From 3f7388fdc8695e3d1edce82362ebe37afbaeb8cc Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Fri, 17 Jul 2026 04:36:16 -0700 Subject: [PATCH] test: remove obsolete terraform test, fix stale sentry-release assertion test/unit/root-terraform-grafana-firewall.test.ts read terraform/main.tf, terraform/variables.tf, and terraform/README.md -- all deleted by commit 9001197c ("chore: remove unused terraform/ directory"), whose message confirms this was deliberate and discussed with the repo owner ("Never applied... no intention of using terraform/Hetzner going forward"). The test guarded real safety-critical invariants (Grafana's firewall port never opened to the public) for a module that no longer exists, so it's pure dead code now -- removed rather than updated, since there's nothing left to test. The miner's separate Terraform module (packages/loopover-miner/terraform/) is untouched and still has its own test. test/unit/selfhost-sentry-release.test.ts asserted scripts/deploy-selfhost-prebuilt.sh still defaults SENTRY_RELEASE to the pre-rename "gittensory-selfhost@..." prefix; the script itself has already moved to "loopover-selfhost@...". Every other assertion in this test (40+, covering the release workflow's Docker image naming, Sentry API calls, and version-tag handling) was already correct and unaffected -- only this one stale expected value needed updating to match reality. Also regenerates scripts/branding-drift-baseline.json: unrelated to this change, but picked up while re-verifying against a moving main -- a separate, concurrent rebrand PR removed a "gittensory" comment mention in packages/loopover-mcp/bin/loopover-mcp.js without regenerating the baseline, so the regression-guard test in check-branding-drift-script.test.ts was failing on main itself. Confirmed via git blame/content inspection that both original failures were unrelated to any of this session's other PRs (verified real CI logs on #6900, which surfaced these same 2 pre-existing failures despite never touching either file). --- scripts/branding-drift-baseline.json | 2 +- .../root-terraform-grafana-firewall.test.ts | 53 ------------------- test/unit/selfhost-sentry-release.test.ts | 2 +- 3 files changed, 2 insertions(+), 55 deletions(-) delete mode 100644 test/unit/root-terraform-grafana-firewall.test.ts diff --git a/scripts/branding-drift-baseline.json b/scripts/branding-drift-baseline.json index c46c3f88cd..8af380f9b0 100644 --- a/scripts/branding-drift-baseline.json +++ b/scripts/branding-drift-baseline.json @@ -1,6 +1,6 @@ { "packages/loopover-engine/src/signals/engine.ts": 2, - "packages/loopover-mcp/bin/loopover-mcp.js": 3, + "packages/loopover-mcp/bin/loopover-mcp.js": 2, "src/api/routes.ts": 2, "src/db/repositories.ts": 1, "src/github/app.ts": 11, diff --git a/test/unit/root-terraform-grafana-firewall.test.ts b/test/unit/root-terraform-grafana-firewall.test.ts deleted file mode 100644 index dea9da1813..0000000000 --- a/test/unit/root-terraform-grafana-firewall.test.ts +++ /dev/null @@ -1,53 +0,0 @@ -import { readFileSync } from "node:fs"; - -import { describe, expect, it } from "vitest"; - -// Static structural checks for the root ORB Terraform module's Grafana exposure (#5818). docker-compose.yml's -// `grafana` service (--profile observability) publishes 3000:3000 on the host, but the firewall had no rule for -// it — not even an admin-scoped one — so an operator following main.tf's own documented flow (provision, then -// `docker compose --profile observability up -d`) got a timed-out connection with no explanation. These lock in -// the SAFETY-CRITICAL invariants a `terraform validate` can't see: the port is opt-in, and it can never be -// opened to the public. Mirrors the pattern in test/unit/miner-terraform-module.test.ts. - -const DIR = "terraform"; -const mainTf = readFileSync(`${DIR}/main.tf`, "utf8"); -const variablesTf = readFileSync(`${DIR}/variables.tf`, "utf8"); -const readme = readFileSync(`${DIR}/README.md`, "utf8"); -const dockerCompose = readFileSync("docker-compose.yml", "utf8"); - -/** The `dynamic "rule"` block that gates Grafana's port, body included. */ -const grafanaRule = /dynamic\s+"rule"\s*\{[\s\S]*?for_each\s*=\s*var\.expose_grafana[\s\S]*?\n {2}\}/.exec(mainTf)?.[0] ?? ""; - -describe("root Terraform module — Grafana firewall (#5818)", () => { - it("still matches the compose service it exists for: grafana publishes 3000 under the observability profile", () => { - // If this drifts, the firewall rule below is guarding the wrong port. - expect(dockerCompose).toMatch(/grafana:[\s\S]*?profiles:\s*\["observability"\]/); - expect(dockerCompose).toMatch(/grafana:[\s\S]*?ports:[\s\S]*?"3000:3000"/); - }); - - it("opens Grafana's port 3000, gated by var.expose_grafana", () => { - expect(grafanaRule, "a dynamic rule gated on var.expose_grafana must exist").not.toBe(""); - expect(grafanaRule).toMatch(/port\s*=\s*"3000"/); - expect(grafanaRule).toMatch(/protocol\s*=\s*"tcp"/); - expect(grafanaRule).toMatch(/direction\s*=\s*"in"/); - }); - - it("INVARIANT: Grafana's port is admin-allowlist-scoped — never opened to the public like the Caddy ports", () => { - expect(grafanaRule).toMatch(/source_ips\s*=\s*var\.admin_ip_allowlist/); - expect(grafanaRule).not.toMatch(/0\.0\.0\.0\/0/); - expect(grafanaRule).not.toMatch(/::\/0/); - }); - - it("INVARIANT: exposure is opt-in — expose_grafana is a bool defaulting to false", () => { - const variable = /variable\s+"expose_grafana"\s*\{[\s\S]*?\n\}/.exec(variablesTf)?.[0] ?? ""; - expect(variable, "expose_grafana must be declared").not.toBe(""); - expect(variable).toMatch(/type\s*=\s*bool/); - expect(variable).toMatch(/default\s*=\s*false/); - expect(variable).toMatch(/description\s*=/); // every var in this file documents itself - }); - - it("documents both access paths, including a runnable SSH-tunnel command for the closed default", () => { - expect(readme).toMatch(/ssh -L 3000:localhost:3000/); - expect(readme).toContain("expose_grafana"); - }); -}); diff --git a/test/unit/selfhost-sentry-release.test.ts b/test/unit/selfhost-sentry-release.test.ts index 94e1e5094b..10734c6048 100644 --- a/test/unit/selfhost-sentry-release.test.ts +++ b/test/unit/selfhost-sentry-release.test.ts @@ -61,7 +61,7 @@ describe("self-host Sentry release wiring", () => { 'SENTRY_CLI_PACKAGE="${SENTRY_CLI_PACKAGE:-@sentry/cli@3.6.0}"', ); expect(edgeDeployScript).toContain( - 'SENTRY_RELEASE="${SENTRY_RELEASE:-gittensory-selfhost@$(git rev-parse --short=8 HEAD)}"', + 'SENTRY_RELEASE="${SENTRY_RELEASE:-loopover-selfhost@$(git rev-parse --short=8 HEAD)}"', ); expect(edgeDeployScript).not.toContain('env_get SENTRY_RELEASE'); expect(edgeDeployScript).not.toContain("@sentry/cli@latest");