实现首版 Gitea microVM runner

tests/test_controller.py

@@ -0,0 +1,31 @@
+import hashlib
+import hmac
+
+from gitea_microvm_runner import controller
+
+
+def test_accepts_matching_queued_job(monkeypatch):
+    monkeypatch.setattr(controller, "LABEL", "kind-microvm")
+    assert controller.accepts({
+        "action": "queued",
+        "workflow_job": {"id": 47, "labels": ["linux", "kind-microvm"]},
+    }) == (True, "47")
+
+
+def test_rejects_other_actions_labels_and_boolean_id(monkeypatch):
+    monkeypatch.setattr(controller, "LABEL", "kind-microvm")
+    assert controller.accepts({"action": "completed", "workflow_job": {"id": 1, "labels": ["kind-microvm"]}}) == (False, None)
+    assert controller.accepts({"action": "queued", "workflow_job": {"id": 1, "labels": ["host"]}}) == (False, None)
+    assert controller.accepts({"action": "queued", "workflow_job": {"id": True, "labels": ["kind-microvm"]}}) == (False, None)
+
+
+def test_signature_accepts_gitea_and_prefixed_forms(tmp_path, monkeypatch):
+    secret = b"test-secret"
+    body = b'{"action":"queued"}'
+    secret_file = tmp_path / "secret"
+    secret_file.write_bytes(secret)
+    monkeypatch.setattr(controller, "WEBHOOK_SECRET_FILE", secret_file)
+    digest = hmac.new(secret, body, hashlib.sha256).hexdigest()
+    assert controller.valid_signature(body, digest)
+    assert controller.valid_signature(body, f"sha256={digest}")
+    assert not controller.valid_signature(body, "bad")