jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-22 14:52:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): verify deployed trust before dependency work

Browse Source
This commit is contained in:
RaresKeY
2026-10-21 21:40:05 +00:00
parent cd9f1f734f
commit 77a02c30ff
5 changed files with 99 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_ci_authoritative_validation.py
+13
View File
@@ -33,3 +33,16 @@ def test_python_tests_are_authoritative():
assert "python -m pytest -q" in python_tests
assert "continue-on-error:" not in python_tests
def test_ci_checks_system_trust_before_project_installation():
python_tests = _indented_block(_WORKFLOW.read_text(), "python-tests", 2)
system_check = python_tests.index("python scripts/check_ca_trust.py --system\n")
system_update = python_tests.index("sudo apt-get install -y --no-install-recommends ffmpeg bubblewrap ca-certificates")
bootstrap = python_tests.index("uv pip install --system --require-hashes")
python_check = python_tests.index("python scripts/check_ca_trust.py --python\n")
application_install = python_tests.index("uv pip install --system -r requirements.txt")
assert system_update < system_check < bootstrap < python_check < application_install
assert system_check < python_tests.index("npm ci")
assert system_check < python_tests.index("npx playwright install")