ceremony/test/refs-not-closing.test.sh

#!/usr/bin/env bash
# Contract tests for actions/refs-not-closing (issue #218). Bodies and
# closing-reference sets are fixtures: no network and no pull request are
# involved. set -u, not -e: failures are behavior for the harness to inspect.
set -u

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=test/harness.sh
. "$ROOT/test/harness.sh"

SCRIPT="$ROOT/actions/refs-not-closing/refs-not-closing.sh"
ACTION="$ROOT/actions/refs-not-closing/action.yml"
ENTRYPOINT="$ROOT/actions/refs-not-closing/run.sh"
WORKFLOW="$ROOT/.github/workflows/refs-guard.yml"

TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

body() {
  local name="$1"
  shift
  printf '%s\n' "$@" >"$TMP/$name.md"
}

guard() {
  local name="$1"
  shift
  bash "$SCRIPT" "$TMP/$name.md" "$@"
}

body ref-5 'Refs #5'
check "Refs target with empty closing set passes" 0 "no Refs target" guard ref-5
check "Refs target with itself closing fails" 1 "#5" guard ref-5 5
check "Refs target with another issue closing passes" 0 "no Refs target" guard ref-5 9

body ordinary 'Closes #5'
check "ordinary Closes PR remains green" 0 "no Refs target" guard ordinary 5

body mixed 'Refs #5' '' 'This PR legitimately Closes #9.'
check "Refs #5 plus Closes #9 remains green" 0 "no Refs target" guard mixed 9

body prose 'Refs #5' '' 'Triage closes #5 by hand after the live proof.'
check "closing prose for a Refs target fails" 1 "closes #5" guard prose 5
check "failure prints the surrounding sentence" 1 \
  "sentence: Triage closes #5 by hand after the live proof" guard prose 5
check "failure offers number-first rewrite" 1 "#N is" guard prose 5
check "failure offers number-free rewrite" 1 "closes the issue" guard prose 5

body code-span 'Refs #5' '' "The body must not contain \`Closes #5\` anywhere."
check "backticked closing keyword is reported as the match" 1 \
  "matched: Closes #5" guard code-span 5
check "backtick failure explains that code spans do not protect" 1 \
  "Backticks do not protect" guard code-span 5

body adjacency 'Refs #5' '' 'Triage closes #9 and #5 after the proof.'
check "non-adjacent #5 does not join closing set #9" 0 "no Refs target" \
  guard adjacency 9

body empty ''
check "empty body remains green" 0 "no Refs target" guard empty 5

body incidents-211 'Refs #209' 'Triage closes #209 by hand.'
check "#211 incident replays red" 1 "#209" guard incidents-211 209
body incidents-214 'Refs #212' 'Triage closes #212 and #209 on that evidence.'
check "#214 incident replays red" 1 "#212" guard incidents-214 212
body incidents-200 'Refs #199' "A later edit added \`Closes #199\`."
check "#200 incident replays red" 1 "#199" guard incidents-200 199

body multiple 'Refs #5 and Refs #7.' 'Triage closes #5 and fixes #7 by hand.'
check "failure names every intersecting issue" 1 \
  "scheduled to close: #5 #7" guard multiple 5 7

body soft-wrap 'Refs #5' '' 'Triage closes' '#5 by hand after the live proof.'
check "soft-wrapped closing prose is reported as one sentence" 1 \
  "sentence: Triage closes #5 by hand after the live proof" \
  guard soft-wrap 5

body refs-colon 'Refs: #5' '' 'Triage closes #5 after proof.'
check "Refs colon form is protected" 1 "matched: closes #5" \
  guard refs-colon 5
body refs-link 'Refs [#5](https://example.test/issues/5)' '' \
  'Triage closes #5 after proof.'
check "linked Refs form is protected" 1 "matched: closes #5" \
  guard refs-link 5

for number in 207 191 190 176 165 164; do
  body "incident-$number" "Refs #$number"
  check "#$number incident replays green" 0 "no Refs target" \
    guard "incident-$number"
done

check "missing body is a loud failure" 1 "missing or unreadable" \
  bash "$SCRIPT" "$TMP/missing.md"
check "invalid closing set is a loud failure" 1 "invalid closing issue" \
  guard ref-5 nope

