(t *testing.T)
| 12 | ) |
| 13 | |
| 14 | func TestCollectDockerImages_CliProxy(t *testing.T) { |
| 15 | // Use a version without "v" prefix — getAWFImageTag strips it |
| 16 | awfImageTag := "0.25.20" |
| 17 | |
| 18 | t.Run("includes cli-proxy image when feature flag is enabled", func(t *testing.T) { |
| 19 | workflowData := &WorkflowData{ |
| 20 | AI: "claude", |
| 21 | NetworkPermissions: &NetworkPermissions{ |
| 22 | Firewall: &FirewallConfig{ |
| 23 | Enabled: true, |
| 24 | Version: awfImageTag, |
| 25 | }, |
| 26 | }, |
| 27 | Features: map[string]any{"cli-proxy": true}, |
| 28 | } |
| 29 | |
| 30 | images := collectDockerImages(nil, workflowData, ActionModeRelease) |
| 31 | |
| 32 | cliProxyImage := constants.DefaultFirewallRegistry + "/cli-proxy:" + awfImageTag |
| 33 | assert.True(t, slices.Contains(images, cliProxyImage), |
| 34 | "Expected cli-proxy image %q in collected images, got: %v", cliProxyImage, images) |
| 35 | }) |
| 36 | |
| 37 | t.Run("excludes cli-proxy image when feature flag is absent", func(t *testing.T) { |
| 38 | workflowData := &WorkflowData{ |
| 39 | AI: "claude", |
| 40 | NetworkPermissions: &NetworkPermissions{ |
| 41 | Firewall: &FirewallConfig{ |
| 42 | Enabled: true, |
| 43 | Version: awfImageTag, |
| 44 | }, |
| 45 | }, |
| 46 | } |
| 47 | |
| 48 | images := collectDockerImages(nil, workflowData, ActionModeRelease) |
| 49 | |
| 50 | cliProxyImage := constants.DefaultFirewallRegistry + "/cli-proxy:" + awfImageTag |
| 51 | assert.False(t, slices.Contains(images, cliProxyImage), |
| 52 | "Did not expect cli-proxy image %q in collected images without feature flag, got: %v", cliProxyImage, images) |
| 53 | }) |
| 54 | |
| 55 | t.Run("excludes cli-proxy image when AWF version is too old", func(t *testing.T) { |
| 56 | workflowData := &WorkflowData{ |
| 57 | AI: "claude", |
| 58 | NetworkPermissions: &NetworkPermissions{ |
| 59 | Firewall: &FirewallConfig{ |
| 60 | Enabled: true, |
| 61 | Version: "v0.25.16", // older than AWFCliProxyMinVersion |
| 62 | }, |
| 63 | }, |
| 64 | Features: map[string]any{"cli-proxy": true}, |
| 65 | } |
| 66 | |
| 67 | images := collectDockerImages(nil, workflowData, ActionModeRelease) |
| 68 | |
| 69 | // Should not include cli-proxy for an old AWF version |
| 70 | for _, img := range images { |
| 71 | assert.NotContains(t, img, "/cli-proxy:", |
nothing calls this directly
no test coverage detected