peter
cc9fc3b544
0.93.2 shipped a week's worth of confusion about which Node this repo
runs on; the Python side had the identical shape and nobody had looked.
Prod (Dockerfile), the test image (Dockerfile.test) and CI (check.yml)
each spelled 3.12 as an independent literal, there was no
`.python-version`, no `requires-python`, and ruff had no target-version
so it judged our syntax against some other interpreter. The dev machine
had no 3.12 installed at all — only 3.13 and 3.14 — so every ad-hoc host
script ran two majors ahead of production.
`.python-version` is now the single source of truth, and the contract is
held by tests rather than by prose. It is split in two because no single
runner can see every link: the pytest suite runs inside the test image,
which mounts backend/ alone and cannot read the repo-root Dockerfile or
the workflow.
test_python_engine_contract.py : running interpreter == pyrightconfig
== ruff.toml
pythonEngine.contract.test.ts : .python-version == pyrightconfig ==
ruff.toml == Dockerfile ==
Dockerfile.test == check.yml
Together they close the loop, and the backend half carries the assertion
that pays — that the interpreter running the suite is the pinned one. A
green suite on another minor does not mean the shipped image is green;
it means they have drifted and nobody has noticed yet.
87 lines
3.7 KiB
TypeScript
87 lines
3.7 KiB
TypeScript
import { readFileSync } from "node:fs";
|
|
import { expect, it } from "vitest";
|
|
|
|
// The Python major is a contract, not a coincidence — the host half. The twin of
|
|
// `nodeEngine.contract.test.ts`, and written the day after that one was: `0.93.2` shipped because
|
|
// four machines disagreed about Node, and the Python side turned out to have the identical shape
|
|
// with nobody watching. Prod (`Dockerfile`), the test image (`backend/Dockerfile.test`) and CI
|
|
// (`check.yml`) each spelled 3.12 as its own literal, there was no `.python-version`, and the dev
|
|
// machine had only 3.13 and 3.14 installed — so every ad-hoc host script ran two majors ahead of
|
|
// production.
|
|
//
|
|
// It lives in the FRONTEND suite for one boring reason: this is the only runner that can see the
|
|
// whole repository. The backend suite runs inside the test image, which mounts `backend/` alone, so
|
|
// it cannot read the repo-root Dockerfile or the workflow. It holds the other half of the chain —
|
|
// including "the interpreter running these tests IS the pinned one", which only it can assert:
|
|
//
|
|
// backend/tests/test_python_engine_contract.py : running interpreter == pyrightconfig == ruff.toml
|
|
// here : .python-version == pyrightconfig == ruff.toml
|
|
// == Dockerfile == Dockerfile.test == check.yml
|
|
//
|
|
// To move the version: edit `.python-version`, then follow the failures in both files.
|
|
const readRoot = (rel: string) => readFileSync(new URL(`../../../${rel}`, import.meta.url), "utf8");
|
|
|
|
function versionIn(source: string, pattern: RegExp, where: string): string {
|
|
const m = pattern.exec(source);
|
|
// A rename or a moved line lands here. Re-point the test — the contract did not go away with it.
|
|
expect(m, `${pattern} not found in ${where}`).not.toBeNull();
|
|
return `${m![1]}.${m![2]}`;
|
|
}
|
|
|
|
const pinned = versionIn(readRoot(".python-version"), /^(\d+)\.(\d+)\s*$/m, ".python-version");
|
|
|
|
it("pins a plausible Python version", () => {
|
|
// Guards against a typo'd `.python-version` silently agreeing with nothing.
|
|
expect(Number(pinned.split(".")[1])).toBeGreaterThanOrEqual(12);
|
|
expect(pinned.split(".")[0]).toBe("3");
|
|
});
|
|
|
|
it("runs the shipped backend on the pinned version", () => {
|
|
// The image our users' instance actually runs.
|
|
expect(versionIn(readRoot("Dockerfile"), /^FROM python:(\d+)\.(\d+)-slim/m, "Dockerfile")).toBe(
|
|
pinned,
|
|
);
|
|
});
|
|
|
|
it("tests on the pinned version", () => {
|
|
// The image the whole pytest suite runs in — including the backend half of this contract, which
|
|
// asserts its own `sys.version_info` against the pin.
|
|
expect(
|
|
versionIn(
|
|
readRoot("backend/Dockerfile.test"),
|
|
/^FROM python:(\d+)\.(\d+)-slim/m,
|
|
"Dockerfile.test",
|
|
),
|
|
).toBe(pinned);
|
|
});
|
|
|
|
it("runs the server gate on the pinned version", () => {
|
|
// The backend job's container. Its NODE is deliberately outside the Node contract (it only runs
|
|
// the checkout action), but its PYTHON runs our code and our tests, so it is inside this one.
|
|
expect(
|
|
versionIn(
|
|
readRoot(".gitea/workflows/check.yml"),
|
|
/^\s*container: nikolaik\/python-nodejs:python(\d+)\.(\d+)-nodejs\d+$/m,
|
|
"check.yml",
|
|
),
|
|
).toBe(pinned);
|
|
});
|
|
|
|
it("type-checks against the pinned version", () => {
|
|
// A type checker aimed at another version green-lights APIs the shipped interpreter does not have
|
|
// — the same defect as the image split, moved to check time.
|
|
expect(
|
|
versionIn(
|
|
readRoot("backend/pyrightconfig.json"),
|
|
/"pythonVersion"\s*:\s*"(\d+)\.(\d+)"/,
|
|
"pyrightconfig.json",
|
|
),
|
|
).toBe(pinned);
|
|
});
|
|
|
|
it("lints against the pinned version", () => {
|
|
expect(
|
|
versionIn(readRoot("backend/ruff.toml"), /^target-version = "py(\d)(\d+)"$/m, "ruff.toml"),
|
|
).toBe(pinned);
|
|
});
|