# The action owns the network boundary. Drive its executable entrypoint with
# a fake `gh` so failures are behavioral assertions, not YAML text guesses.
mkdir -p "$TMP/bin"
cat >"$TMP/bin/gh" <<'EOF'
#!/usr/bin/env bash
set -u
# Every call is recorded, so a probe can assert the gather did NOT run — a
# refusal that still reads is not a refusal (#198).
[ -z "${GH_CALL_LOG:-}" ] || printf '%s\n' "$*" >>"$GH_CALL_LOG"
case "${FAKE_GH_MODE:-success}" in
  failure)
    echo "fake GraphQL read failed" >&2
    exit 42
    ;;
  partial)
    has_next=true
    ;;
  success)
    has_next=false
    ;;
  *)
    echo "unknown fake mode: ${FAKE_GH_MODE:-}" >&2
    exit 2
    ;;
esac
printf '{"data":{"repository":{"pullRequest":{"body":"Refs #5","closingIssuesReferences":{"nodes":[],"pageInfo":{"hasNextPage":%s}}}}}}\n' "$has_next"
EOF
chmod +x "$TMP/bin/gh"

action_boundary() {
  local mode="$1"
  # CEREMONY_FORGE=github is the environment this matrix has always assumed
  # implicitly — it stubs `gh`. It is explicit now only because the entrypoint
  # declares CEREMONY_FORGE_CLIENT=gh and preflights it (#198 spec 4); the
  # incident matrix below is unchanged.
  env PATH="$TMP/bin:$PATH" FAKE_GH_MODE="$mode" \
    CEREMONY_FORGE=github \
    GITHUB_REPOSITORY="heavy-duty/ceremony" PR_NUMBER=268 \
    GITHUB_ACTION_PATH="$ROOT/actions/refs-not-closing" \
    bash "$ENTRYPOINT"
}

# The declared-client refusal (#198 spec 4). This action is the one call site
# the 0.6.0 merge could NOT port — Forgejo serves no GraphQL at all — so on a
# Forgejo forge it must refuse by name, never produce a verdict from a graph
# it did not read. #199 removes the declaration by making the gather REST.
forgejo_boundary() {
  env PATH="$TMP/bin:$PATH" FAKE_GH_MODE=success GH_CALL_LOG="$TMP/gh-calls" \
    CEREMONY_FORGE=forgejo \
    GITHUB_REPOSITORY="heavy-duty/ceremony" PR_NUMBER=268 \
    GITHUB_ACTION_PATH="$ROOT/actions/refs-not-closing" \
    bash "$ENTRYPOINT"
}
# The contract on a forge this action cannot speak: refuse, by name, non-zero,
# and read nothing. FAIL CLOSED — an earlier head made this exit 0 so the PR
# check would not be red, which conflated the ACTION's contract with the
# CALLER's scheduling decision (@codex-reviewer-andresmgsl, #198). The caller
# is .github/workflows/refs-guard.yml, which skips on a backend this action
# cannot speak; the action itself never reports success it did not earn.
check "on a forgejo forge the action refuses, non-zero" 1 \
  "cannot speak it" forgejo_boundary
check "...naming the client it declared" 1 "'gh' client" forgejo_boundary
check "...and the client the forge actually needs" 1 "'rest' client" forgejo_boundary
# The teeth: it must not have READ anything. The stub counts its own calls, so
# a gather that ran despite the refusal is visible here.
forgejo_read_count() {
  : >"$TMP/gh-calls"
  forgejo_boundary >/dev/null 2>&1
  wc -l <"$TMP/gh-calls"
}
check "...and reached the forge zero times" 0 "0" forgejo_read_count
# The caller carries the scheduling half, positively: only github.com runs it.
check "the caller skips the job on any non-github forge" 0 \
  "github.server_url == 'https://github.com'" \
  grep -F "if:" "$ROOT/.github/workflows/refs-guard.yml"

check "action boundary fails when GraphQL read fails" 42 \
  "fake GraphQL read failed" action_boundary failure
check "action boundary refuses a partial closing-reference page" 5 \
  "refusing a partial verdict" action_boundary partial
check "action boundary accepts a complete GraphQL read" 0 \
  "no Refs target" action_boundary success

one_graphql_read() {
  [ "$(grep -c "gh api graphql" "$ENTRYPOINT")" -eq 1 ]
  printf '1\n'
}

check "action performs exactly one GraphQL read" 0 "1" \
  one_graphql_read
check "composite delegates to the tested entrypoint" 0 "run.sh" \
  grep -F "run: bash \"\$GITHUB_ACTION_PATH/run.sh\"" "$ACTION"

check "workflow wakes on body edits" 0 "types: [opened, edited, reopened, synchronize]" \
  grep -F "types: [opened, edited, reopened, synchronize]" "$WORKFLOW"
check "workflow is pull_request-only" 1 "" \
  grep -E '^  (push|pull_request_target|workflow_dispatch|schedule|issue_comment):' \
  "$WORKFLOW"
check "workflow grants read-only pull request access" 0 "pull-requests: read" \
  grep -F "pull-requests: read" "$WORKFLOW"

summary