Clean up macOS release hygiene tests

Author: TheGreatAxios

tests/unit/macos-release-signing.test.ts

@@ -45,7 +45,7 @@ printf '%s\\n' "$STUB_NOTARY_JSON"`,
   await command("ditto", `: > "$5"`);
   await command("plutil", `cp "$5" "$4"`);
 
-  const run = (operation = "sign-and-notarize", architecture = "arm64", overrides = {}) =>
+  const run = (operation = "sign", architecture = "arm64", overrides = {}) =>
     Bun.spawnSync({
       cmd: ["bash", helper, operation, artifact, architecture],
       cwd: root,
@@ -81,7 +81,7 @@ describe("macOS release signing gate", () => {
 
   test("signs, notarizes, and validates an accepted artifact", async () => {
     const { run } = await createFixture();
-    const signed = run("sign");
+    const signed = run();
     expect({ exitCode: signed.exitCode, stderr: signed.stderr.toString() }).toEqual({
       exitCode: 0,
       stderr: "",
@@ -119,30 +119,4 @@ describe("macOS release signing gate", () => {
     const { run } = await createFixture();
     expect(run("verify", "x86_64", { STUB_ARCHES: "arm64" }).exitCode).not.toBe(0);
   });
-
-  test("keeps both macOS architectures on the mandatory pre-publication path", async () => {
-    const release = await readFile(join(root, "scripts/release.sh"), "utf8");
-    expect(release).toContain('"macos-arm64|bun-darwin-arm64|macos|-"');
-    expect(release).toContain('"macos-x64|bun-darwin-x64|macos|-"');
-    expect(release).toContain('[ "$kind" != macos ] && [ -f "$tarball" ]');
-
-    const signing = release.indexOf('"$MACOS_RELEASE_HELPER" sign ');
-    const nativeSmoke = release.indexOf('"$MACOS_HOST_NATIVE_SMOKE" "$label"');
-    const notarization = release.indexOf('"$MACOS_RELEASE_HELPER" notarize ');
-    const extraction = release.indexOf('tar -xzf "$tarball"');
-    const checksum = release.indexOf('shasum -a 256 "$pkg.tar.gz"');
-    const publication = release.indexOf('step "Land release commit');
-    expect(signing).toBeGreaterThan(0);
-    expect(nativeSmoke).toBeGreaterThan(signing);
-    expect(notarization).toBeGreaterThan(nativeSmoke);
-    expect(extraction).toBeGreaterThan(notarization);
-    expect(checksum).toBeGreaterThan(extraction);
-    expect(publication).toBeGreaterThan(checksum);
-    expect(release.slice(0, publication)).toContain(
-      '[ "$validated_macos" -eq 2 ] || die "both macOS architectures must rebuild and pass release validation"',
-    );
-    expect(release.slice(0, publication)).toContain(
-      '[ "$native_smoked_macos" -eq 1 ] || die "host-native signed OpenTUI smoke is required before publication"',
-    );
-  });
 });

tests/unit/release-native-validation.test.ts

@@ -30,6 +30,23 @@ async function createStubBinDirectory() {
   return { directory, binDirectory, command };
 }
 
+async function stubCurlDownload(
+  command: (name: string, body: string) => Promise<void>,
+  tarball: string,
+) {
+  await command(
+    "curl",
+    `out=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "-o" ]; then out="$arg"; fi
+  prev="$arg"
+done
+[ -n "$out" ]
+cp "${tarball}" "$out"`,
+  );
+}
+
 describe("host-native signed OpenTUI smoke counting", () => {
   test("release gate separates host-native smoke from opposite-arch signature validation", async () => {
     const source = await readFile(release, "utf8");
@@ -40,10 +57,15 @@ describe("host-native signed OpenTUI smoke counting", () => {
     expect(source).toContain(
       '[ "$validated_macos" -eq 2 ] || die "both macOS architectures must rebuild and pass release validation"',
     );
+    expect(source).toContain('"macos-arm64|bun-darwin-arm64|macos|-"');
+    expect(source).toContain('"macos-x64|bun-darwin-x64|macos|-"');
+    expect(source).toContain('[ "$kind" != macos ] && [ -f "$tarball" ]');
 
