From f8283861787a361d6fa8bc6467ef15c9495b8261 Mon Sep 17 00:00:00 2001 From: bigbes Date: Sun, 9 Aug 2026 01:28:07 +0300 Subject: [PATCH] ci: a test task, and the truth about !check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gofmt, go vet and make test, between cache_restore and build. gofmt -l exits 0 whether or not it printed anything, so its output goes through tee and is checked with test -s. No Postgres and no network: every suite here is hermetic, so nothing can skip and there is no DSN to guard. gitx/fixture_test.go builds a bare repository with the local git and web/web_test.go is httptest plus ecoretest. Which makes the APKBUILD's !check comment wrong, and it has been wrong the whole time — the tests never needed a live git.sr.ht API. With the task in place the option stops meaning 'these cannot run here' and starts meaning 'these ran before abuild did', which is only true while make test stays fatal. Said so where the option is. --- .build.yml | 15 +++++++++++++++ APKBUILD | 9 ++++++++- docs/ci.md | 17 ++++++++++------- 3 files changed, 33 insertions(+), 8 deletions(-) diff --git a/.build.yml b/.build.yml index f05ab8f1fad69c152dfcf138c5d8e24194a7ffde..2d62dbd1b648cdf9b991761e731003cbc36b2bfd 100644 --- a/.build.yml +++ b/.build.yml @@ -122,6 +122,21 @@ tasks: # in the packaged binary, so say so out loud rather than trusting the # flag. docs/ci.md#cache_restore. git status --porcelain + - test: | + cd "$REPO" + # gofmt -l exits 0 whether or not it printed anything, so the only way to + # fail on its output is to look at the output; tee keeps the filenames in + # the log, where they are the whole diagnosis. See docs/ci.md#test. + gofmt -l . | tee /tmp/fmt + test ! -s /tmp/fmt || { echo "gofmt would change the files above" >&2; exit 1; } + go vet ./... + # `make test` and not a bare `go test ./...`: the test command lives in + # one place. There is no DSN guard and no service to reach — every suite + # here is hermetic (gitx builds a bare repo with the local git, web is + # httptest + ecoretest) — so nothing can skip, and a failure is a non-zero + # exit that fails this task. That is what the APKBUILD's `!check` now + # rests on. docs/ci.md#test. + make test - build: | cd "$REPO" # -d: makedepends come from `packages:` above, so skip abuild's own diff --git a/APKBUILD b/APKBUILD index aba8c3878993a84d3c1be0be785408577c8c76c4..a7023bab6cfeadcc8f9be80619807945a8f839ca 100644 --- a/APKBUILD +++ b/APKBUILD @@ -28,7 +28,14 @@ pkgdesc="Stateless diff/compare viewer for a sourcehut instance" url="https://sourcecraft.dev/bigbes/sr-ht-compare" arch="x86_64" license="MIT" -# !check — the Go tests need a live git.sr.ht API, not available in the VM +# !check — the suites are run by the `test` task of .build.yml, which runs +# BEFORE this package is built. They do NOT need a live git.sr.ht +# API — that claim was here for a year and was never true: every +# suite in this tree is hermetic (gitx/fixture_test.go builds a +# bare repo with the local git, web/web_test.go is httptest plus +# ecoretest). This option is therefore a promise that they ran +# elsewhere, not a statement that they are unrunnable, and it is +# only as good as that task staying fatal. # !tracedeps — CGO_ENABLED=0, so there are no shared-object deps to trace options="!check !tracedeps" diff --git a/docs/ci.md b/docs/ci.md index 35f5dff40489d2ef6cce49592e630f28697dcf98..4c0753e69af0cb96e1fbbcbfa750654a046388fc 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -8,7 +8,7 @@ manifest carries pointers. The pipeline is one linear job on `alpine/edge`: install the cache helper, assemble the shared SCSS, make a throwaway signing key, decide the version, -restore the Go caches, package with `abuild`, publish the apk to +restore the Go caches, test, package with `abuild`, publish the apk to `repo.bigb.es/alpine/v3.22/bigbes`, save the caches. It is triggered by a push to the **sourcehut** side. A push to sourcecraft @@ -187,11 +187,16 @@ the build log, where they are the entire diagnosis. `go vet ./...` next, then `make test` — the Makefile, not a bare `go test ./...`, so that the test command lives in one place. -No Postgres and no network. Every suite in this tree is hermetic: +No Postgres, no network and **no guard**. Every suite in this tree is hermetic: `gitx/fixture_test.go` builds a bare repository with the local `git` binary, and -`web/web_test.go` is `httptest` plus `ecoretest`. The APKBUILD's `!check` is -about not running these a second time inside `abuild`, not about them needing -something the VM lacks. +`web/web_test.go` is `httptest` plus `ecoretest`. Nothing here is gated on an +environment variable, so nothing can skip itself into a green build, and the +only thing this task owes is a non-zero exit when `make test` fails. + +That last point is load-bearing for the APKBUILD. `options="!check"` used to say +the tests could not run in the VM — a claim that was never true — and now says +they ran *before* `abuild` did. Which is a promise about **this** task: soften it +and `!check` becomes a package built with nothing tested. ## build @@ -322,8 +327,6 @@ parallel — the copying would start beside the build it is supposed to follow. ## What is not here -- **No test task in the same commit as the version fix.** They are two commits - on purpose: a red suite must not be able to hold up the packaging change. - **No coverage upload.** The sibling services POST their profile to cover.sr.ht at the end of the pipeline. Adding it here needs a token secret and a repository on cover.