suzmii
48985d3447
补齐macOS universal双架构Codex资源与构建校验 统一发布清单和检查脚本支持universal目标 新增锁定原生依赖完整性校验与隔离构建smoke 新增Mac Jenkins Agent归档构建Job与本机构建接入规范
86 lines
2.3 KiB
JavaScript
86 lines
2.3 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { createHash } from 'node:crypto';
|
|
import fs from 'node:fs';
|
|
import { test } from 'node:test';
|
|
|
|
import {
|
|
lockedMacPackage,
|
|
validateArchiveListing,
|
|
verifyPackageIntegrity,
|
|
} from './prepare-macos-codex.mjs';
|
|
|
|
const lock = JSON.parse(
|
|
fs.readFileSync(new URL('../../../package-lock.json', import.meta.url)),
|
|
);
|
|
const version = JSON.parse(
|
|
fs.readFileSync(new URL('../package.json', import.meta.url)),
|
|
).devDependencies['@openai/codex'];
|
|
|
|
test('both macOS dependencies resolve from the lockfile without floating versions', () => {
|
|
assert.equal(
|
|
lockedMacPackage(lock, 'arm64', version).target,
|
|
'aarch64-apple-darwin',
|
|
);
|
|
assert.equal(
|
|
lockedMacPackage(lock, 'x64', version).target,
|
|
'x86_64-apple-darwin',
|
|
);
|
|
assert.throws(() => lockedMacPackage(lock, 'other', version));
|
|
assert.throws(() => lockedMacPackage(lock, 'x64', '0.0.0'));
|
|
});
|
|
|
|
test('native package integrity rejects tampering', () => {
|
|
const bytes = Buffer.from('pinned package');
|
|
const integrity = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
|
|
verifyPackageIntegrity(bytes, integrity);
|
|
assert.throws(() =>
|
|
verifyPackageIntegrity(Buffer.from('modified'), integrity),
|
|
);
|
|
});
|
|
|
|
test('archive traversal and non-package entries fail closed', () => {
|
|
validateArchiveListing(
|
|
'package/package.json\npackage/vendor/target/bin/codex\n',
|
|
);
|
|
for (const listing of [
|
|
'',
|
|
'/tmp/payload',
|
|
'package/../private',
|
|
'other/file',
|
|
'package/..\\file',
|
|
]) {
|
|
assert.throws(() => validateArchiveListing(listing));
|
|
}
|
|
});
|
|
|
|
test('CI pipeline is manual archive-only and does not reuse a developer workspace', () => {
|
|
const pipeline = fs.readFileSync(
|
|
new URL(
|
|
'../../../jenkins/Jenkinsfile.ai-game-creator-shell-macos-build',
|
|
import.meta.url,
|
|
),
|
|
'utf8',
|
|
);
|
|
for (const required of [
|
|
'genarrative-agc-macos',
|
|
'disableConcurrentBuilds()',
|
|
'$AGC_AGENT_ROOT',
|
|
'StrictHostKeyChecking=yes',
|
|
'git merge-base --is-ancestor',
|
|
'allowEmptyArchive: false',
|
|
]) {
|
|
assert.ok(pipeline.includes(required), required);
|
|
}
|
|
for (const forbidden of [
|
|
'triggers {',
|
|
'cron(',
|
|
'pollSCM(',
|
|
'release:upload',
|
|
'AgcUpdaterSigningKey',
|
|
'AliyunAccessKeyId',
|
|
'git clean -fdx',
|
|
]) {
|
|
assert.ok(!pipeline.includes(forbidden), forbidden);
|
|
}
|
|
});
|