Merge remote-tracking branch 'origin/main' into feature/network/multi-network-serving

# Conflicts:
#	plugins/lookup/email.py
#	tests/unit/python/roles/web-app-prometheus/test_blackbox_targets.py

tests/unit/python/scripts/lint/test_mermaid.py

@@ -0,0 +1,62 @@
+"""``scripts/lint/mermaid.sh`` renders with the browser install-lint provisioned.
+
+``make lint`` runs its targets in parallel, so the script must not reach for a
+package manager, and a browser that cannot start must fail the lint once with
+its reason instead of once per Markdown file.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from utils.cache.files import PROJECT_ROOT
+
+SCRIPT = Path(PROJECT_ROOT) / "scripts" / "lint" / "mermaid.sh"
+LIBRARY_ERROR = (
+    "chrome-headless-shell: error while loading shared libraries: libnspr4.so"
+)
+RECORDING_STUB = '#!/bin/sh\necho "$(basename "$0")" >> "$STUB_CALLS"\n'
+
+
+class TestMermaidLint(unittest.TestCase):
+    def test_a_browser_that_cannot_start_fails_before_any_file_renders(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            bin_dir = Path(tmp)
+            calls = bin_dir / "calls"
+            calls.touch()
+            for name in ("npx", "apt-get"):
+                (bin_dir / name).write_text(RECORDING_STUB)
+            (bin_dir / "mmdc").write_text(
+                f"{RECORDING_STUB}echo '{LIBRARY_ERROR}' >&2\nexit 1\n"
+            )
+            for stub in bin_dir.iterdir():
+                stub.chmod(0o755)
+            env = {
+                k: v
+                for k, v in os.environ.items()
+                if not k.startswith("INFINITO_") and k != "BASH_ENV"
+            }
+            env["PATH"] = f"{bin_dir}{os.pathsep}{env['PATH']}"
+            env["STUB_CALLS"] = str(calls)
+            proc = subprocess.run(
+                ["bash", str(SCRIPT)],
+                env=env,
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            recorded = calls.read_text().split()  # nocheck: cache-read  stub call log
+
+        self.assertEqual(proc.returncode, 1, proc.stderr)
+        self.assertIn("cannot render a minimal diagram", proc.stderr)
+        self.assertIn(LIBRARY_ERROR, proc.stderr)
+        self.assertNotIn("❌", proc.stdout)
+        self.assertEqual(recorded, ["mmdc"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/scripts/meta/env/test_load.py

