Check each done artifact's reference against its kind, and say when a key can be delivered (issue 1587, S13, ADR 0498 §1 §5 §6 §8)

A bundle or archive names its artifact-store blob, an image or upstream copy the registry's reference to its digest (L1), a package name@version; Referenced names the artifacts without one, since the controller delivers only from a key with all.
2026-10-22 17:31:40 +02:00
parent d14a6d301c
commit 97895851f8
3 changed files with 145 additions and 3 deletions
@@ -0,0 +1,76 @@
+package delivery
+
+import (
+	"strings"
+	"testing"
+)
+
+func artifactOf(name, kind, digest, reference string) BuiltArtifact {
+	return BuiltArtifact{Name: name, Kind: kind, Digest: digest, Reference: reference}
+}
+
+// A done key names where each artifact is (novox/hq ADR 0498 clauses 1, 5 and 6; the lead's decision L1 of R4e): a
+// bundle or an archive by its artifact-store blob, an image or an upstream copy by the registry's reference to its
+// digest (or the kept artifact-store form), a package by name and version. A reference of the wrong form for its kind,
+// or naming another digest or artifact, is refused, naming the artifact.
+func TestADoneKeyNamesEachArtifactsReferenceInTheFormOfItsKind(t *testing.T) {
+	d := "sha256:" + digestOf('6')
+	good := []BuiltArtifact{
+		artifactOf("code", "bundle", d, "artifact-store://mail/code/blobs/"+d),
+		artifactOf("files", "archive", d, "artifact-store://mail/files/blobs/"+d),
+		artifactOf("server", "image", d, "10.0.0.1:5000/mail/server@"+d),
+		artifactOf("server", "image", d, "artifact-store://mail/server@"+d),
+		artifactOf("nats", "upstream", d, "registry.example/nats/nats@"+d),
+		artifactOf("lib", "package", d, "@novox/mesh-sdk@0.1.15"),
+		artifactOf("lib", "package", d, "left-pad@1.3.0"),
+		artifactOf("old", "", d, "anything at all"),
+	}
+	for _, a := range good {
+		b := doneBuild()
+		b.Artifacts = []BuiltArtifact{a}
+		if _, err := EncodeBuilderBuild(b); err != nil {
+			t.Errorf("%+v was refused: %v", a, err)
+		}
+	}
+	other := "sha256:" + digestOf('7')
+	bad := []BuiltArtifact{
+		artifactOf("code", "bundle", d, "artifact-store://mail/code/blobs/"+other),
+		artifactOf("code", "bundle", d, "artifact-store://mail/other/blobs/"+d),
+		artifactOf("code", "bundle", d, "10.0.0.1:5000/mail/code@"+d),
+		artifactOf("server", "image", d, "10.0.0.1:5000/mail@"+d),
+		artifactOf("server", "image", d, "10.0.0.1:5000/mail/server@"+other),
+		artifactOf("server", "image", d, "mail/server@"+d),
+		artifactOf("server", "image", d, "artifact-store://mail/server/blobs/"+d),
+		artifactOf("lib", "package", d, "@novox/mesh-sdk"),
+		artifactOf("lib", "package", d, "0.1.15"),
+	}
+	for _, a := range bad {
+		b := doneBuild()
+		b.Artifacts = []BuiltArtifact{a}
+		if _, err := EncodeBuilderBuild(b); err == nil || !strings.Contains(err.Error(), `"`+a.Name+`"`) {
+			t.Errorf("%+v: %v, wanted a refusal naming the artifact", a, err)
+		}
+	}
+}
+
+// The controller delivers only from a done key whose every artifact names a reference (ADR 0498 clause 8): Referenced
+// says so and names the artifacts without one.
+func TestReferencedNamesTheArtifactsWithoutAReference(t *testing.T) {
+	d := "sha256:" + digestOf('6')
+	b := doneBuild()
+	b.Artifacts = []BuiltArtifact{
+		artifactOf("code", "bundle", d, "artifact-store://mail/code/blobs/"+d),
+		artifactOf("server", "image", d, ""),
+	}
+	if ok, missing := b.Referenced(); ok || len(missing) != 1 || missing[0] != "server" {
+		t.Fatalf("Referenced = %v, %v; want false, [server]", ok, missing)
+	}
+	b.Artifacts[1].Reference = "10.0.0.1:5000/mail/server@" + d
+	if ok, missing := b.Referenced(); !ok || len(missing) != 0 {
+		t.Fatalf("Referenced = %v, %v; want true", ok, missing)
+	}
+	if ok, _ := (BuilderBuild{State: BuildQueued}).Referenced(); ok {
+		t.Fatal("a queued key is referenced")
+	}
+}
+