     const sign = source.indexOf('"$MACOS_RELEASE_HELPER" sign ');
     const smoke = source.indexOf('"$MACOS_HOST_NATIVE_SMOKE" "$label"');
     const notarize = source.indexOf('"$MACOS_RELEASE_HELPER" notarize ');
+    const extraction = source.indexOf('tar -xzf "$tarball"');
+    const checksum = source.indexOf('shasum -a 256 "$pkg.tar.gz"');
     const validated = source.indexOf("validated_macos=$((validated_macos + 1))");
     const nativeGate = source.indexOf(
       '[ "$native_smoked_macos" -eq 1 ] || die "host-native signed OpenTUI smoke is required before publication"',
@@ -52,8 +74,10 @@ describe("host-native signed OpenTUI smoke counting", () => {
     expect(sign).toBeGreaterThan(0);
     expect(smoke).toBeGreaterThan(sign);
     expect(notarize).toBeGreaterThan(smoke);
-    expect(validated).toBeGreaterThan(notarize);
-    expect(nativeGate).toBeGreaterThan(validated);
+    expect(extraction).toBeGreaterThan(notarize);
+    expect(validated).toBeGreaterThan(extraction);
+    expect(checksum).toBeGreaterThan(validated);
+    expect(nativeGate).toBeGreaterThan(checksum);
     expect(publication).toBeGreaterThan(nativeGate);
   });
 
@@ -112,7 +136,7 @@ describe("OpenTUI native package lockfile integrity", () => {
   });
 
   test("mismatched checksum fails before unpack", async () => {
-    const { directory, binDirectory } = await createStubBinDirectory();
+    const { directory, binDirectory, command } = await createStubBinDirectory();
     const lockfile = join(directory, "bun.lock");
     const dest = join(directory, "node_modules/@opentui/core-darwin-arm64");
     const tarball = join(directory, "payload.tgz");
@@ -121,21 +145,7 @@ describe("OpenTUI native package lockfile integrity", () => {
       lockfile,
       `{\n  "packages": {\n    "@opentui/core-darwin-arm64": ["@opentui/core-darwin-arm64@0.5.1", "", {}, "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="],\n  }\n}\n`,
     );
-    await writeFile(
-      join(binDirectory, "curl"),
-      `#!/bin/sh
-set -eu
-out=""
-prev=""
-for arg in "$@"; do
-  if [ "$prev" = "-o" ]; then out="$arg"; fi
-  prev="$arg"
-done
-[ -n "$out" ]
-cp "${tarball}" "$out"
-`,
-    );
-    await chmod(join(binDirectory, "curl"), 0o755);
+    await stubCurlDownload(command, tarball);
 
     const result = Bun.spawnSync({
       cmd: ["bash", fetchOpentui, "core-darwin-arm64", "0.5.1", dest, lockfile],
@@ -153,7 +163,7 @@ cp "${tarball}" "$out"
   });
 
   test("packages-array hash wins over nested optionalDependencies false match", async () => {
-    const { directory, binDirectory } = await createStubBinDirectory();
+    const { directory, binDirectory, command } = await createStubBinDirectory();
     const lockfile = join(directory, "bun.lock");
     const dest = join(directory, "node_modules/@opentui/core-darwin-arm64");
     const packageRoot = join(directory, "package");
@@ -192,21 +202,7 @@ cp "${tarball}" "$out"
 }
 `,
     );
-    await writeFile(
-      join(binDirectory, "curl"),
-      `#!/bin/sh
-set -eu
-out=""
-prev=""
-for arg in "$@"; do
-  if [ "$prev" = "-o" ]; then out="$arg"; fi
-  prev="$arg"
-done
-[ -n "$out" ]
-cp "${tarball}" "$out"
-`,
-    );
-    await chmod(join(binDirectory, "curl"), 0o755);
+    await stubCurlDownload(command, tarball);
 
     const accept = Bun.spawnSync({
       cmd: ["bash", fetchOpentui, "core-darwin-arm64", "0.5.1", dest, lockfile],