refactor!: separate runtime releases from panel source

internal/api/releases_test.go

@@ -182,10 +182,26 @@ func TestPinnedReleaseWorkerAdmissionAndBlock(t *testing.T) {
 			parts := strings.Split(imagePlatform, "/")
 			writeJSON(w, map[string]any{"Id": "sha256:release", "Os": parts[0], "Architecture": parts[1], "Config": map[string]any{"Labels": labels}})
 		case "/v1.47/containers/create":
+			var cfg struct {
+				Image, User string
+				HostConfig  struct {
+					NetworkMode    string
+					ReadonlyRootfs bool
+					Tmpfs          map[string]string
+				}
+			}
+			if err := json.NewDecoder(r.Body).Decode(&cfg); err != nil || cfg.Image != "sha256:release" || cfg.User != "1000:1000" || cfg.HostConfig.NetworkMode != "none" || !cfg.HostConfig.ReadonlyRootfs || !strings.Contains(cfg.HostConfig.Tmpfs["/tmp"], "exec") {
+				t.Errorf("unsafe verification config %+v err=%v", cfg, err)
+			}
 			io.WriteString(w, `{"Id":"check"}`)
 		case "/v1.47/containers/check/start", "/v1.47/exec/probe/start", "/v1.47/containers/check":
 			w.WriteHeader(204)
 		case "/v1.47/containers/check/exec":
+			var cfg struct{ Cmd []string }
+			expected, _ := json.Marshal(info.Version)
+			if err := json.NewDecoder(r.Body).Decode(&cfg); err != nil || len(cfg.Cmd) != 3 || !strings.Contains(cfg.Cmd[2], "execFileSync('dsh',['--version']") || !strings.Contains(cfg.Cmd[2], "actual!=="+string(expected)) {
+				t.Errorf("missing exact version check %+v err=%v", cfg, err)
+			}
 			io.WriteString(w, `{"Id":"probe"}`)
 		case "/v1.47/exec/probe/json":
 			io.WriteString(w, `{"Running":false,"ExitCode":0}`)
@@ -199,9 +215,7 @@ func TestPinnedReleaseWorkerAdmissionAndBlock(t *testing.T) {
 	if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='u'"); err != nil {
 		t.Fatal(err)
 	}
-	npmBuildClient = &http.Client{Transport: imageRoundTrip(func(r *http.Request) (*http.Response, error) {
-		return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(`{"version":"0.2.0-rc.3"}`)), Header: make(http.Header)}, nil
-	})}
+
 	old := fetchRelease
 	t.Cleanup(func() { fetchRelease = old })
 	fetchRelease = func(ctx context.Context, repository, ref string) (releaseInfo, io.Reader, error) {
@@ -233,3 +247,56 @@ func TestPinnedReleaseWorkerAdmissionAndBlock(t *testing.T) {
 		t.Fatalf("%+v %v", im, err)
 	}
 }
+
+func TestReleaseRateLimitDedup(t *testing.T) {
+	a, _ := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) { t.Error("queued release contacted Docker") })
+	info := releaseFixture()
+	first, err := a.enqueueRelease("u", info)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, commit := range []string{strings.Repeat("b", 40), strings.Repeat("c", 40)} {
+		next := info
+		next.Commit = commit
+		if _, err := a.enqueueRelease("u", next); err != nil {
+			t.Fatal(err)
+		}
+	}
+	again, err := a.enqueueRelease("u", info)
+	if err != nil || again.ID != first.ID {
+		t.Fatal(again, err)
+	}
+	info.Commit = strings.Repeat("d", 40)
+	if _, err := a.enqueueRelease("u", info); err != errBuildRateLimited {
+		t.Fatal(err)
+	}
+	var count int
+	if err := a.s.DB.QueryRow("SELECT count(*) FROM image_build_requests").Scan(&count); err != nil || count != 3 {
+		t.Fatal(count, err)
+	}
+}
+
+func TestReleaseUnknownDiskBlocksBuild(t *testing.T) {
+	a, _ := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) { t.Errorf("unexpected Docker request %s", r.URL) })
+	t.Setenv("DSH_DOCKER_ROOT_VISIBLE", "")
+	if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='u'"); err != nil {
+		t.Fatal(err)
+	}
+	info := releaseFixture()
+	old := fetchRelease
+	t.Cleanup(func() { fetchRelease = old })
+	fetchRelease = func(context.Context, string, string) (releaseInfo, io.Reader, error) {
+		return info, strings.NewReader("context"), nil
+	}
+	b, err := a.enqueueRelease("u", info)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a.runImageBuild(b)
+	if err := scanBuildSummary(a.s.DB.QueryRow("SELECT "+buildSummaryColumns+" FROM image_builds WHERE id=?", b.ID), &b); err != nil {
+		t.Fatal(err)
+	}
+	if b.Status != "failed" || !strings.Contains(b.Error, "capacity unknown") {
+		t.Fatalf("%+v", b)
+	}
+}