chore: initialize from frontend template 4dc033c

tests/unit/build-environment.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  assertCiBuildEnvironment,
+  buildDate,
+  ciCheckoutIdentityFailures,
+  ciBuildEnvironmentFailures,
+  isValidSourceDateEpoch,
+} from "../../scripts/lib/build-environment.ts";
+
+const validCiEnvironment = {
+  CI: "true",
+  VITE_BUILD_ID: "gitea-42-1",
+  VITE_COMMIT_SHA: "a".repeat(40),
+  RELEASE_ID: "refs/heads/develop-42-1",
+  CI_RUNNER_IMAGE: `registry.test/frontend-runner@sha256:${"b".repeat(64)}`,
+  SOURCE_DATE_EPOCH: "946684800",
+};
+
+describe("CI build environment", () => {
+  it("requires complete release identity only in CI", () => {
+    expect(ciBuildEnvironmentFailures({ CI: "false" })).toEqual([]);
+    expect(ciBuildEnvironmentFailures({ CI: "true" })).toEqual(
+      expect.arrayContaining([
+        "missing required CI build environment: VITE_BUILD_ID",
+        "missing required CI build environment: VITE_COMMIT_SHA",
+        "missing required CI build environment: RELEASE_ID",
+        "missing required CI build environment: CI_RUNNER_IMAGE",
+        "missing required CI build environment: SOURCE_DATE_EPOCH",
+      ]),
+    );
+    expect(() => assertCiBuildEnvironment(validCiEnvironment)).not.toThrow();
+  });
+
+  it("rejects abbreviated commit IDs and invalid epochs", () => {
+    expect(
+      ciBuildEnvironmentFailures({
+        ...validCiEnvironment,
+        VITE_COMMIT_SHA: "abc123",
+        SOURCE_DATE_EPOCH: "-1",
+        CI_RUNNER_IMAGE: "ubuntu-latest-node24",
+      }),
+    ).toEqual(
+      expect.arrayContaining([
+        "VITE_COMMIT_SHA must be a full 40- or 64-character hexadecimal commit ID",
+        "SOURCE_DATE_EPOCH must be non-negative epoch seconds",
+        "CI_RUNNER_IMAGE must end with an immutable @sha256 image digest",
+      ]),
+    );
+  });
+
+  it("binds the configured identity and timestamp to the checkout", () => {
+    expect(
+      ciCheckoutIdentityFailures(validCiEnvironment, {
+        commitSha: "b".repeat(40),
+        sourceDateEpoch: "946684801",
+      }),
+    ).toEqual([
+      "VITE_COMMIT_SHA does not identify the checked-out commit",
+      "SOURCE_DATE_EPOCH does not match the checked-out commit timestamp",
+    ]);
+  });
+
+  it("uses SOURCE_DATE_EPOCH as the deterministic build timestamp", () => {
+    expect(isValidSourceDateEpoch("946684800")).toBe(true);
+    expect(isValidSourceDateEpoch("not-an-epoch")).toBe(false);
+    expect(buildDate(validCiEnvironment).toISOString()).toBe(
+      "2000-01-01T00:00:00.000Z",
+    );
+  });
+});