modelhub-engine-bi150-compat/tests/test_contract.py

import os
import re
import subprocess
import unittest
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
FRAMEWORK = "vllm_bi150_r2r4"
RETIRED_FRAMEWORK = "vllm_0_17_0_corex_4_4_0"


class EngineContractTest(unittest.TestCase):
    def test_locked_values_match(self) -> None:
        example = (ROOT / "task_info.env.example").read_text(encoding="utf-8")
        workflow_env = (ROOT / ".gitea/workflows/task_info.env").read_text(encoding="utf-8")
        dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
        self.assertIn(f"FRAMEWORK={FRAMEWORK}", example)
        self.assertIn("GPU_TYPE=Iluvatar_bi-150", example)
        self.assertIn(f"FRAMEWORK={FRAMEWORK}", workflow_env)
        self.assertIn("GPU_TYPE=Iluvatar_bi-150", workflow_env)
        self.assertIn(f"FRAMEWORK={FRAMEWORK}", dockerfile)
        self.assertIn("GPU_TYPE=Iluvatar_bi-150", dockerfile)
        self.assertIn(
            "registry.iluvatar.com.cn:10443/customer/sz/vllm0.17.0-4.4.0-x86:v4.1",
            dockerfile,
        )
        self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", example)
        self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", workflow_env)
        self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", dockerfile)
        self.assertNotIn(RETIRED_FRAMEWORK, example)
        self.assertNotIn(RETIRED_FRAMEWORK, workflow_env)
        self.assertNotIn(RETIRED_FRAMEWORK, dockerfile)

    def test_ci_registers_image_verify(self) -> None:
        workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
        self.assertIn("Validate Image Verify Metadata", workflow)
        self.assertIn("https://modelhub.org.cn/adminApi/image-verify/validate", workflow)
        self.assertIn("Notify Image Verify", workflow)
        self.assertIn("https://modelhub.org.cn//adminApi/image-verify", workflow)
        self.assertIn("Xc-Token: ${FIXED_TOKEN}", workflow)
        self.assertIn("FIXED_TOKEN is not configured on runner", workflow)
        for field in ("framework", "gpuType", "imageUrl", "taskType", "createBy", "repoUrl", "tag"):
            self.assertIn(f'\\"{field}\\"', workflow)
        self.assertIn("build-only", workflow)
        self.assertIn("tags:", workflow)
        self.assertIn(f"本仓使用 {FRAMEWORK}", workflow)
        self.assertNotIn(RETIRED_FRAMEWORK, workflow)

    def test_ci_notifies_only_after_push(self) -> None:
        workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
        self.assertIn('PUSHED=1', workflow)
        self.assertIn('if [ "${PUSHED:-0}" != "1" ]; then', workflow)
        notify_at = workflow.index("Notify Image Verify")
        push_at = workflow.index("Push when registry credentials exist")
        validate_at = workflow.index("Validate Image Verify Metadata")
        build_at = workflow.index("Build image")
        self.assertLess(validate_at, build_at)
        self.assertLess(build_at, push_at)
        self.assertLess(push_at, notify_at)

    def test_ci_does_not_submit_adaptation_task(self) -> None:
        workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
        allowed = {
            "https://modelhub.org.cn/adminApi/image-verify/validate",
            "https://modelhub.org.cn//adminApi/image-verify",
        }
        for url in re.findall(r"https?://[^\s'\"]+", workflow):
            if "modelhub.org.cn" not in url:
                continue
            self.assertIn(url, allowed, f"CI 只允许调用 image-verify，发现 {url}")

    def test_no_secret_literals_in_repo(self) -> None:
        tracked = subprocess.run(
            ["git", "ls-files"],
            cwd=ROOT,
            text=True,
            capture_output=True,
            check=True,
        ).stdout.split()
        pattern = re.compile(r"(FIXED_TOKEN|DOCKER_PASSWORD)\s*=\s*\S")
        for name in tracked:
            path = ROOT / name
            if not path.is_file():
                continue
            try:
                text = path.read_text(encoding="utf-8")
            except UnicodeDecodeError:
                continue
            for line in text.splitlines():
                self.assertIsNone(pattern.search(line), f"{name} 可能写入了明文密钥: {line}")

    def test_ci_does_not_log_secrets(self) -> None:
        workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
        for line in workflow.splitlines():
            stripped = line.strip()
            if "FIXED_TOKEN" in stripped:
                self.assertFalse(
                    stripped.startswith("echo") and "${FIXED_TOKEN" in stripped,
                    f"不要把 FIXED_TOKEN 打进日志: {stripped}",
                )
            if stripped.startswith("echo") and "$DOCKER_PASSWORD" in stripped:
                self.assertIn(
                    "docker login",
                    stripped,
                    f"DOCKER_PASSWORD 只能管道给 docker login: {stripped}",
                )

    def test_no_zip_or_contest_targets(self) -> None:
        makefile = (ROOT / "Makefile").read_text(encoding="utf-8")
        self.assertNotIn("package", makefile)
        self.assertNotIn("submit", makefile)
        self.assertFalse((ROOT / "contest").exists())
        self.assertFalse((ROOT / "computility-run.yaml").exists())

    def test_dry_run_prints_plan(self) -> None:
        env = os.environ.copy()
        env.pop("FRAMEWORK", None)
        env.pop("GPU_TYPE", None)
        env.pop("MODEL_DIR", None)
        completed = subprocess.run(
            ["bash", "scripts/entrypoint.sh", "--dry-run"],
            cwd=ROOT,
            env=env,
            text=True,
            capture_output=True,
            check=False,
        )
        self.assertEqual(completed.returncode, 0, completed.stderr)
        self.assertIn(f"FRAMEWORK={FRAMEWORK}", completed.stdout)
        self.assertIn("GPU_TYPE=Iluvatar_bi-150", completed.stdout)
        self.assertIn("python3 -m vllm.entrypoints.openai.api_server", completed.stdout)
        self.assertIn("dry-run: 不启动进程，不访问平台", completed.stdout)
        self.assertNotIn("modelhub.org.cn", completed.stdout)
        self.assertNotIn(RETIRED_FRAMEWORK, completed.stdout)
        self.assertIn("<|user|>", completed.stdout)

    def test_dry_run_rejects_forbidden_framework(self) -> None:
        env = os.environ.copy()
        env["FRAMEWORK"] = "vllm_fix_tokenizer"
        completed = subprocess.run(
            ["bash", "scripts/entrypoint.sh", "--dry-run"],
            cwd=ROOT,
            env=env,
            text=True,
            capture_output=True,
            check=False,
        )
        self.assertNotEqual(completed.returncode, 0)
        self.assertIn("vllm_fix_tokenizer", completed.stderr)
        self.assertIn(FRAMEWORK, completed.stderr)

    def test_tokenizer_patch_stays_off(self) -> None:
        import shutil
        import tempfile

        import apply_patches

        self.assertEqual(apply_patches.DEFAULT_FRAMEWORK, FRAMEWORK)
        with tempfile.TemporaryDirectory() as tmp:
            model = Path(tmp) / "model"
            shutil.copytree(ROOT / "tests" / "fixtures" / "fake-model", model)
            result = apply_patches.apply_all(
                model,
                (ROOT / "patches/chat_template/default_chat_template.jinja").read_text(encoding="utf-8"),
                apply_patches.load_whitelist(ROOT / "patches/architectures/whitelist.txt"),
                {},
            )
        self.assertFalse(result["tokenizer"]["applied"])


if __name__ == "__main__":
    unittest.main()