mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
70 lines
2.7 KiB
Bash
70 lines
2.7 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
||
|
|
tmp=$(mktemp -d)
|
||
|
|
trap 'rm -rf "$tmp"' EXIT
|
||
|
|
mkdir -p "$tmp/bin"
|
||
|
|
cat >"$tmp/bin/gh" <<'GH'
|
||
|
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
printf '%q ' "$@" >>"$GH_CALLS"
|
||
|
|
printf '\n' >>"$GH_CALLS"
|
||
|
|
|
||
|
|
[[ "${1:-}" == api ]] || { echo "expected gh api" >&2; exit 91; }
|
||
|
|
if [[ "${2:-}" == graphql ]]; then
|
||
|
|
expected_query='query($owner:String!,$repo:String!,$number:Int!){repository(owner:$owner,name:$repo){pullRequest(number:$number){reviewDecision}}}'
|
||
|
|
[[ "$#" -eq 12 && "$3" == -f && "$4" == "query=$expected_query" &&
|
||
|
|
"$5" == -F && "$6" == owner=block &&
|
||
|
|
"$7" == -F && "$8" == repo=buzz &&
|
||
|
|
"$9" == -F && "${10}" == number=123 &&
|
||
|
|
"${11}" == --jq && "${12}" == '.data.repository.pullRequest' ]] || {
|
||
|
|
echo "GraphQL call does not match the deployed query contract" >&2; exit 92;
|
||
|
|
}
|
||
|
|
if [[ -n "${REVIEW_DECISION:-}" ]]; then printf '%s\n' "$REVIEW_DECISION"; else printf '%s\n' '{"reviewDecision":"APPROVED"}'; fi
|
||
|
|
elif [[ "$#" -eq 4 && "$2" == --paginate && "$3" == --slurp && "$4" == "repos/block/buzz/pulls/123/reviews?per_page=100&page=1" ]]; then
|
||
|
|
[[ "${GH_FAIL_REVIEWS:-false}" != true ]] || { echo "simulated reviews API failure" >&2; exit 94; }
|
||
|
|
if [[ -n "${REVIEWS:-}" ]]; then printf '%s\n' "$REVIEWS"; else printf '%s\n' '[[],[{"state":"APPROVED","commit_id":"head","author_association":"MEMBER"}]]'; fi
|
||
|
|
else
|
||
|
|
echo "unexpected or malformed gh call: $*" >&2
|
||
|
|
exit 95
|
||
|
|
fi
|
||
|
|
GH
|
||
|
|
chmod +x "$tmp/bin/gh"
|
||
|
|
|
||
|
|
run_authorization() {
|
||
|
|
(cd "$repo_root" && PATH="$tmp/bin:$PATH" GH_CALLS="$tmp/calls" GH_TOKEN=test \
|
||
|
|
GITHUB_REPOSITORY=block/buzz PR_NUMBER=123 PR_HEAD_SHA=head \
|
||
|
|
REVIEW_DECISION="${REVIEW_DECISION-}" REVIEWS="${REVIEWS-}" GH_FAIL_REVIEWS="${GH_FAIL_REVIEWS-false}" \
|
||
|
|
scripts/verify-desktop-release-authorization.sh)
|
||
|
|
}
|
||
|
|
|
||
|
|
: >"$tmp/calls"
|
||
|
|
run_authorization
|
||
|
|
! grep -Fq 'rule-suites' "$tmp/calls"
|
||
|
|
|
||
|
|
for invalid in \
|
||
|
|
'[[{"state":"APPROVED","commit_id":"stale","author_association":"MEMBER"}]]' \
|
||
|
|
'[[{"state":"APPROVED","commit_id":"head","author_association":"NONE"}]]' \
|
||
|
|
'[[{"state":"CHANGES_REQUESTED","commit_id":"head","author_association":"MEMBER"}]]'; do
|
||
|
|
: >"$tmp/calls"
|
||
|
|
if REVIEWS="$invalid" run_authorization >/dev/null 2>&1; then
|
||
|
|
echo "invalid approval was accepted: $invalid" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
: >"$tmp/calls"
|
||
|
|
if REVIEW_DECISION='{"reviewDecision":"CHANGES_REQUESTED"}' run_authorization >/dev/null 2>&1; then
|
||
|
|
echo "changes-requested review decision was accepted" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
: >"$tmp/calls"
|
||
|
|
if GH_FAIL_REVIEWS=true run_authorization >/dev/null 2>&1; then
|
||
|
|
echo "reviews API failure was ignored" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "desktop release authorization passed"
|