70 lines
4.7 KiB
JavaScript
70 lines
4.7 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import test from 'node:test';
|
|
|
|
const root = path.resolve(import.meta.dirname, '../..');
|
|
const compose = fs.readFileSync(path.join(root, 'docker-compose.gateway.yml'), 'utf8');
|
|
const deploy = fs.readFileSync(path.join(root, 'scripts/deploy-gateway.sh'), 'utf8');
|
|
const workflow = fs.readFileSync(path.join(root, '.gitea/workflows/gateway-build.yml'), 'utf8');
|
|
const clientDockerfile = fs.readFileSync(path.join(root, 'Dockerfile.client'), 'utf8');
|
|
const dockerfiles = ['Dockerfile', 'Dockerfile.client']
|
|
.map((file) => fs.readFileSync(path.join(root, file), 'utf8'));
|
|
|
|
test('gateway deploy updates control without recreating dataplane', () => {
|
|
assert.match(compose, /vpn-proxy-control:/);
|
|
assert.match(compose, /vpn-proxy-dataplane:/);
|
|
assert.match(compose, /DATAPLANE_SOCKET: \/run\/vpn-proxy\/dataplane\.sock/);
|
|
assert.match(deploy, /up -d --no-deps --wait[^\n]+vpn-proxy-control/);
|
|
assert.match(workflow, /UPDATE_DATAPLANE="\$\{UPDATE_DATAPLANE\}"/);
|
|
assert.match(workflow, /node scripts\/runtime-impact\.mjs --stdin/);
|
|
assert.match(workflow, /Affected components: \$\{AFFECTED_COMPONENTS\}/);
|
|
assert.match(workflow, /Restart scope: \$\{RESTART_SCOPE\}/);
|
|
assert.match(workflow, /git diff --no-renames --name-only "\$BEFORE_SHA"/);
|
|
assert.match(workflow, /git diff-tree --no-renames/);
|
|
assert.match(workflow, /git cat-file -e "\$\{BEFORE_SHA\}\^\{commit\}"/);
|
|
assert.match(workflow, /npm_status=\$\?[\s\S]*! -x node_modules\/\.bin\/tsc[\s\S]*tail -n 200 \/root\/\.npm\/_logs\/\*-debug-0\.log[\s\S]*exit 1/);
|
|
assert.match(workflow, /npm test[\s\S]*Image build and push skipped: no Gateway runtime impact\.[\s\S]*exit 0[\s\S]*docker login/);
|
|
assert.match(workflow, /Image build and push skipped: no Gateway runtime impact\.[\s\S]*exit 0[\s\S]*\.\/scripts\/build-runtime-base\.sh/);
|
|
assert.match(workflow, /sing-box version \$\{\{ env\.SINGBOX_VERSION \}\}[\s\S]*\.\/scripts\/build-runtime-base\.sh/);
|
|
assert.match(workflow, /--entrypoint sing-box[\s\S]*grep -Fx "sing-box version \$\{\{ env\.SINGBOX_VERSION \}\}"/);
|
|
assert.match(workflow, /api\/version[\s\S]*singBox/);
|
|
assert.match(workflow, /Deploy skipped: no Gateway runtime impact\.[\s\S]*exit 0[\s\S]*bash scripts\/deploy-gateway\.sh/);
|
|
assert.doesNotMatch(workflow, /grep -Eq/);
|
|
});
|
|
|
|
test('Gateway native API credentials remain private to the dataplane volume', () => {
|
|
assert.equal(compose.split('SING_BOX_TRAFFIC_SOURCE: ${SING_BOX_TRAFFIC_SOURCE:-shadow}').length - 1, 2);
|
|
assert.equal(deploy.split('SING_BOX_TRAFFIC_SOURCE: \\${SING_BOX_TRAFFIC_SOURCE:-shadow}').length - 1, 2);
|
|
assert.match(compose, /vpn-proxy-dataplane:[\s\S]*SING_BOX_API_SECRET: \/var\/lib\/sing-box\/api\.secret[\s\S]*sing-box-cache:\/var\/lib\/sing-box/);
|
|
assert.doesNotMatch(
|
|
compose.match(/vpn-proxy-control:[\s\S]*?(?=\nvolumes:)/)?.[0] || '',
|
|
/SING_BOX_API_SECRET|sing-box-cache|19091/,
|
|
);
|
|
assert.doesNotMatch(compose.match(/ports:[\s\S]*?volumes:/)?.[0] || '', /19091/);
|
|
});
|
|
|
|
test('manual hard deploy safely forces the existing full Gateway path', () => {
|
|
assert.match(workflow, /workflow_dispatch:\s*\n\s+inputs:\s*\n\s+hard_deploy:[\s\S]*default: false[\s\S]*type: boolean/);
|
|
assert.match(workflow, /env:\s*\n\s+HARD_DEPLOY_INPUT: \$\{\{ inputs\.hard_deploy \}\}/);
|
|
assert.match(workflow, /case "\$\{EVENT_NAME\}:\$\{HARD_DEPLOY_INPUT\}" in\s*\n\s+workflow_dispatch:true\) HARD_DEPLOY=true/);
|
|
assert.match(workflow, /workflow_dispatch:false\|workflow_dispatch:\|push:false\|push:\) HARD_DEPLOY=false/);
|
|
assert.match(workflow, /\*\) echo "Invalid hard deploy request:[^\n]+exit 1/);
|
|
assert.match(workflow, /Invalid runtime impact:[\s\S]*DOCKER_BUILD_OPTIONS=\(\)[\s\S]*if \[ "\$HARD_DEPLOY" = "true" \]/);
|
|
assert.match(workflow, /Hard deploy requested: forcing no-cache rebuild and deploy of both Gateway images\./);
|
|
assert.match(workflow, /AFFECTED_COMPONENTS="control\+dataplane"\s*\n\s+RESTART_SCOPE="both"\s*\n\s+DOCKER_BUILD_OPTIONS=\(--no-cache\)/);
|
|
assert.match(workflow, /DOCKER_BUILDKIT=1 docker build \\\n\s+"\$\{DOCKER_BUILD_OPTIONS\[@\]\}"/);
|
|
assert.match(workflow, /DOCKER_BUILD_OPTIONS=\(--no-cache\)[\s\S]*affected_components=\$\{AFFECTED_COMPONENTS\}[\s\S]*if \[ "\$RESTART_SCOPE" = "none" \]/);
|
|
assert.equal(workflow.match(/bash scripts\/deploy-gateway\.sh/g)?.length, 1);
|
|
});
|
|
|
|
test('runtime images contain only compiled application modules', () => {
|
|
for (const dockerfile of dockerfiles) {
|
|
assert.match(dockerfile, /RUN npm run build:production/);
|
|
assert.match(dockerfile, /COPY --from=build \/src\/dist \/app\/dist/);
|
|
assert.doesNotMatch(dockerfile, /\/app\/src/);
|
|
}
|
|
assert.match(clientDockerfile, /COPY index\.html vite\.config\.ts/);
|
|
assert.doesNotMatch(clientDockerfile, /vite\.config\.js/);
|
|
});
|