74 lines
1.9 KiB
Go
74 lines
1.9 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func readDeployScript(t *testing.T, path string) string {
|
|
t.Helper()
|
|
raw, err := os.ReadFile(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return string(raw)
|
|
}
|
|
|
|
func TestDeployAdminPowerShell_固定提交隔离构建且支持WhatIf(t *testing.T) {
|
|
source := readDeployScript(t, "deploy/deploy-admin.ps1")
|
|
for _, want := range []string{
|
|
"SupportsShouldProcess = $true",
|
|
"\"archive\", \"--format=tar\"",
|
|
"$env:GOTOOLCHAIN = \"go1.23.0\"",
|
|
"$env:GOOS = \"linux\"",
|
|
"$env:GOARCH = \"amd64\"",
|
|
"$env:CGO_ENABLED = \"0\"",
|
|
"BatchMode=yes",
|
|
"StrictHostKeyChecking=yes",
|
|
"AllowSchemaMigration",
|
|
} {
|
|
if !strings.Contains(source, want) {
|
|
t.Errorf("本地部署脚本缺少关键安全步骤 %q", want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDeployAdminRemote_备份预检原子切换和失败回退(t *testing.T) {
|
|
source := readDeployScript(t, "deploy/deploy-admin-remote.sh")
|
|
for _, want := range []string{
|
|
"check_active_jobs",
|
|
"mysqldump --defaults-extra-file=",
|
|
"gzip -t",
|
|
"preflight_port=\"18083\"",
|
|
"current_schema < target_schema",
|
|
"allow_migration",
|
|
"install -d -o root -g cmautobuy -m 0750 \"$release_root\"",
|
|
"install -d -o root -g cmautobuy -m 0750 \"$release_dir\"",
|
|
"mv -Tf \"$temporary_link\" \"$stable_binary\"",
|
|
"restore_previous_release",
|
|
"数据库迁移不会自动回滚",
|
|
"nginx -t",
|
|
} {
|
|
if !strings.Contains(source, want) {
|
|
t.Errorf("远端部署脚本缺少关键安全步骤 %q", want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDeployScripts_不降低传输安全或写死凭据(t *testing.T) {
|
|
source := readDeployScript(t, "deploy/deploy-admin.ps1") + "\n" +
|
|
readDeployScript(t, "deploy/deploy-admin-remote.sh")
|
|
for _, forbidden := range []string{
|
|
"StrictHostKeyChecking=no",
|
|
"--no-check-certificate",
|
|
"curl -k",
|
|
"CMAUTOBUY_DB_PASSWORD=",
|
|
"Authorization:",
|
|
} {
|
|
if strings.Contains(source, forbidden) {
|
|
t.Errorf("部署脚本包含禁止内容 %q", forbidden)
|
|
}
|
|
}
|
|
}
|