From 3b5c55bc8ee0d871f50493bd0bcdcbe5e209538c Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 21 Jul 2026 18:40:33 +0000 Subject: [PATCH] test(git): cover provisioning failures --- tests/unit/test_docker_provision_git_user.py | 43 ++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/tests/unit/test_docker_provision_git_user.py b/tests/unit/test_docker_provision_git_user.py index a889002..d193e9f 100644 --- a/tests/unit/test_docker_provision_git_user.py +++ b/tests/unit/test_docker_provision_git_user.py @@ -45,12 +45,15 @@ _PROVIDER = _Provider() def _plan(*, git_user: dict | None = None, # type: ignore + git_repos: dict | None = None, # type: ignore copy_cwd: bool = False, user_cwd: str = "/tmp/x", stage_dir: Path | None = None) -> DockerBottlePlan: bottle_json: dict = {} # type: ignore if git_user is not None: bottle_json["git-gate"] = {"user": git_user} + if git_repos is not None: + bottle_json.setdefault("git-gate", {})["repos"] = git_repos index = ManifestIndex.from_json_obj({ "bottles": {"dev": bottle_json}, "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}}, @@ -141,6 +144,46 @@ class TestProvisionGitUser(unittest.TestCase): self.assertIn("chown -R node:node /home/node/.config", script) self.assertIn("chmod -R u+rwX,go+rX /home/node/.config", script) + def test_fails_closed_when_home_permissions_cannot_be_repaired(self): + bottle = _make_bottle() + bottle.exec.return_value = ExecResult(1, "", "read-only filesystem") + + with self.assertRaises(SystemExit): + _PROVIDER.provision_git(bottle, _plan(stage_dir=self.stage)) + + def _git_plan(self) -> DockerBottlePlan: + return _plan( + git_repos={ + "repo": { + "url": "ssh://git@example.com/repo.git", + "key": {"provider": "static", "path": "/dev/null"}, + "host_key": "ssh-ed25519 AAAA", + }, + }, + stage_dir=self.stage, + ) + + def test_fails_closed_when_gitconfig_permissions_cannot_be_set(self): + bottle = _make_bottle() + bottle.exec.side_effect = [ + ExecResult(0, "", ""), + ExecResult(1, "", "chown failed"), + ] + + with self.assertRaises(SystemExit): + _PROVIDER.provision_git(bottle, self._git_plan()) + + def test_fails_closed_when_runtime_user_cannot_read_gitconfig(self): + bottle = _make_bottle() + bottle.exec.side_effect = [ + ExecResult(0, "", ""), + ExecResult(0, "", ""), + ExecResult(1, "", "permission denied"), + ] + + with self.assertRaises(SystemExit): + _PROVIDER.provision_git(bottle, self._git_plan()) + def test_sets_name_and_email(self): plan = _plan( git_user={"name": "Eric Bauerfeld", "email": "eric@dideric.is"},