Gate releases on public Manager clone

tests/test_release_gate.py

@@ -0,0 +1,55 @@
+import importlib.util
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).parents[1] / "tools" / "verify_manager_install.py"
+SPEC = importlib.util.spec_from_file_location("verify_manager_install", SCRIPT)
+release_gate = importlib.util.module_from_spec(SPEC)
+assert SPEC.loader is not None
+SPEC.loader.exec_module(release_gate)
+
+
+def test_manager_clone_command_matches_manager_install_shape(tmp_path):
+    destination = tmp_path / "custom_nodes" / "etk-ltxv-timeline-editor"
+    assert release_gate.manager_clone_command("https://example.test/owner/repo", destination) == [
+        "git",
+        "clone",
+        "-v",
+        "--recursive",
+        "--progress",
+        "--",
+        "https://example.test/owner/repo",
+        str(destination),
+    ]
+
+
+def test_anonymous_environment_removes_ambient_git_credentials(tmp_path):
+    env = release_gate.anonymous_git_environment(
+        {
+            "PATH": "/usr/bin",
+            "GIT_ASKPASS": "credential-helper",
+            "GIT_CONFIG_GLOBAL": "/secret/config",
+            "GIT_SSH_COMMAND": "ssh -i /secret/key",
+        },
+        tmp_path,
+    )
+    assert env["GIT_ASKPASS"] == "/bin/false"
+    assert env["GIT_CONFIG_GLOBAL"] == "/dev/null"
+    assert env["GIT_TERMINAL_PROMPT"] == "0"
+    assert env["HOME"] == str(tmp_path)
+    assert "GIT_SSH_COMMAND" not in env
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "",
+        "ssh://git@example.test/owner/repo",
+        "https://user:password@example.test/owner/repo",
+        "https://example.test/owner/repo?token=secret",
+    ],
+)
+def test_public_repository_url_rejects_nonanonymous_forms(url):
+    with pytest.raises(release_gate.VerificationError):
+        release_gate.validate_public_repository_url(url)