ms2k/nuthatch
SHA256
Watch
0
Code Releases Activity

Split kind tests into component-owned probes

Browse source
This commit is contained in:
ms2k 2026-07-19 23:57:21 +09:00
commit 691ad92e30
2 changed files with 4269 additions and 3108 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/spec/contracts.md
View file

@ -179,10 +179,9 @@ authority over other buckets. End users and browsers never receive its
credentials.
The deployment's object-store IAM or policy system enforces that scope. The
Kubernetes manifest supplies the scoped credential through the secret boundary;
`tests/kind/lib.sh` provisions equivalent fixture principals, and
`tests/kind/product-matrix-job.yaml.in` verifies denial against a different
bucket.
Kubernetes manifest supplies the scoped credential through the secret boundary.
`tests/kind/fixture/target.sh` provisions equivalent fixture principals, and
`test/AuthProbe.hs` verifies denial against a different bucket.
Nuthatch is the exclusive writer to `users/` and `shared/` in the configured
bucket while the service is enabled. Operators may inspect those prefixes, but

14
docs/spec/testing.md
View file

@ -37,9 +37,9 @@ The fixture provides PostgreSQL, Redis and DragonflyDB, Keycloak and ZITADEL,
and Garage and VersityGW. Images and fixture tools are checksum or
digest-pinned.
`make check-dependencies` creates the complete fixture, verifies each released
dependency image through its product interface, and destroys the fixture.
`make check-kind-matrix` runs a fixture-consumer Job sequentially across the
`make check-dependencies` creates the complete fixture, runs the Haskell
dependency probe against each released product interface, and destroys the
fixture. `make check-kind-matrix` runs the Haskell fixture probe sequentially across the
Redis/DragonflyDB × Keycloak/ZITADEL × Garage/VersityGW matrix without
deploying Nuthatch. `make check-app` deploys Nuthatch and runs its smoke Job
across the Redis/DragonflyDB × Garage/VersityGW matrix. `make app-up` retains
@ -72,6 +72,14 @@ retained. Locally built application or test images are loaded with
`load_local_image`; released dependencies always use the digest-pinned images
from `tests/kind/versions.env`.
`tests/kind/lib.sh` is a compatibility facade over the fixture modules.
The shared core owns only paths, the explicit Kubernetes wrapper, locking, and
Job observation. Runtime-provider setup, dependency deployment, lane
selection, PostgreSQL, Redis-compatible coordination, OIDC, target
provisioning, profiles, and lane cleanup have separate modules under
`tests/kind/fixture/`. Job manifests configure and launch one component-owned
Haskell probe; they do not contain shell test programs.
The host provides rootless nerdctl and containerd at the versions recorded in
`tests/kind/versions.env`, together with `ctr`, `curl`, `flock`, `jq`, and
`sha256sum`. The fixture downloads its pinned kind and kubectl binaries.