源码快照 @ 2026-09-01 (source-only, 剔除非源码素材)

scripts/asf-source-workflow-policy.test.mjs

@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, test } from 'node:test';
+
+const workflowPath = join(import.meta.dirname, '../.github/workflows/asf-source-candidate.yml');
+const ciWorkflowPath = join(import.meta.dirname, '../.github/workflows/ci.yml');
+
+describe('ASF source workflow policy', () => {
+  test('binds the candidate handoff to the dispatched commit and artifact', () => {
+    const workflow = readFileSync(workflowPath, 'utf8');
+    assert.doesNotMatch(workflow, /RELEASE_SHA/);
+    assert.match(workflow, /ref: \$\{\{ github\.sha \}\}/);
+    assert.match(workflow, /--revision "\$GITHUB_SHA"/);
+    assert.match(workflow, /Commit: \\`\$GITHUB_SHA\\`/);
+    assert.match(workflow, /tar -xzf "\$CANDIDATE_PATH"/);
+    assert.match(workflow, /npm run check:third-party-notices/);
+    assert.match(workflow, /npm run check:cli-third-party-notices/);
+    assert.match(workflow, /npm run check:windows-cargo-notices/);
+    assert.doesNotMatch(workflow, /rc_number/);
+    assert.match(workflow, /name: apache-maka-.*-incubating-\$\{\{ github\.sha \}\}-unsigned/);
+    assert.match(workflow, /\$\{\{ env\.CANDIDATE_PATH \}\}\.sha512/);
+    assert.match(
+      workflow,
+      /RUNBOOK_URL: .*\/blob\/\$\{\{ github\.sha \}\}\/\.github\/ASF_SOURCE_RELEASE\.md/,
+    );
+  });
+
+  test('audits source headers in the extracted candidate before it is installed into', () => {
+    const workflow = readFileSync(workflowPath, 'utf8');
+    const auditIndex = workflow.indexOf('npm run check:asf-headers');
+    const installIndex = workflow.indexOf('npm ci');
+    assert.notEqual(auditIndex, -1);
+    assert.notEqual(installIndex, -1);
+    assert.ok(
+      auditIndex < installIndex,
+      'the header audit must read the extracted archive, not a built tree',
+    );
+    assert.match(
+      workflow,
+      /Audit source headers in the extracted candidate\n\s+working-directory: candidate-source\n/,
+    );
+  });
+});
+
+describe('ASF source CI policy', () => {
+  test('keeps the header audit install-free and runs generation checks after installation', () => {
+    const workflow = readFileSync(ciWorkflowPath, 'utf8');
+    const headerIndex = workflow.indexOf('name: Check ASF source headers');
+    const installIndex = workflow.indexOf('name: Install dependencies');
+    const sourceGateIndex = workflow.indexOf('name: Verify ASF source release mechanics');
+    assert.notEqual(headerIndex, -1);
+    assert.notEqual(installIndex, -1);
+    assert.notEqual(sourceGateIndex, -1);
+    assert.ok(headerIndex < installIndex);
+    assert.ok(installIndex < sourceGateIndex);
+    assert.match(
+      workflow,
+      /name: Install dependencies\n\s+if: .*needs\.plan\.outputs\.asf_source == 'true'/,
+    );
+  });
+});