Keep main's rule right at every start and copy a covering glob's checks (issue 948, review round 1)

modules/gitea/test/tools-account.test.ts

@@ -33,7 +33,9 @@ function fakeForge() {
   const calls: string[] = [];
   // The organisation's repositories, and the rule each has for main, which the administrator's setup puts right
   // (issue 948, ADR 0398 §2).
-  const repos = ["hq", "mesh-catalog"];
+  const repos = ["hq", "mesh-catalog", "globbed"];
+  const globRules = new Map<string, any[]>([["globbed", [{ rule_name: "m*", enable_status_check: true,
+    status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"], block_admin_merge_override: true, required_approvals: 1 }]]]);
   const mainRules = new Map<string, any>([["hq", { rule_name: "main", enable_status_check: true, status_check_contexts: ["mesh/merge-gate"] }]]);
   // What the forge does wrong when a test says so: a token mint or delete it fails, a team another process made
   // between this one's look and its create (gitea answers the create 422).
@@ -152,6 +154,9 @@ function fakeForge() {
     if (m) {
       const admins = isAdmin(me) || teams.some((t) => t.members.has(me) && t.units.permission === "admin");
       if (!admins) return json(res, 403, { message: "user should be an owner or a collaborator with admin write of a repository" });
+      if (req.method === "GET" && m[2] === undefined) {
+        return json(res, 200, [...(mainRules.has(m[1]) ? [mainRules.get(m[1])] : []), ...(globRules.get(m[1]) ?? [])]);
+      }
       if (req.method === "PATCH" && m[2] === "main") {
         const rule = mainRules.get(m[1]);
         if (!rule) return json(res, 404, { message: "branch protection does not exist" });
@@ -367,3 +372,26 @@ test("setting the tools' account up puts main's rule right in every repository:
   assert.ok(forge.calls.slice(from).filter((c) => /branch_protections/.test(c)).every((c) => c.endsWith(` as ${ADMIN}`)),
     "only the administrator's login touches a rule: the tools' account is no repository's administrator");
 });
+
+test("a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1)", async () => {
+  const env = await environment();
+  await fresh(env).listRepos();
+  const rule = forge.mainRules.get("globbed");
+  assert.ok(rule, "main is given its own rule");
+  assert.deepEqual(rule.status_check_contexts, ["mesh/merge-gate", "mesh/repo-check"]);
+  assert.equal(rule.enable_status_check, true);
+  assert.equal(rule.block_admin_merge_override, true);
+  assert.equal(rule.required_approvals, 1);
+  assert.equal(rule.enable_push, false);
+  assert.deepEqual(rule.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
+});
+
+test("a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1)", async () => {
+  const src = await readFile(new URL("../index.ts", import.meta.url), "utf8");
+  assert.match(src, /ensureMainMerges\("novox"\)/, "index.ts calls it outside the token's mint");
+  const { GiteaAdmin } = await import("../dist/client.js");
+  const env = await environment();
+  forge.mainRules.delete("hq");
+  await GiteaAdmin.fromEnv(env).ensureMainMerges("novox");
+  assert.equal(forge.mainRules.get("hq").enable_push, false, "a rule gone is made again with no token minted");
+});