clean_archive_test.go

package main

import (
	"bytes"
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

// TestCleanSourceArchiveBuilds proves that the staged/tracked release manifest
// is self-contained. The child marker prevents recursive archive tests.
func TestCleanSourceArchiveBuilds(t *testing.T) {
	if os.Getenv("ZIM_CLEAN_ARCHIVE_CHILD") == "1" {
		t.Skip("already running from clean source archive")
	}
	root, err := os.Getwd()
	if err != nil {
		t.Fatal(err)
	}
	if output, err := exec.Command("git", "rev-parse", "--is-inside-work-tree").CombinedOutput(); err != nil {
		t.Skipf("Git metadata unavailable: %v (%s)", err, strings.TrimSpace(string(output)))
	}
	manifestOutput, err := exec.Command("git", "ls-files", "--cached", "-z").Output()
	if err != nil {
		t.Fatalf("enumerate staged/tracked manifest: %v", err)
	}
	manifest := splitNUL(manifestOutput)
	if len(manifest) == 0 {
		t.Fatal("staged/tracked manifest is empty")
	}

	destination := t.TempDir()
	for _, relative := range manifest {
		if err := validateReleasePath(relative); err != nil {
			t.Fatal(err)
		}
	}
	export := exec.Command("git", "checkout-index", "--all", "--prefix="+destination+string(os.PathSeparator))
	export.Dir = root
	if output, err := export.CombinedOutput(); err != nil {
		t.Fatalf("export staged/tracked manifest: %v\n%s", err, output)
	}
	for _, relative := range manifest {
		target := filepath.Join(destination, filepath.FromSlash(relative))
		info, err := os.Lstat(target)
		if err != nil {
			t.Fatalf("inspect %s: %v", relative, err)
		}
		if !info.Mode().IsRegular() {
			t.Fatalf("release manifest contains non-regular file %s (%s)", relative, info.Mode())
		}
	}

	for _, args := range [][]string{{"build", "./..."}, {"test", "-count=1", "./..."}} {
		command := exec.Command("go", args...)
		command.Dir = destination
		command.Env = append(os.Environ(), "ZIM_CLEAN_ARCHIVE_CHILD=1")
		if output, err := command.CombinedOutput(); err != nil {
			t.Fatalf("clean source archive go %s failed: %v\n%s", strings.Join(args, " "), err, output)
		}
	}
}

func splitNUL(data []byte) []string {
	parts := bytes.Split(data, []byte{0})
	paths := make([]string, 0, len(parts))
	for _, part := range parts {
		if len(part) > 0 {
			paths = append(paths, string(part))
		}
	}
	return paths
}

func validateReleasePath(path string) error {
	rootAllowed := map[string]bool{
		".gitattributes": true, ".gitignore": true, "CHANGELOG.md": true, "LICENSE": true, "README.md": true,
		"go.mod": true, "go.sum": true,
	}
	if !strings.Contains(path, "/") {
		if rootAllowed[path] || strings.HasSuffix(path, ".go") {
			return nil
		}
		return fmt.Errorf("release manifest contains unexpected root path %s", path)
	}
	allowed := false
	for _, prefix := range []string{"cmd/", "docs/", "internal/", "web/"} {
		if strings.HasPrefix(path, prefix) {
			allowed = true
			break
		}
	}
	if !allowed {
		return fmt.Errorf("release manifest contains unexpected path %s", path)
	}
	lower := strings.ToLower(path)
	for _, forbidden := range []string{
		"/.claude/", "/.codex/", "/.agents/", "/.work/", "/node_modules/", "/.svelte-kit/",
		"cmd/ui/build/", "web/build/", "claude.md", ".env", ".log", ".transcript",
		".sqlite", ".db", ".zim", ".onnx", ".safetensors", ".test", ".prof", ".pprof",
	} {
		if strings.Contains("/"+lower, forbidden) {
			return fmt.Errorf("release manifest contains forbidden path %s", path)
		}
	}
	return nil
}