import os import re import subprocess import unittest from pathlib import Path ROOT = Path(__file__).resolve().parents[1] FRAMEWORK = "vllm_bi150_r2r4" RETIRED_FRAMEWORK = "vllm_0_17_0_corex_4_4_0" class EngineContractTest(unittest.TestCase): def test_locked_values_match(self) -> None: example = (ROOT / "task_info.env.example").read_text(encoding="utf-8") workflow_env = (ROOT / ".gitea/workflows/task_info.env").read_text(encoding="utf-8") dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8") self.assertIn(f"FRAMEWORK={FRAMEWORK}", example) self.assertIn("GPU_TYPE=Iluvatar_bi-150", example) self.assertIn(f"FRAMEWORK={FRAMEWORK}", workflow_env) self.assertIn("GPU_TYPE=Iluvatar_bi-150", workflow_env) self.assertIn(f"FRAMEWORK={FRAMEWORK}", dockerfile) self.assertIn("GPU_TYPE=Iluvatar_bi-150", dockerfile) self.assertIn( "registry.iluvatar.com.cn:10443/customer/sz/vllm0.17.0-4.4.0-x86:v4.1", dockerfile, ) self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", example) self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", workflow_env) self.assertNotIn("FRAMEWORK=vllm_fix_tokenizer", dockerfile) self.assertNotIn(RETIRED_FRAMEWORK, example) self.assertNotIn(RETIRED_FRAMEWORK, workflow_env) self.assertNotIn(RETIRED_FRAMEWORK, dockerfile) def test_ci_registers_image_verify(self) -> None: workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8") self.assertIn("Validate Image Verify Metadata", workflow) self.assertIn("https://modelhub.org.cn/adminApi/image-verify/validate", workflow) self.assertIn("Notify Image Verify", workflow) self.assertIn("https://modelhub.org.cn//adminApi/image-verify", workflow) self.assertIn("Xc-Token: ${FIXED_TOKEN}", workflow) self.assertIn("FIXED_TOKEN is not configured on runner", workflow) for field in ("framework", "gpuType", "imageUrl", "taskType", "createBy", "repoUrl", "tag"): self.assertIn(f'\\"{field}\\"', workflow) self.assertIn("build-only", workflow) self.assertIn("tags:", workflow) self.assertIn(f"本仓使用 {FRAMEWORK}", workflow) self.assertNotIn(RETIRED_FRAMEWORK, workflow) def test_ci_notifies_only_after_push(self) -> None: workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8") self.assertIn('PUSHED=1', workflow) self.assertIn('if [ "${PUSHED:-0}" != "1" ]; then', workflow) notify_at = workflow.index("Notify Image Verify") push_at = workflow.index("Push when registry credentials exist") validate_at = workflow.index("Validate Image Verify Metadata") build_at = workflow.index("Build image") self.assertLess(validate_at, build_at) self.assertLess(build_at, push_at) self.assertLess(push_at, notify_at) def test_ci_does_not_submit_adaptation_task(self) -> None: workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8") allowed = { "https://modelhub.org.cn/adminApi/image-verify/validate", "https://modelhub.org.cn//adminApi/image-verify", } for url in re.findall(r"https?://[^\s'\"]+", workflow): if "modelhub.org.cn" not in url: continue self.assertIn(url, allowed, f"CI 只允许调用 image-verify，发现 {url}") def test_no_secret_literals_in_repo(self) -> None: tracked = subprocess.run( ["git", "ls-files"], cwd=ROOT, text=True, capture_output=True, check=True, ).stdout.split() pattern = re.compile(r"(FIXED_TOKEN|DOCKER_PASSWORD)\s*=\s*\S") for name in tracked: path = ROOT / name if not path.is_file(): continue try: text = path.read_text(encoding="utf-8") except UnicodeDecodeError: continue for line in text.splitlines(): self.assertIsNone(pattern.search(line), f"{name} 可能写入了明文密钥: {line}") def test_ci_does_not_log_secrets(self) -> None: workflow = (ROOT / ".gitea/workflows/build.yml").read_text(encoding="utf-8") for line in workflow.splitlines(): stripped = line.strip() if "FIXED_TOKEN" in stripped: self.assertFalse( stripped.startswith("echo") and "${FIXED_TOKEN" in stripped, f"不要把 FIXED_TOKEN 打进日志: {stripped}", ) if stripped.startswith("echo") and "$DOCKER_PASSWORD" in stripped: self.assertIn( "docker login", stripped, f"DOCKER_PASSWORD 只能管道给 docker login: {stripped}", ) def test_no_zip_or_contest_targets(self) -> None: makefile = (ROOT / "Makefile").read_text(encoding="utf-8") self.assertNotIn("package", makefile) self.assertNotIn("submit", makefile) self.assertFalse((ROOT / "contest").exists()) self.assertFalse((ROOT / "computility-run.yaml").exists()) def test_dry_run_prints_plan(self) -> None: env = os.environ.copy() env.pop("FRAMEWORK", None) env.pop("GPU_TYPE", None) env.pop("MODEL_DIR", None) completed = subprocess.run( ["bash", "scripts/entrypoint.sh", "--dry-run"], cwd=ROOT, env=env, text=True, capture_output=True, check=False, ) self.assertEqual(completed.returncode, 0, completed.stderr) self.assertIn(f"FRAMEWORK={FRAMEWORK}", completed.stdout) self.assertIn("GPU_TYPE=Iluvatar_bi-150", completed.stdout) self.assertIn("python3 -m vllm.entrypoints.openai.api_server", completed.stdout) self.assertIn("dry-run: 不启动进程，不访问平台", completed.stdout) self.assertNotIn("modelhub.org.cn", completed.stdout) self.assertNotIn(RETIRED_FRAMEWORK, completed.stdout) self.assertIn("<|user|>", completed.stdout) def test_dry_run_rejects_forbidden_framework(self) -> None: env = os.environ.copy() env["FRAMEWORK"] = "vllm_fix_tokenizer" completed = subprocess.run( ["bash", "scripts/entrypoint.sh", "--dry-run"], cwd=ROOT, env=env, text=True, capture_output=True, check=False, ) self.assertNotEqual(completed.returncode, 0) self.assertIn("vllm_fix_tokenizer", completed.stderr) self.assertIn(FRAMEWORK, completed.stderr) def test_tokenizer_patch_stays_off(self) -> None: import shutil import tempfile import apply_patches self.assertEqual(apply_patches.DEFAULT_FRAMEWORK, FRAMEWORK) with tempfile.TemporaryDirectory() as tmp: model = Path(tmp) / "model" shutil.copytree(ROOT / "tests" / "fixtures" / "fake-model", model) result = apply_patches.apply_all( model, (ROOT / "patches/chat_template/default_chat_template.jinja").read_text(encoding="utf-8"), apply_patches.load_whitelist(ROOT / "patches/architectures/whitelist.txt"), {}, ) self.assertFalse(result["tokenizer"]["applied"]) if __name__ == "__main__": unittest.main()