mirror of
https://github.com/Sea-Haven-Industries/meal-order-manager.git
synced 2026-09-30 07:43:13 +00:00
f632020b20
* ci: convert onto org HCP reusables Switch Fargate CD and CI to the v1.0.13 org workflows, emit ci-complete, and retarget githubdeploy OIDC to the reusable plus the thin caller. * chore(security): retarget githubdeploy Checkov suppression The OIDC dual-claim edit shifted CKV_AWS_111 from line 40 to 49. Permissions are unchanged. * style: apply formatter * ci: pin org reusables to v1.0.14 Drop collect-only and requirements from the python lint caller now that ci-python-app is lint-only. * test(ci): probe autofix with a ruff format violation * style: apply formatter --------- Co-authored-by: sea-haven-auto-fix[bot] <5037331+sea-haven-auto-fix[bot]@users.noreply.github.com>
35 lines
1.3 KiB
Python
35 lines
1.3 KiB
Python
"""githubdeploy OIDC trust pins the org reusable and the thin caller."""
|
|
|
|
from pathlib import Path
|
|
|
|
IAM = Path(__file__).resolve().parents[1] / "terraform" / "iam_github_deploy.tf"
|
|
|
|
|
|
def test_github_deploy_trust_uses_org_reusable_and_caller():
|
|
text = IAM.read_text()
|
|
assert "token.actions.githubusercontent.com:sub" in text
|
|
assert "repo:Sea-Haven-Industries/meal-order-manager:environment:dev" in text
|
|
assert "repo:Sea-Haven-Industries/meal-order-manager:environment:prod" in text
|
|
assert (
|
|
"Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*" in text
|
|
)
|
|
assert "token.actions.githubusercontent.com:workflow_ref" in text
|
|
assert (
|
|
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main"
|
|
in text
|
|
)
|
|
assert (
|
|
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*"
|
|
in text
|
|
)
|
|
assert "cd-hcp-spa.yaml" not in text
|
|
assert "token.actions.githubusercontent.com:workflow_ref" in text
|
|
assert (
|
|
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main"
|
|
in text
|
|
)
|
|
assert (
|
|
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*"
|
|
in text
|
|
)
|
|
assert "cd-hcp-spa.yaml" not in text
|