Genarrative/apps/ai-game-creator-shell/scripts/prepare-macos-codex.test.mjs

import assert from 'node:assert/strict';
import { createHash } from 'node:crypto';
import fs from 'node:fs';
import { test } from 'node:test';

import {
  lockedMacPackage,
  validateArchiveListing,
  verifyPackageIntegrity,
} from './prepare-macos-codex.mjs';

const lock = JSON.parse(
  fs.readFileSync(new URL('../../../package-lock.json', import.meta.url)),
);
const version = JSON.parse(
  fs.readFileSync(new URL('../package.json', import.meta.url)),
).devDependencies['@openai/codex'];

test('both macOS dependencies resolve from the lockfile without floating versions', () => {
  assert.equal(
    lockedMacPackage(lock, 'arm64', version).target,
    'aarch64-apple-darwin',
  );
  assert.equal(
    lockedMacPackage(lock, 'x64', version).target,
    'x86_64-apple-darwin',
  );
  assert.throws(() => lockedMacPackage(lock, 'other', version));
  assert.throws(() => lockedMacPackage(lock, 'x64', '0.0.0'));
});

test('native package integrity rejects tampering', () => {
  const bytes = Buffer.from('pinned package');
  const integrity = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
  verifyPackageIntegrity(bytes, integrity);
  assert.throws(() =>
    verifyPackageIntegrity(Buffer.from('modified'), integrity),
  );
});

test('archive traversal and non-package entries fail closed', () => {
  validateArchiveListing(
    'package/package.json\npackage/vendor/target/bin/codex\n',
  );
  for (const listing of [
    '',
    '/tmp/payload',
    'package/../private',
    'other/file',
    'package/..\\file',
  ]) {
    assert.throws(() => validateArchiveListing(listing));
  }
});

test('CI pipeline is manual, publishes the macOS partition and never reuses a developer workspace', () => {
  const pipeline = fs.readFileSync(
    new URL(
      '../../../jenkins/Jenkinsfile.ai-game-creator-shell-macos-build',
      import.meta.url,
    ),
    'utf8',
  );
  for (const required of [
    'genarrative-agc-macos',
    'disableConcurrentBuilds()',
    '$AGC_AGENT_ROOT',
    'StrictHostKeyChecking=yes',
    'git merge-base --is-ancestor',
    'allowEmptyArchive: false',
    "string(name: 'AGC_UPDATE_CHANNEL', defaultValue: 'dev'",
    'AGC_UPDATE_CHANNEL=${params.AGC_UPDATE_CHANNEL}',
    "string(credentialsId: 'AgcUpdaterSigningKey'",
    "string(credentialsId: 'AgcUpdaterSigningKeyPassword'",
    "string(credentialsId: 'AliyunAccessKeyId'",
    "string(credentialsId: 'AliyunaccessKeySecret'",
    'AGC_RELEASE_VERSION',
    'OSSUTIL_BIN',
  ]) {
    assert.ok(pipeline.includes(required), required);
  }
  // dry-run 必须是默认值：不显式取消勾选就不得写入 OSS。
  assert.match(
    pipeline,
    /booleanParam\(name: 'AGC_RELEASE_DRY_RUN', defaultValue: true/u,
  );
  for (const forbidden of [
    'triggers {',
    'cron(',
    'pollSCM(',
    'git clean -fdx',
    // release:upload 会重新触发一次完整构建，既翻倍耗时也绕过本 Job 的验签门禁。
    'release:upload',
  ]) {
    assert.ok(!pipeline.includes(forbidden), forbidden);
  }
});

test('macOS release entry verifies the updater signature before uploading', () => {
  const entry = fs.readFileSync(
    new URL('./build-macos-ci.mjs', import.meta.url),
    'utf8',
  );
  const verifyIndex = entry.indexOf('verifyUpdaterSignature({');
  const uploadIndex = entry.indexOf('uploadReleaseArtifacts(release');
  assert.ok(verifyIndex > 0, '必须调用更新包验签');
  assert.ok(uploadIndex > 0, '必须调用 OSS 上传');
  assert.ok(verifyIndex < uploadIndex, '必须先验签再上传，验不过不得写 OSS');
  // 无签名私钥时禁止构建：未签名的更新包会被客户端一律拒绝。
  assert.ok(entry.includes('TAURI_SIGNING_PRIVATE_KEY'));
});