ |
| 86 | + 200 '[]' 0 \ |
| 87 | + "available=true" |
| 88 | + |
| 89 | +run_case "Code Security is not enabled" \ |
| 90 | + 403 '{"message":"Code Security must be enabled for this repository to use code scanning.","status":"403"}' 0 \ |
| 91 | + "available=false" |
| 92 | + |
| 93 | +run_case "Advanced Security is not enabled" \ |
| 94 | + 403 '{"message":"Advanced Security must be enabled for this repository to use code scanning.","status":"403"}' 0 \ |
| 95 | + "available=false" |
| 96 | + |
| 97 | +run_case "an alert merely quotes the rejection message" \ |
| 98 | + 200 '[{"rule":{"description":"Code Security must be enabled for this repository"}}]' 0 \ |
| 99 | + "available=true" |
| 100 | + |
| 101 | +run_case "token cannot read alerts" \ |
| 102 | + 403 '{"message":"Resource not accessible by integration","status":"403"}' 0 \ |
| 103 | + "available=true" |
| 104 | + |
| 105 | +run_case "no analysis found" \ |
| 106 | + 404 '{"message":"no analysis found","status":"404"}' 0 \ |
| 107 | + "available=true" |
| 108 | + |
| 109 | +run_case "network failure" \ |
| 110 | + 000 '' 28 \ |
| 111 | + "available=true" |
| 112 | + |
| 113 | +if [ "${failures}" -gt 0 ]; then |
| 114 | + echo "${failures} case(s) failed" |
| 115 | + exit 1 |
| 116 | +fi |
| 117 | + |
| 118 | +echo "All cases passed" |
0 commit comments