@@ -0,0 +1,136 @@
+"""The distro-derived keys follow the distro the caller asks for.
+
+``scripts/tests/deploy/distros.sh`` exports ``INFINITO_DISTRO`` per iteration
+and sources the loader again. The keys composed from the distro must then name
+that distro, not the one ``.env`` was generated for, and ``.env`` itself must
+stay as it was.
+"""
+
+from __future__ import annotations
+
+import filecmp
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from typing import ClassVar
+
+from utils.cache.files import PROJECT_ROOT
+
+LOADER_DIR = Path(PROJECT_ROOT) / "scripts" / "meta" / "env"
+SHOWN = (
+    "INFINITO_DISTRO",
+    "INFINITO_CONTAINER",
+    "INFINITO_PARENT_IMAGE",
+    "INFINITO_IMAGE",
+)
+SHOW = "printf '%s\\n' " + " ".join(f'"{key}=${{{key}:-}}"' for key in SHOWN)
+
+
+def clean_env(**overrides: str) -> dict[str, str]:
+    env = {
+        k: v
+        for k, v in os.environ.items()
+        if not k.startswith("INFINITO_")
+        and k not in ("BASH_ENV", "PYTHONPATH", "VENV", "PYTHON", "VIRTUAL_ENV")
+    }
+    env["PYTHONPATH"] = str(PROJECT_ROOT)
+    env.update(overrides)
+    return env
+
+
+def bash(script: str, cwd: Path) -> dict[str, str]:
+    proc = subprocess.run(
+        ["bash", "-c", f"{script}\n{SHOW}"],
+        env=clean_env(),
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return dict(line.split("=", 1) for line in proc.stdout.splitlines())
+
+
+class TestDistroDerivedKeys(unittest.TestCase):
+    scratch: ClassVar[Path]
+    expected: ClassVar[dict[str, dict[str, str]]]
+
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.scratch = Path(tempfile.mkdtemp())
+        cls.expected = {}
+        for distro in ("debian", "centos"):
+            path = cls.scratch / f"{distro}.env"
+            subprocess.run(
+                [sys.executable, "-m", "cli.meta.env", "--output", str(path)],
+                env=clean_env(INFINITO_DISTRO=distro),
+                cwd=PROJECT_ROOT,
+                capture_output=True,
+                check=True,
+            )
+            cls.expected[distro] = bash(f'set -a; source "{path}"', cls.scratch)
+
+    @classmethod
+    def tearDownClass(cls) -> None:
+        shutil.rmtree(cls.scratch)
+
+    def run_loader(self, steps: str) -> dict[str, str]:
+        """Source a copy of the loader in a checkout whose ``.env`` is debian's.
+
+        Args:
+            steps: bash run before the keys are shown; ``load`` sources the
+                loader.
+
+        Returns:
+            The keys as the steps leave them.
+        """
+        checkout = Path(tempfile.mkdtemp())
+        self.addCleanup(shutil.rmtree, checkout)
+        (checkout / "scripts" / "meta" / "env").mkdir(parents=True)
+        for name in ("load.sh", "python.sh"):
+            shutil.copy(LOADER_DIR / name, checkout / "scripts" / "meta" / "env")
+        dotenv = checkout / ".env"
+        shutil.copy(self.scratch / "debian.env", dotenv)
+        shown = bash(
+            f"load() {{ source scripts/meta/env/load.sh; }}\n{steps}", checkout
+        )
+        self.assertTrue(
+            filecmp.cmp(dotenv, self.scratch / "debian.env", shallow=False),
+            ".env was rewritten",
+        )
+        return shown
+
+    def test_the_two_distros_derive_different_keys(self):
+        self.assertNotEqual(
+            self.expected["debian"]["INFINITO_PARENT_IMAGE"],
+            self.expected["centos"]["INFINITO_PARENT_IMAGE"],
+        )
+
+    def test_a_distro_exported_after_the_first_load_gets_its_own_keys(self):
+        shown = self.run_loader("load\nexport INFINITO_DISTRO=centos\nload")
+        self.assertEqual(shown, self.expected["centos"])
+
+    def test_a_distro_exported_before_the_first_load_gets_its_own_keys(self):
+        shown = self.run_loader("export INFINITO_DISTRO=centos\nload")
+        self.assertEqual(shown, self.expected["centos"])
+
+    def test_switching_back_restores_the_keys_of_the_dotenv(self):
+        shown = self.run_loader(
+            "load\nexport INFINITO_DISTRO=centos\nload\n"
+            "export INFINITO_DISTRO=debian\nload"
+        )
+        self.assertEqual(shown, self.expected["debian"])
+
+    def test_a_caller_value_for_the_loaded_distro_still_wins(self):
+        shown = self.run_loader(
+            "load\nexport INFINITO_PARENT_IMAGE=caller/image:pinned\n"
+            "touch -d '+1 minute' .env\nload"
+        )
+        self.assertEqual(shown["INFINITO_PARENT_IMAGE"], "caller/image:pinned")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/scripts/meta/resolve/missing/test_highest_release_tag.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import os
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from utils.cache.files import PROJECT_ROOT
+
+SCRIPT = (
+    PROJECT_ROOT / "scripts" / "meta" / "resolve" / "missing" / "highest_release_tag.sh"
+)
+TAGS = ("v9.0.0", "v9.0.1", "v9.0.2", "v14.1.0", "v15.0.0")
+STUBS = {
+    "git": '#!/usr/bin/env bash\nprintf "%s\\n" ${STUB_TAGS}\n',
+    "docker": (
+        "#!/usr/bin/env bash\n"
+        'case " ${STUB_MISSING} " in *" ${3##*:} "*) exit 1 ;; esac\n'
+    ),
+}
+
+
+def pick(*missing: str) -> subprocess.CompletedProcess:
+    """Run the picker against stubbed ``git`` tags and ``docker`` manifests.
+
+    Args:
+        missing: tags whose images the registry does not hold.
+    """
+    with tempfile.TemporaryDirectory() as tmp:
+        for name, body in STUBS.items():
+            stub = Path(tmp) / name
+            stub.write_text(body)
+            stub.chmod(0o755)
+        env = {
+            **{k: v for k, v in os.environ.items() if k != "BASH_ENV"},
+            "PATH": f"{tmp}{os.pathsep}{os.environ['PATH']}",
+            "STUB_TAGS": " ".join(TAGS),
+            "STUB_MISSING": " ".join(missing),
+            "OWNER": "acme",
+            "REGISTRY": "ghcr.io",
+            "REPO_PREFIX": "core",
+            "INFINITO_DISTROS": "debian arch",
+        }
+        return subprocess.run(
+            ["bash", str(SCRIPT)],
+            env=env,
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+
+
+class TestHighestReleaseTag(unittest.TestCase):
+    def test_tags_below_the_oldest_buildable_one_are_not_picked(self) -> None:
+        self.assertEqual("", pick("v9.0.1", "v9.0.0").stdout)
+
+    def test_the_oldest_buildable_tag_is_picked(self) -> None:
+        self.assertEqual("v9.0.2\n", pick("v9.0.2", "v9.0.1").stdout)
+
+    def test_the_highest_missing_tag_is_picked(self) -> None:
+        self.assertEqual("v14.1.0\n", pick("v14.1.0", "v9.0.1").stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/scripts/tests/deploy/act/test_down_act_outer.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import os
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from utils.cache.files import PROJECT_ROOT
+
+SCRIPT = PROJECT_ROOT / "scripts" / "tests" / "deploy" / "act" / "down_act_outer.sh"
+DOCKER_STUB = (
+    "#!/usr/bin/env bash\n"
+    'printf "%s\\n" "$*" >>"${STUB_LOG}"\n'
+    'if [ "$1" = ps ]; then\n'
+    '  case "$*" in *"label=infinito.worktree=own"*) echo own-id ;; esac\n'
+    "fi\n"
+)
+
+
+def teardown(container: str | None) -> tuple[subprocess.CompletedProcess, list[str]]:
+    """Run the teardown against a ``docker`` stub that only knows ``own-id``.
+
+    Args:
+        container: value of ``INFINITO_CONTAINER``, or None to leave it unset.
+
+    Returns:
+        The finished process and the docker invocations it made.
+    """
+    with tempfile.TemporaryDirectory() as tmp:
+        stub = Path(tmp) / "docker"
+        stub.write_text(DOCKER_STUB)
+        stub.chmod(0o755)
+        log = Path(tmp) / "docker.log"
+        log.touch()
+        env = {
+            k: v
+            for k, v in os.environ.items()
+            if k not in ("BASH_ENV", "INFINITO_CONTAINER")
+        }
+        env.update(PATH=f"{tmp}{os.pathsep}{os.environ['PATH']}", STUB_LOG=str(log))
+        if container is not None:
+            env["INFINITO_CONTAINER"] = container
+        done = subprocess.run(
+            ["bash", str(SCRIPT)],
+            env=env,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        return done, log.read_text().splitlines()  # nocheck: cache-read  stub call log
+
+
+class TestDownActOuter(unittest.TestCase):
+    def test_only_the_own_worktrees_act_containers_are_listed(self) -> None:
+        _, calls = teardown("own")
+        self.assertIn("label=infinito.worktree=own", calls[0])
+
+    def test_the_own_act_container_is_removed(self) -> None:
+        _, calls = teardown("own")
+        self.assertEqual(calls[1], "rm -f own-id")
+
+    def test_a_foreign_worktrees_act_container_is_left_alone(self) -> None:
+        _, calls = teardown("foreign")
+        self.assertEqual(len(calls), 1)
+
+    def test_an_unset_container_name_removes_nothing(self) -> None:
+        done, calls = teardown(None)
+        self.assertNotEqual(done.returncode, 0)
+        self.assertEqual(calls, [])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/scripts/tests/deploy/test_distros.py

