fix: FRAMEWORK vllm_bi150_r2r4 + image-verify CI (I8–I12)

tests/test_contract.py

@@ -1,9 +1,12 @@
 import os
+import re
 import subprocess
 import unittest
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
+FRAMEWORK = "vllm_bi150_r2r4"
+RETIRED_FRAMEWORK = "vllm_0_17_0_corex_4_4_0"
 
 
 class EngineContractTest(unittest.TestCase):
@@ -11,11 +14,11 @@ class EngineContractTest(unittest.TestCase):
         example = (ROOT / "task_info.env.example").read_text(encoding="utf-8")
         workflow_env = (ROOT / ".gitea/workflows/task_info.env").read_text(encoding="utf-8")
         dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
-        self.assertIn("FRAMEWORK=vllm_0_17_0_corex_4_4_0", example)
+        self.assertIn(f"FRAMEWORK={FRAMEWORK}", example)
         self.assertIn("GPU_TYPE=Iluvatar_bi-150", example)
-        self.assertIn("FRAMEWORK=vllm_0_17_0_corex_4_4_0", workflow_env)
+        self.assertIn(f"FRAMEWORK={FRAMEWORK}", workflow_env)
         self.assertIn("GPU_TYPE=Iluvatar_bi-150", workflow_env)
-        self.assertIn("FRAMEWORK=vllm_0_17_0_corex_4_4_0", dockerfile)
+        self.assertIn(f"FRAMEWORK={FRAMEWORK}", dockerfile)
         self.assertIn("GPU_TYPE=Iluvatar_bi-150", dockerfile)
         self.assertIn(
             "registry.iluvatar.com.cn:10443/customer/sz/vllm0.17.0-4.4.0-x86:v4.1",
@@ -24,13 +27,83 @@ class EngineContractTest(unittest.TestCase):
         self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", example)
         self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", workflow_env)
         self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", dockerfile)
+        self.assertNotIn(RETIRED_FRAMEWORK, example)
+        self.assertNotIn(RETIRED_FRAMEWORK, workflow_env)
+        self.assertNotIn(RETIRED_FRAMEWORK, dockerfile)
 
-    def test_ci_does_not_submit_platform_task(self) -> None:
+    def test_ci_registers_image_verify(self) -> None:
         workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
-        self.assertNotIn("adminApi", workflow)
-        self.assertNotIn("modelhub.org.cn", workflow)
+        self.assertIn("Validate Image Verify Metadata", workflow)
+        self.assertIn("https://modelhub.org.cn/adminApi/image-verify/validate", workflow)
+        self.assertIn("Notify Image Verify", workflow)
+        self.assertIn("https://modelhub.org.cn//adminApi/image-verify", workflow)
+        self.assertIn("Xc-Token: ${FIXED_TOKEN}", workflow)
+        self.assertIn("FIXED_TOKEN is not configured on runner", workflow)
+        for field in ("framework", "gpuType", "imageUrl", "taskType", "createBy", "repoUrl", "tag"):
+            self.assertIn(f'\\"{field}\\"', workflow)
         self.assertIn("build-only", workflow)
-        self.assertIn('tags:', workflow)
+        self.assertIn("tags:", workflow)
+        self.assertIn(f"本仓使用 {FRAMEWORK}", workflow)
+        self.assertNotIn(RETIRED_FRAMEWORK, workflow)
+
+    def test_ci_notifies_only_after_push(self) -> None:
+        workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
+        self.assertIn('PUSHED=1', workflow)
+        self.assertIn('if [ "${PUSHED:-0}" != "1" ]; then', workflow)
+        notify_at = workflow.index("Notify Image Verify")
+        push_at = workflow.index("Push when registry credentials exist")
+        validate_at = workflow.index("Validate Image Verify Metadata")
+        build_at = workflow.index("Build image")
+        self.assertLess(validate_at, build_at)
+        self.assertLess(build_at, push_at)
+        self.assertLess(push_at, notify_at)
+
+    def test_ci_does_not_submit_adaptation_task(self) -> None:
+        workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
+        allowed = {
+            "https://modelhub.org.cn/adminApi/image-verify/validate",
+            "https://modelhub.org.cn//adminApi/image-verify",
+        }
+        for url in re.findall(r"https?://[^\s'\"]+", workflow):
+            if "modelhub.org.cn" not in url:
+                continue
+            self.assertIn(url, allowed, f"CI 只允许调用 image-verify，发现 {url}")
+
+    def test_no_secret_literals_in_repo(self) -> None:
+        tracked = subprocess.run(
+            ["git", "ls-files"],
+            cwd=ROOT,
+            text=True,
+            capture_output=True,
+            check=True,
+        ).stdout.split()
+        pattern = re.compile(r"(FIXED_TOKEN|DOCKER_PASSWORD)\s*=\s*\S")
+        for name in tracked:
+            path = ROOT / name
+            if not path.is_file():
+                continue
+            try:
+                text = path.read_text(encoding="utf-8")
+            except UnicodeDecodeError:
+                continue
+            for line in text.splitlines():
+                self.assertIsNone(pattern.search(line), f"{name} 可能写入了明文密钥: {line}")
+
+    def test_ci_does_not_log_secrets(self) -> None:
+        workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8")
+        for line in workflow.splitlines():
+            stripped = line.strip()
+            if "FIXED_TOKEN" in stripped:
+                self.assertFalse(
+                    stripped.startswith("echo") and "${FIXED_TOKEN" in stripped,
+                    f"不要把 FIXED_TOKEN 打进日志: {stripped}",
+                )
+            if stripped.startswith("echo") and "$DOCKER_PASSWORD" in stripped:
+                self.assertIn(
+                    "docker login",
+                    stripped,
+                    f"DOCKER_PASSWORD 只能管道给 docker login: {stripped}",
+                )
 
     def test_no_zip_or_contest_targets(self) -> None:
         makefile = (ROOT / "Makefile").read_text(encoding="utf-8")
@@ -53,11 +126,12 @@ class EngineContractTest(unittest.TestCase):
             check=False,
         )
         self.assertEqual(completed.returncode, 0, completed.stderr)
-        self.assertIn("FRAMEWORK=vllm_0_17_0_corex_4_4_0", completed.stdout)
+        self.assertIn(f"FRAMEWORK={FRAMEWORK}", completed.stdout)
         self.assertIn("GPU_TYPE=Iluvatar_bi-150", completed.stdout)
         self.assertIn("python3 -m vllm.entrypoints.openai.api_server", completed.stdout)
         self.assertIn("dry-run: 不启动进程，不访问平台", completed.stdout)
         self.assertNotIn("modelhub.org.cn", completed.stdout)
+        self.assertNotIn(RETIRED_FRAMEWORK, completed.stdout)
         self.assertIn("<|user|>", completed.stdout)
 
     def test_dry_run_rejects_forbidden_framework(self) -> None:
@@ -73,6 +147,7 @@ class EngineContractTest(unittest.TestCase):
         )
         self.assertNotEqual(completed.returncode, 0)
         self.assertIn("vllm_fix_tokenizer", completed.stderr)
+        self.assertIn(FRAMEWORK, completed.stderr)
 
     def test_tokenizer_patch_stays_off(self) -> None:
         import shutil
@@ -80,6 +155,7 @@ class EngineContractTest(unittest.TestCase):
 
         import apply_patches
 
+        self.assertEqual(apply_patches.DEFAULT_FRAMEWORK, FRAMEWORK)
         with tempfile.TemporaryDirectory() as tmp:
             model = Path(tmp) / "model"
             shutil.copytree(ROOT / "tests" / "fixtures" / "fake-model", model)