75 lines
3.1 KiB
Python
75 lines
3.1 KiB
Python
from pathlib import Path
|
|
|
|
|
|
APP_ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_container_contract_uses_immutable_nonroot_stages_TASK_8c19d6a7() -> None:
|
|
# Given: the checked-in embedding runtime container definition.
|
|
lines = (APP_ROOT / "Dockerfile").read_text().splitlines()
|
|
from_lines = [line for line in lines if line.startswith("FROM ")]
|
|
|
|
# When: external and internal build stages are inspected as a supply-chain contract.
|
|
external_sources = [line for line in from_lines if not line.startswith("FROM dependencies ")]
|
|
runtime_is_minimal = from_lines[-1].startswith("FROM cgr.dev/chainguard/python:latest@sha256:")
|
|
|
|
# Then: external sources are immutable and the final process is explicitly non-root.
|
|
assert len(from_lines) == 4
|
|
assert all("@sha256:" in line for line in external_sources)
|
|
assert runtime_is_minimal
|
|
assert "USER 65532:65532" in lines
|
|
|
|
|
|
def test_runtime_dependencies_pin_fixed_versions_TASK_8c19d6a7() -> None:
|
|
# Given: the production dependency lock used to build the image.
|
|
lines = (APP_ROOT / "requirements.txt").read_text().splitlines()
|
|
requirements = {
|
|
name: version
|
|
for line in lines
|
|
if line and not line.startswith("#")
|
|
for name, version in [line.split("==", maxsplit=1)]
|
|
}
|
|
|
|
# When: security-attributed runtime dependencies are checked.
|
|
fixed_versions = {
|
|
"fastapi": "0.139.0",
|
|
"starlette": "1.3.1",
|
|
"sentence-transformers": "5.6.0",
|
|
"transformers": "5.13.1",
|
|
"torch": "2.13.0",
|
|
"peft": "0.19.1",
|
|
}
|
|
|
|
# Then: fixed compatible versions are exact and build-only vulnerable packages stay absent.
|
|
assert requirements.items() >= fixed_versions.items()
|
|
assert "jaraco.context" not in requirements
|
|
assert "wheel" not in requirements
|
|
|
|
|
|
def test_quality_evidence_is_reproducible_and_taxonomy_aware_TASK_8c19d6a7() -> None:
|
|
# Given: the declared quality environment and its operator documentation.
|
|
dockerfile = (APP_ROOT / "Dockerfile").read_text()
|
|
test_requirements = (APP_ROOT / "requirements-test.txt").read_text().splitlines()
|
|
readme = (APP_ROOT / "README.md").read_text()
|
|
|
|
# When: the evidence contract is inspected independently of prior run logs.
|
|
pinned_tools = {
|
|
name: version
|
|
for line in test_requirements
|
|
if line and not line.startswith("#")
|
|
for name, version in [line.split("==", maxsplit=1)]
|
|
}
|
|
|
|
# Then: eight tests and all quality gates are reproducible with honest SBOM taxonomy.
|
|
assert pinned_tools["ruff"] == "0.15.19"
|
|
assert pinned_tools["ty"] == "0.0.53"
|
|
assert "AS quality" in dockerfile
|
|
assert "VIRTUAL_ENV=/home/nonroot/venv" in dockerfile
|
|
assert "PYTHONPYCACHEPREFIX=/tmp/embedding-runtime-pycache" in dockerfile
|
|
assert "python -m pytest -p no:cacheprovider tests" in dockerfile
|
|
assert "ruff check server.py tests" in dockerfile
|
|
assert "ty check server.py tests" in dockerfile
|
|
assert "python -m compileall -q server.py tests" in dockerfile
|
|
assert "8 tests" in readme
|
|
assert "pkg:pypi/wheel" in readme
|
|
assert "pkg:apk/wolfi/py3-pip-wheel" in readme
|