Files
acdl/tests/test_adapter.py
T
Jon Chery f68f85c9fd
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 15s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
review(v1.5): READY TO SHIP — multi-persona code review
---ci---
project: acdl
phase: 20
milestone: v1.5
status: review
verdict: READY TO SHIP
p0: 1 (fixed — contract path resolution in deploy workflow)
p1: 6 (flagged post-hoc)
---/ci---

Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow).

P0 (blocking) — AUTO-FIXED:
- C1: scripts/run_platform.sh contract path resolution broken in deploy
  workflow. The reusable workflow invokes run_platform.sh from the consumer
  workspace root with a relative contract path (.acdl/contract.yaml), but
  run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative
  path resolved against the platform repo and the pipeline could never run.
  Fix (commit 75c2274): capture CALLER_CWD before cd "$ROOT"; resolve
  caller-supplied relative paths against CALLER_CWD; default no-arg contract
  stays relative to ROOT (preserves platform-local CI). Reproduced pre-fix;
  verified post-fix.

P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship):
- C2: ref: v1.4 in the deploy workflow platform checkout — no v1.4 tag exists
  (only v1.4.0 / v1.4.1). Operator must create a floating v1.4 tag or change
  the ref to v1.4.1.
- C3: modules/l2/{static-asset,microservice}/README.md still use @v1 in their
  Usage examples; missed by the v1.4 bump.
- S1: static-key override is not wired. ACDL_AWS_* env vars on the OIDC step
  are not read by aws-actions/configure-aws-credentials@v4 (it reads AWS_*
  or its own access-key/secret-key inputs). The README/CONSUMER_GUIDE claim
  a working override that doesn't function as written. Needs a conditional
  step or renamed env vars + input wiring.
- S2: README overstates ABAC repo:org/repo:ref:... scoping. The workflow
  constructs a numeric role name (github.repository_id); the actual claim
  enforcement lives in the IAM trust policy, not in this workflow.
- T1: no deploy-workflow triggers conformance test (CI workflow has one;
  deploy doesn't). Minor — reusable workflows use workflow_call, not push
  triggers, but the contract's triggers field is then unenforced.
- A1: terraform/spike/terraform.tf uploaded as artifact leaks the AWS account
  ID via the state-backend bucket name. Recommend excluding terraform.tf or
  gating artifact upload to non-public repos.

P2 (nits) — listed for awareness: floating-tag terminology imprecision (M1),
  header comment "Gitea Actions" in the GitHub copy (M2, intentional byte-
  identical), pip install split (P1-perf), comment drift in pipelines/deploy.yaml
  header (C4), module README internal inconsistency (C5).

Verdict: READY TO SHIP. The one P0 is fixed. The 6 P1s are post-hoc items —
the deploy workflow is a scaffold whose first real consumer run requires
operator setup (tag, IAM role, secrets) that gates go-live. The P1s should
be addressed before any consumer invokes uses: acdl/.gitea/workflows/
deploy.yml@v1.4 in earnest.