@@ -20,6 +20,7 @@ import unittest
 from pathlib import Path
 
 from utils.cache.files import PROJECT_ROOT, read_text
+from utils.distros import pkgmgr_image
 from utils.env.parser import parse_static_env
 
 LOOP = PROJECT_ROOT / "scripts" / "tests" / "deploy" / "distros.sh"
@@ -76,6 +77,19 @@ class TestDistrosLoop(unittest.TestCase):
         self.assertEqual(proc.returncode, 0, proc.stderr)
         self.assertEqual(sorted(record.split()), sorted(DISTROS.split()))
 
+    def test_every_distro_runs_with_a_parent_image_of_its_own(self) -> None:
+        proc, record = self._run(
+            DISTROS,
+            'echo "${INFINITO_DISTRO} ${INFINITO_PARENT_IMAGE}'
+            ' ${INFINITO_PARENT_IMAGE_OWNER} ${INFINITO_PARENT_IMAGE_TAG}" >> "${RECORD}"',
+            INFINITO_CI_DISTRO_BUDGET_SECONDS="600",
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        rows = [line.split() for line in record.splitlines()]
+        self.assertEqual(sorted(row[0] for row in rows), sorted(DISTROS.split()))
+        for distro, image, owner, tag in rows:
+            self.assertEqual(image, pkgmgr_image(distro, owner=owner, tag=tag))
+
     def test_the_command_inherits_the_env_layer(self) -> None:
         proc, record = self._run(
             "debian",