| 1 | package axe |
| 2 | |
| 3 | import ( |
| 4 | "crypto/sha256" |
| 5 | "encoding/hex" |
| 6 | "io/fs" |
| 7 | "os" |
| 8 | "os/exec" |
| 9 | "path/filepath" |
| 10 | "regexp" |
| 11 | "strings" |
| 12 | "testing" |
| 13 | |
| 14 | "amadan.net/rastrillo/fiesta" |
| 15 | ) |
| 16 | |
| 17 | // axe-core is vendored here for the accessibility gate. It is test |
| 18 | // data, and this test is what "test data" means here: it is what the |
| 19 | // README says it is. |
| 20 | // |
| 21 | // It runs without a build tag, on every `go test ./...`, because the |
| 22 | // day somebody replaces the file is a day this has to fail loudly and |
| 23 | // not only when a browser is available. |
| 24 | |
| 25 | const axeDir = "." |
| 26 | |
| 27 | // axeReadme parses the pin out of the README beside the file: the |
| 28 | // version line and the sha256 line, in the indented block near the top. |
| 29 | // The README is the documentation and the manifest at once, so there is |
| 30 | // no second place for the two to disagree. |
| 31 | var ( |
| 32 | axeVersionLine = regexp.MustCompile(`(?m)^\s+version\s+(\S+)\s*$`) |
| 33 | axeSHALine = regexp.MustCompile(`(?m)^\s+sha256\s+([0-9a-f]{64})\s*$`) |
| 34 | ) |
| 35 | |
| 36 | func TestVendoredAxeIsThePinnedVersion(t *testing.T) { |
| 37 | readme, err := os.ReadFile(filepath.Join(axeDir, "README.md")) |
| 38 | if err != nil { |
| 39 | t.Fatalf("the vendored axe has no README: %v", err) |
| 40 | } |
| 41 | vm := axeVersionLine.FindSubmatch(readme) |
| 42 | sm := axeSHALine.FindSubmatch(readme) |
| 43 | if vm == nil || sm == nil { |
| 44 | t.Fatalf("%s/README.md does not name a version and a sha256 in its pin block", axeDir) |
| 45 | } |
| 46 | body, err := os.ReadFile(filepath.Join(axeDir, "axe.min.js")) |
| 47 | if err != nil { |
| 48 | t.Fatalf("reading the vendored axe: %v", err) |
| 49 | } |
| 50 | sum := sha256.Sum256(body) |
| 51 | if got := hex.EncodeToString(sum[:]); got != string(sm[1]) { |
| 52 | t.Errorf("axe.min.js is sha256 %s; the README pins %s", got, sm[1]) |
| 53 | } |
| 54 | // Deque stamps the version into the banner comment, so the file |
| 55 | // says its own version and the README cannot drift from it quietly. |
| 56 | want := "axe v" + string(vm[1]) |
| 57 | if head := string(body[:min(len(body), 200)]); !strings.Contains(head, want) { |
| 58 | t.Errorf("the README pins %s, but the file's banner does not say %q", vm[1], want) |
| 59 | } |
| 60 | } |
| 61 | |
| 62 | // TestTheShippedTreeCarriesNoAxe is the other half of "test data": the |
| 63 | // engine reaches nothing a Go program imports from Fiesta. The root |
| 64 | // package embeds its tree by directory, so the check is of what those |
| 65 | // directories hold, by the banner every build of axe-core carries and |
| 66 | // no hand-written asset does; and the packages a program imports, the |
| 67 | // root and example, pull this package into no build. The release has |
| 68 | // the same check over its own files, TestVendoredAxeIsNotAShippedAsset |
| 69 | // in internal/build. |
| 70 | func TestTheShippedTreeCarriesNoAxe(t *testing.T) { |
| 71 | const marker = "Deque Systems" |
| 72 | if !strings.Contains(script, marker) { |
| 73 | t.Fatalf("the vendored engine does not carry %q; the check below would be looking for nothing", marker) |
| 74 | } |
| 75 | files := 0 |
| 76 | err := fs.WalkDir(fiesta.FS(), ".", func(p string, d fs.DirEntry, err error) error { |
| 77 | if err != nil { |
| 78 | return err |
| 79 | } |
| 80 | if d.IsDir() { |
| 81 | return nil |
| 82 | } |
| 83 | files++ |
| 84 | b, err := fs.ReadFile(fiesta.FS(), p) |
| 85 | if err != nil { |
| 86 | return err |
| 87 | } |
| 88 | if strings.Contains(string(b), marker) { |
| 89 | t.Errorf("%s carries the vendored axe-core: it is test data and must not ship", p) |
| 90 | } |
| 91 | return nil |
| 92 | }) |
| 93 | if err != nil { |
| 94 | t.Fatal(err) |
| 95 | } |
| 96 | if files == 0 { |
| 97 | t.Fatal("the embedded tree holds no files; the walk above checked nothing") |
| 98 | } |
| 99 | |
| 100 | out, err := exec.Command("go", "list", "-deps", "amadan.net/rastrillo/fiesta", "amadan.net/rastrillo/fiesta/example").CombinedOutput() |
| 101 | if err != nil { |
| 102 | t.Fatalf("go list -deps: %v\n%s", err, out) |
| 103 | } |
| 104 | deps := strings.Split(strings.TrimSpace(string(out)), "\n") |
| 105 | listed := false |
| 106 | for _, dep := range deps { |
| 107 | listed = listed || dep == "amadan.net/rastrillo/fiesta" |
| 108 | if strings.HasSuffix(dep, "/internal/axe") { |
| 109 | t.Errorf("the public packages import %s; the engine is for the drives alone", dep) |
| 110 | } |
| 111 | } |
| 112 | if !listed { |
| 113 | t.Fatalf("go list -deps did not list the root package itself:\n%s", out) |
| 114 | } |
| 115 | } |
| 116 | |
amadan