AI Implementation feature(1082): Project Scaffold and Docker Packaging (#1)

tests/test_docker_artifacts.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_dockerignore_blocks_secrets_and_data() -> None:
+    dockerignore = (REPO_ROOT / ".dockerignore").read_text().splitlines()
+    normalized = {line.strip() for line in dockerignore if line.strip() and not line.startswith("#")}
+
+    for required in (".env", "data/", ".git/", "tests/", ".kilo/", ".venv/"):
+        assert required in normalized, f"missing {required} from .dockerignore"
+
+
+def test_gitignore_blocks_dotenv_and_data() -> None:
+    gitignore = (REPO_ROOT / ".gitignore").read_text().splitlines()
+    normalized = {line.strip() for line in gitignore if line.strip() and not line.startswith("#")}
+    assert ".env" in normalized
+    assert "data/" in normalized
+    assert ".kilo/" in normalized
+
+
+def test_env_example_has_no_real_tokens() -> None:
+    text = (REPO_ROOT / ".env.example").read_text()
+    assert "MASTODON_ACCESS_TOKEN=replace-me" in text
+
+    for token in ("ghp_", "gho_", "xoxb-", "Bearer ey", "AKIA"):
+        assert token not in text, f"found suspicious token prefix {token!r} in .env.example"
+
+    mastodon_line = next(
+        line for line in text.splitlines() if line.startswith("MASTODON_ACCESS_TOKEN=")
+    )
+    value = mastodon_line.split("=", 1)[1].strip()
+    assert not re.fullmatch(r"[A-Za-z0-9_\-]{40,}", value), (
+        "MASTODON_ACCESS_TOKEN placeholder should not look like a real token"
+    )
+
+
+def test_dockerfile_does_not_copy_env_or_data() -> None:
+    dockerfile = (REPO_ROOT / "Dockerfile").read_text()
+    for blocked in (".env", "data/", "./data"):
+        for line in dockerfile.splitlines():
+            if line.lstrip().upper().startswith("COPY"):
+                assert blocked not in line, f"Dockerfile COPY must not reference {blocked}: {line!r}"
+
+
+def test_compose_mounts_data_and_env_readonly() -> None:
+    compose = (REPO_ROOT / "docker-compose.yml").read_text()
+    assert "./.env:/.env:ro" in compose
+    assert "./data:/app/data" in compose
+    assert "build:" in compose
+
+
+def test_cron_template_has_env_header() -> None:
+    cron = (REPO_ROOT / "crontab" / "tenbackward.cron").read_text()
+    assert "SHELL=/bin/bash" in cron
+    assert "PATH=" in cron