test: scan every readable wheel surface

Author: karlwaldman

scripts/validate_storefront_claims.py

@@ -2,12 +2,24 @@
 """Reject stale mutable claims from authored, generated, and packaged surfaces."""
 
 import argparse
+import csv
 import re
 from pathlib import Path
 from typing import Iterable, List, Pattern, Sequence, Tuple
 
 ROOT = Path(__file__).resolve().parents[1]
 CONTRACT = "https://api.oilpriceapi.com/product-facts.json"
+BINARY_SUFFIXES = {
+    ".a",
+    ".class",
+    ".dll",
+    ".dylib",
+    ".o",
+    ".pyd",
+    ".pyc",
+    ".pyo",
+    ".so",
+}
 BLOCKED: Sequence[Tuple[str, Pattern[str]]] = (
     ("real-time claim", re.compile(r"\breal[ -]?time\b", re.IGNORECASE)),
     (
@@ -74,10 +86,37 @@ def discover_public_surfaces(root: Path = ROOT) -> List[Path]:
     return sorted(surfaces)
 
 
+def discover_installed_surfaces(package_root: Path) -> List[Path]:
+    """Return every UTF-8 customer-readable file recorded in the wheel manifest."""
+    package_root = package_root.resolve()
+    record_files = sorted(package_root.glob("oilpriceapi-*.dist-info/RECORD"))
+    if len(record_files) != 1:
+        return []
+
+    surfaces: List[Path] = []
+    with record_files[0].open(encoding="utf-8", newline="") as record:
+        for row in csv.reader(record):
+            if not row:
+                continue
+            path = (package_root / row[0]).resolve()
+            try:
+                path.relative_to(package_root)
+            except ValueError:
+                continue
+            if not path.is_file() or path.suffix.lower() in BINARY_SUFFIXES:
+                continue
+            try:
+                path.read_text(encoding="utf-8")
+            except UnicodeDecodeError:
+                continue
+            surfaces.append(path)
+    return sorted(set(surfaces))
+
+
 def _claim_failures(root: Path, surfaces: Iterable[Path]) -> List[str]:
     failures: List[str] = []
     for path in surfaces:
-        text = path.read_text()
+        text = path.read_text(encoding="utf-8")
         for label, pattern in BLOCKED:
             match = pattern.search(text)
             if match:
@@ -109,12 +148,16 @@ def validate_package(package_root: Path) -> List[str]:
     package_root = package_root.resolve()
     package_dir = package_root / "oilpriceapi"
     metadata_files = sorted(package_root.glob("oilpriceapi-*.dist-info/METADATA"))
-    surfaces = sorted(package_dir.rglob("*.py")) + metadata_files
+    record_files = sorted(package_root.glob("oilpriceapi-*.dist-info/RECORD"))
+    surfaces = discover_installed_surfaces(package_root)
     failures = _claim_failures(package_root, surfaces)
 
     if len(metadata_files) != 1:
         failures.append("installed artifact must contain exactly one oilpriceapi METADATA file")
         return failures
+    if len(record_files) != 1:
+        failures.append("installed artifact must contain exactly one oilpriceapi RECORD file")
+        return failures
 
     metadata = metadata_files[0].read_text()
     if CONTRACT not in metadata:

tests/test_storefront_claims.py

@@ -1,6 +1,7 @@
 from pathlib import Path
 
 from scripts.validate_storefront_claims import (
+    discover_installed_surfaces,
     discover_public_surfaces,
     validate,
     validate_package,
@@ -34,5 +35,54 @@ def test_rejects_claim_introduced_only_in_installed_wheel(tmp_path: Path) -> Non
         "Version: 9.9.9\n\n"
         "https://api.oilpriceapi.com/product-facts.json\n"
     )
+    (dist_info / "RECORD").write_text(
+        "oilpriceapi/version.py,,\n"
+        "oilpriceapi/future.py,,\n"
+        "oilpriceapi-9.9.9.dist-info/METADATA,,\n"
+        "oilpriceapi-9.9.9.dist-info/RECORD,,\n"
+    )
 
     assert any("oilpriceapi/future.py" in failure for failure in validate_package(tmp_path))
+
+
+def test_rejects_claim_in_future_installed_package_data(tmp_path: Path) -> None:
+    package = tmp_path / "oilpriceapi"
+    dist_info = tmp_path / "oilpriceapi-9.9.9.dist-info"
+    package.mkdir()
+    (package / "docs").mkdir()
+    (package / "__pycache__").mkdir()
+    dist_info.mkdir()
+    (package / "version.py").write_text('__version__ = "9.9.9"\n')
+    (package / "py.typed").write_text("")
+    (package / "types.pyi").write_text('"""Real-time prices."""\n')
+    (package / "docs" / "catalog.json").write_text(
+        '{"allowance": "1,000 API requests/month"}\n'
+    )
+    (package / "__pycache__" / "version.cpython-312.pyc").write_bytes(b"\x00\xff")
+    (dist_info / "METADATA").write_text(
+        "Metadata-Version: 2.1\n"
+        "Name: oilpriceapi\n"
+        "Version: 9.9.9\n\n"
+        "https://api.oilpriceapi.com/product-facts.json\n"
+    )
+    (dist_info / "RECORD").write_text(
+        "oilpriceapi/version.py,,\n"
+        "oilpriceapi/py.typed,,\n"
+        "oilpriceapi/types.pyi,,\n"
+        "oilpriceapi/docs/catalog.json,,\n"
+        "oilpriceapi/__pycache__/version.cpython-312.pyc,,\n"
+        "oilpriceapi-9.9.9.dist-info/METADATA,,\n"
+        "oilpriceapi-9.9.9.dist-info/RECORD,,\n"
+    )
+
+    surfaces = {
+        path.relative_to(tmp_path).as_posix()
+        for path in discover_installed_surfaces(tmp_path)
+    }
+    failures = validate_package(tmp_path)
+
+    assert "oilpriceapi/types.pyi" in surfaces
+    assert "oilpriceapi/docs/catalog.json" in surfaces
+    assert not any("__pycache__" in surface for surface in surfaces)
+    assert any("oilpriceapi/types.pyi" in failure for failure in failures)
+    assert any("oilpriceapi/docs/catalog.json" in failure for failure in failures)