Tests: 154 pass (19 new). run_ci.sh green.
2026-07-22 17:24:28 +00:00

180 lines
6.6 KiB
Python

import json
import os
import sys
from pathlib import Path
import jsonschema
import pytest
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
from adapters.terraform.adapter import (
TYPE_MAP, INPUT_MAP, OUTPUT_MAP, adapt, _tf_value, _ref_expr,
)
ROOT = Path(__file__).resolve().parent.parent
class TestInstance:
def test_instance_validates_against_stack_schema(self, stack_instance, stack_schema):
jsonschema.validate(stack_instance, stack_schema)
def test_instance_has_one_resource(self, stack_instance):
assert len(stack_instance["resources"]) == 1
r = stack_instance["resources"][0]
assert r["id"] == "s3"
assert r["type"] == "aws:s3:bucket"
def test_instance_stack_is_s3(self, stack_instance):
assert stack_instance["stack"]["name"] == "s3"
assert stack_instance["stack"]["kind"] == "l1"
class TestRegistry:
EXPECTED_L1_KEYS = {"s3", "vpc", "ecs-cluster", "ecs-service", "iam-role", "alb", "ecr"}
EXPECTED_L2_KEYS = {"static-asset", "microservice"}
def test_registry_has_9_entries(self, registry):
assert len(registry) == 9
assert set(registry.keys()) == (self.EXPECTED_L1_KEYS | self.EXPECTED_L2_KEYS)
def test_registry_has_7_l1_entries(self, registry):
l1 = {k for k in registry if registry[k]["1.0.0"]["interface"].startswith("modules/l1/")}
assert l1 == self.EXPECTED_L1_KEYS
def test_registry_has_2_l2_entries(self, registry):
l2 = {k for k in registry if registry[k]["1.0.0"]["interface"].startswith("modules/l2/")}
assert l2 == self.EXPECTED_L2_KEYS
def test_all_l1_interfaces_exist(self, registry, repo_root):
for name in self.EXPECTED_L1_KEYS:
entry = registry[name]["1.0.0"]
iface_path = os.path.join(repo_root, entry["interface"])
assert os.path.isfile(iface_path), f"{iface_path} missing"
iface = json.load(open(iface_path))
assert iface["name"] == name
class TestTypeMap:
def test_s3_in_type_map(self):
assert TYPE_MAP["aws:s3:bucket"] == "aws_s3_bucket"
def test_vpc_types_in_type_map(self):
assert TYPE_MAP["aws:ec2:vpc"] == "aws_vpc"
assert TYPE_MAP["aws:ec2:subnet"] == "aws_subnet"
assert TYPE_MAP["aws:ec2:routetable"] == "aws_route_table"
def test_ecs_types_in_type_map(self):
assert TYPE_MAP["aws:ecs:cluster"] == "aws_ecs_cluster"
assert TYPE_MAP["aws:ecs:task_definition"] == "aws_ecs_task_definition"
assert TYPE_MAP["aws:ecs:service"] == "aws_ecs_service"
def test_alb_types_in_type_map(self):
assert TYPE_MAP["aws:elbv2:loadbalancer"] == "aws_lb"
assert TYPE_MAP["aws:elbv2:listener"] == "aws_lb_listener"
assert TYPE_MAP["aws:elbv2:targetgroup"] == "aws_lb_target_group"
def test_iam_and_ecr_in_type_map(self):
assert TYPE_MAP["aws:iam:role"] == "aws_iam_role"
assert TYPE_MAP["aws:ecr:repository"] == "aws_ecr_repository"
class TestTfValue:
def test_string_quoted(self):
assert _tf_value("hello") == '"hello"'
def test_bool_true(self):
assert _tf_value(True) == "true"
def test_bool_false(self):
assert _tf_value(False) == "false"
def test_int(self):
assert _tf_value(42) == "42"
def test_float(self):
assert _tf_value(3.14) == "3.14"
def test_dict_jsonencoded(self):
result = _tf_value({"key": "val"})
assert "jsonencode" in result
assert '"key"' in result
def test_list_jsonencoded(self):
result = _tf_value([1, 2])
assert "jsonencode" in result
def test_json_string_jsonencoded(self):
result = _tf_value('{"k":"v"}')
assert "jsonencode" in result
def test_ref_raises(self):
with pytest.raises(ValueError, match="ref: values"):
_tf_value("ref:s3.bucket_arn")
class TestRefExpr:
def test_basic_ref(self):
type_by_id = {"s3": "aws:s3:bucket"}
result = _ref_expr("ref:s3.bucket_arn", type_by_id)
assert result == "aws_s3_bucket.s3.arn"
def test_vpc_ref(self):
type_by_id = {"vpc": "aws:ec2:vpc"}
result = _ref_expr("ref:vpc.vpc_id", type_by_id)
assert result == "aws_vpc.vpc.id"
def test_unknown_id_raises(self):
with pytest.raises(ValueError, match="unknown stack resource id"):
_ref_expr("ref:nonexistent.output", {"s3": "aws:s3:bucket"})
class TestAdapt:
def test_adapt_emits_three_files(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
assert os.path.isfile(os.path.join(out_dir, "main.tf"))
assert os.path.isfile(os.path.join(out_dir, "terraform.tf"))
assert os.path.isfile(os.path.join(out_dir, "providers.tf"))
def test_main_tf_has_s3_bucket(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert 'resource "aws_s3_bucket" "s3"' in main_tf
assert 'bucket = "acdl-spike-bucket"' in main_tf
def test_main_tf_has_versioning(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert "versioning" in main_tf
assert "enabled = true" in main_tf
def test_main_tf_has_outputs(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert 'output "bucket_arn"' in main_tf
assert 'output "bucket_name"' in main_tf
def test_terraform_tf_has_backend(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
terraform_tf = open(os.path.join(out_dir, "terraform.tf")).read()
assert 'backend "s3"' in terraform_tf
assert 'required_version' in terraform_tf
assert ">= 1.9" in terraform_tf
def test_providers_tf_has_aws(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
providers_tf = open(os.path.join(out_dir, "providers.tf")).read()
assert 'provider "aws"' in providers_tf
assert "us-east-1" in providers_tf
def test_backend_key_uses_stack_name(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
terraform_tf = open(os.path.join(out_dir, "terraform.tf")).read()
assert "spike/s3/terraform.tfstate" in terraform_tf