test: container lab for the two-tier apply

A disposable ubuntu container, a fake private tier and a fake bootstrap endpoint, so the whole documented path — chezmoi init --apply, dotup pick, dotup private, cmp apply, dotsecrets — can run end to end without touching a real machine or a real credential. The fake tier mirrors the real one's structure (seven secrets and one alias) because dotsecrets is copied verbatim and the "8 exports, not 7" assertion depends on that cardinality; its ids are sequential and obviously synthetic. check-verbatim.sh keeps the fake tier's copies of shipped files honest, and snapshot.sh records file modes so a 644 where a 600 belongs is a diff.
2026-08-21 22:34:53 -04:00
parent d1e3f8bce2
commit a001406a33
22 changed files with 2809 additions and 0 deletions
@@ -0,0 +1,64 @@
+#!/bin/bash
+# The three packages with no apt source at all: lazygit, omp, herdr.
+#
+# They are `safe` and pre-ticked, they resolve to brew, and until now nothing
+# installed brew -- so `^a` promised three packages that failed on every fresh
+# Linux box. Homebrew does run on Linux; it just has to be asked.
+#
+# This is deliberately its own scenario. The Homebrew installer pulls a large
+# tree and takes minutes, which is not something to bolt onto the fast path.
+set -u
+fail() { echo "FAIL: $*"; exit 1; }
+ok()   { echo "  ok  $*"; }
+
+sudo apt-get update -qq && sudo apt-get install -y -qq git >/dev/null 2>&1
+sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply "$PUB_URL" >/tmp/init.log 2>&1 \
+	|| { tail -5 /tmp/init.log; fail "public tier init"; }
+D=$HOME/.local/bin/dotup
+
+command -v brew >/dev/null && fail "brew already present — this box is not fresh"
+ok "no brew on a stock box, which is the whole problem"
+
+S=${XDG_CONFIG_HOME:-$HOME/.config}/dotfiles; mkdir -p "$S"
+# Tick ONLY lazygit. brew must arrive through the @needs closure, not because
+# the scenario asked for it -- that is the property under test.
+"$D" preset none >/dev/null
+"$D" toggle p:core/lazygit >/dev/null
+grep -qx 'core/brew' "$S/selected" \
+	|| fail "ticking core/lazygit did not pull in core/brew — the @needs edge is missing"
+ok "ticking lazygit pulled in core/brew by itself"
+
+# Order matters as much as presence: core/brew is a `script` row, and script
+# used to run AFTER brew, so brew would still have been missing when the three
+# brew rows were attempted.
+"$D" --print install 2>&1 | grep -n 'Homebrew/install\|brew install lazygit' > /tmp/order.txt
+h=$(sed -n 's/^\([0-9]*\):.*Homebrew\/install.*/\1/p' /tmp/order.txt | head -1)
+b=$(sed -n 's/^\([0-9]*\):.*brew install lazygit.*/\1/p' /tmp/order.txt | head -1)
+[ -n "$h" ] && [ -n "$b" ] || fail "could not find both steps in the plan: $(cat /tmp/order.txt)"
+[ "$h" -lt "$b" ] || fail "brew is installed AFTER the packages that need it (line $h vs $b)"
+ok "the installer runs before the packages that need it"
+
+echo "-- installing, this is the slow part --"
+"$D" --yes install >/tmp/install.log 2>&1
+rc=$?
+tail -4 /tmp/install.log | sed 's/^/   | /'
+[ "$rc" -eq 0 ] || fail "dotup install exited $rc"
+
+command -v brew >/dev/null 2>&1 || [ -x /home/linuxbrew/.linuxbrew/bin/brew ] \
+	|| fail "brew was not installed"
+ok "brew installed to the linuxbrew prefix"
+export PATH="/home/linuxbrew/.linuxbrew/bin:$PATH"
+
+# /usr/local is the reason Homebrew has a reputation. On Linux it should be
+# untouched, and that claim is worth checking rather than repeating.
+[ -z "$(ls -A /usr/local/bin 2>/dev/null | grep -x 'brew' || true)" ] \
+	|| fail "brew wrote into /usr/local/bin"
+ok "/usr/local is untouched — everything is under the linuxbrew prefix"
+
+command -v lazygit >/dev/null || fail "lazygit still not installed after brew arrived"
+ok "lazygit installed: $(lazygit --version 2>&1 | head -1 | cut -c1-60)"
+
+grep -q 'did not install' /tmp/install.log \
+	&& { grep -A5 'did not install' /tmp/install.log | sed 's/^/   | /'; fail "packages still failed"; }
+ok "nothing in the run failed"
+echo "BREW PASS"