tests: add a harness that starts throwaway Forgejo and Gitea servers behind Traefik #677

New issue

Open

opened 2026-09-29 23:05:07 +00:00 by hexajon · 1 comment

hexajon commented

2026-09-29 23:05:07 +00:00

Owner

What to build

A test harness in Go that gives a test a real forge, as ADR 0017 decides. For each of Forgejo and Gitea, the harness:

downloads the pinned binary once, checks its SHA-256, and caches it by that checksum;
starts the forge on a free port, with a fresh data directory and SQLite;
creates a fresh admin and a token with the forge's own CLI, and creates a test repo;
starts a pinned Traefik in front of the forge, with a rate limit, so that every request goes through a real reverse proxy, as in production.

Traefik also comes from a pinned binary with a checked SHA-256. The harness needs no docker and no secret.

The pins live in one file. A madtea-dev command bumps them: it finds the latest release of Forgejo, Gitea, and Traefik, downloads each one, and writes the new version and checksum. Nobody edits a pin by hand.

Acceptance

A test gets a client for each forge and reads the server version through the proxy.
A test that sends requests too fast gets the proxy's rate-limit refusal.
A test stops a forge and gets the client's error for a stopped server.
A binary whose checksum does not match fails the run with a message that names the file. Nothing runs from an unchecked binary.
The madtea-dev command writes the pin file. A second run with no new release changes nothing.

Part of #674.

## What to build A test harness in Go that gives a test a real forge, as ADR 0017 decides. For each of Forgejo and Gitea, the harness: - downloads the pinned binary once, checks its SHA-256, and caches it by that checksum; - starts the forge on a free port, with a fresh data directory and SQLite; - creates a fresh admin and a token with the forge's own CLI, and creates a test repo; - starts a pinned Traefik in front of the forge, with a rate limit, so that every request goes through a real reverse proxy, as in production. Traefik also comes from a pinned binary with a checked SHA-256. The harness needs no docker and no secret. The pins live in one file. A `madtea-dev` command bumps them: it finds the latest release of Forgejo, Gitea, and Traefik, downloads each one, and writes the new version and checksum. Nobody edits a pin by hand. ## Acceptance - A test gets a client for each forge and reads the server version through the proxy. - A test that sends requests too fast gets the proxy's rate-limit refusal. - A test stops a forge and gets the client's error for a stopped server. - A binary whose checksum does not match fails the run with a message that names the file. Nothing runs from an unchecked binary. - The `madtea-dev` command writes the pin file. A second run with no new release changes nothing. Part of #674.

hexajon referenced this issue

2026-09-29 23:05:15 +00:00

ci: run the forge tests on the harness in the gate and in CI, and remove the docker-exec smoke job #678

hexajon referenced this issue

2026-09-29 23:05:21 +00:00

tests: move the internal/gitea tests from fake forges to the harness #679

hexajon referenced this issue

2026-09-29 23:05:28 +00:00

tests: move the internal/mcp tests from fake forges to the harness #680

hexajon referenced this issue

2026-09-29 23:05:35 +00:00

tests: move the internal/service tests from fake forges to the harness #681

hexajon referenced this issue

2026-09-29 23:05:42 +00:00

tests: move the remaining tests from fake forges to the harness #682

hexajon referenced this issue

2026-09-29 23:06:02 +00:00

epic: run forge tests against throwaway Forgejo and Gitea servers behind a real proxy #674