tox.ini

# Tox (http://tox.testrun.org/) is a tool for running tests
# in multiple virtualenvs. This configuration file will run the
# test suite on all supported python versions. To use it, "pip install tox"
# and then run "tox" from this directory.

[tox]
envlist = lint, py, purepy, py-no-gpg, py-test-gpg-fails
skipsdist = True

[testenv]
install_command =
    pip install {opts} {packages}

passenv =
    PYKCS11LIB

deps =
    -r{toxinidir}/requirements-pinned.txt
    -r{toxinidir}/requirements-test.txt

commands =
    python -m tests.check_gpg_available
    coverage run tests/aggregate_tests.py
    coverage report -m --fail-under 70

[testenv:purepy]
deps =

commands =
    python -m tests.check_gpg_available
    python -m tests.check_public_interfaces

[testenv:py-no-gpg]
setenv =
    GNUPG = nonexisting-gpg-for-testing
commands =
    python -m tests.check_public_interfaces_gpg

[testenv:kms]
deps =
    -r{toxinidir}/requirements-pinned.txt
    -r{toxinidir}/requirements-kms.txt
passenv =
    GOOGLE_APPLICATION_CREDENTIALS
commands =
    python -m tests.check_kms_signers

[testenv:sigstore]
deps =
    -r{toxinidir}/requirements-pinned.txt
    -r{toxinidir}/requirements-sigstore.txt
commands =
    python -m tests.check_sigstore_signer

# Check that importing securesystemslib._gpg.constants doesn't shell out.
[testenv:py-test-gpg-fails]
setenv =
    GNUPG = false
commands =
    python -c "import securesystemslib._gpg.constants"

[testenv:lint]
deps =
    -r{toxinidir}/requirements-pinned.txt
    -r{toxinidir}/requirements-lint.txt
    -r{toxinidir}/requirements-sigstore.txt
lint_dirs = securesystemslib tests
commands =
    ruff format --diff {[testenv:lint]lint_dirs}
    ruff check {[testenv:lint]lint_dirs}

    mypy {[testenv:lint]lint_dirs}
    zizmor --persona=pedantic -q .

[testenv:fix]
deps = {[testenv:lint]deps}
commands =
    ruff check --fix {[testenv:lint]lint_dirs}
    ruff format {[testenv:lint]lint_dirs}

# Requires docker running
[testenv:local-aws-kms]
deps =
    -r{toxinidir}/requirements-pinned.txt
    -r{toxinidir}/requirements-aws.txt
    localstack
    awscli
    awscli-local

allowlist_externals =
    localstack
    bash

setenv =
    AWS_ACCESS_KEY_ID = test
    AWS_SECRET_ACCESS_KEY = test
    AWS_ENDPOINT_URL = http://localhost:4566/
    AWS_DEFAULT_REGION = us-east-1

commands_pre =
    # Start virtual AWS KMS
    localstack start --detached
    localstack wait

    # Create test keys
    bash {toxinidir}/tests/scripts/init-aws-kms.sh

commands =
    # Run tests
    python -m tests.check_aws_signer

commands_post =
    # Stop virtual AWS KMS
    localstack stop


# Requires `vault`
# https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-install
[testenv:local-vault]
deps =
    -r{toxinidir}/requirements-pinned.txt
    -r{toxinidir}/requirements-vault.txt

allowlist_externals =
    bash

setenv =
    VAULT_ADDR = http://localhost:8200
    VAULT_TOKEN = test-root-token

commands_pre =
    bash {toxinidir}/tests/scripts/init-vault.sh

commands =
     python -m tests.check_vault_signer

commands_post =
    bash {toxinidir}/tests/scripts/stop-vault.sh