DEVX-167: feat(ci): verify producer container artifact before opening dependency PR

tests/unit/test_create_dependency_pr.py

@@ -188,3 +188,164 @@ class TestCreateVikunjaTask:
             mock_client.create_task.return_value = {"identifier": "OBL-INFRA-999"}
             result = create_vikunja_task("Test", "desc")
             assert result == "OBL-INFRA-999"
+
+
+class TestResolveContainerDigest:
+    """REQ-1: pre-PR artifact verification via the packages API."""
+
+    def test_returns_digest_from_manifest_blob(self) -> None:
+        from devx.ci.create_dependency_pr import resolve_container_digest
+
+        mock_resp = MagicMock()
+        mock_resp.raise_for_status = MagicMock()
+        mock_resp.json.return_value = [
+            {"name": "sha256_layer", "sha256": "abc"},
+            {"name": "manifest.json", "sha256": "deadbeef"},
+        ]
+        with patch("devx.ci.create_dependency_pr.requests.get", return_value=mock_resp):
+            digest = resolve_container_digest(
+                "https://git.example.com/api/v1", "oblachno", "sso-bridge", "0.9.1", "tok"
+            )
+        assert digest == "sha256:deadbeef"
+
+    def test_raises_when_version_missing(self) -> None:
+        import requests
+
+        from devx.ci.create_dependency_pr import resolve_container_digest
+
+        mock_resp = MagicMock()
+        http_err = requests.HTTPError("404")
+        http_err.response = MagicMock(status_code=404)
+        mock_resp.raise_for_status.side_effect = http_err
+        with patch("devx.ci.create_dependency_pr.requests.get", return_value=mock_resp):
+            with pytest.raises(click.ClickException, match="unpublished artifact"):
+                resolve_container_digest("https://git.example.com/api/v1", "oblachno", "sso-bridge", "9.9.9", "tok")
+
+    def test_raises_when_no_manifest_blob(self) -> None:
+        from devx.ci.create_dependency_pr import resolve_container_digest
+
+        mock_resp = MagicMock()
+        mock_resp.raise_for_status = MagicMock()
+        mock_resp.json.return_value = [{"name": "sha256_layer", "sha256": "abc"}]
+        with patch("devx.ci.create_dependency_pr.requests.get", return_value=mock_resp):
+            with pytest.raises(click.ClickException, match="no manifest blob"):
+                resolve_container_digest("https://git.example.com/api/v1", "oblachno", "sso-bridge", "0.9.1", "tok")
+
+    def test_raises_on_connection_error(self) -> None:
+        import requests
+
+        from devx.ci.create_dependency_pr import resolve_container_digest
+
+        with patch(
+            "devx.ci.create_dependency_pr.requests.get",
+            side_effect=requests.ConnectionError("refused"),
+        ):
+            with pytest.raises(click.ClickException, match="Registry lookup failed"):
+                resolve_container_digest("https://git.example.com/api/v1", "oblachno", "sso-bridge", "0.9.1", "tok")
+
+
+class TestCliVerifyContainer:
+    """REQ-1: artifact verification gates the dependency PR."""
+
+    @patch("devx.ci.create_dependency_pr.resolve_container_digest")
+    @patch("devx.ci.create_dependency_pr.find_pinned_version")
+    @patch("devx.ci.create_dependency_pr.get_ci_token")
+    def test_verify_container_runs_before_lookup(
+        self, mock_token: MagicMock, mock_find: MagicMock, mock_digest: MagicMock
+    ) -> None:
+        """Verification failure aborts before the version lookup/PR steps."""
+        mock_token.return_value = "fake-token"
+        mock_digest.side_effect = click.ClickException("unpublished artifact")
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            [
+                "--package",
+                "sso_bridge",
+                "--new-version",
+                "0.9.1",
+                "--source-repo",
+                "oblachno/sso-bridge",
+                "--verify-container",
+                "oblachno/sso-bridge",
+            ],
+        )
+        assert result.exit_code != 0
+        mock_find.assert_not_called()
+
+    @patch("devx.ci.create_dependency_pr.resolve_container_digest")
+    @patch("devx.ci.create_dependency_pr.find_pinned_version")
+    @patch("devx.ci.create_dependency_pr.get_ci_token")
+    def test_verify_container_resolves_digest(
+        self, mock_token: MagicMock, mock_find: MagicMock, mock_digest: MagicMock
+    ) -> None:
+        mock_token.return_value = "fake-token"
+        mock_find.return_value = "0.9.1"
+        mock_digest.return_value = "sha256:abc"
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            [
+                "--package",
+                "sso_bridge",
+                "--new-version",
+                "0.9.1",
+                "--source-repo",
+                "oblachno/sso-bridge",
+                "--verify-container",
+                "oblachno/sso-bridge",
+            ],
+        )
+        assert result.exit_code == 0
+        mock_digest.assert_called_once()
+        args = mock_digest.call_args[0]
+        assert args[1:4] == ("oblachno", "sso-bridge", "0.9.1")
+
+    @patch("devx.ci.create_dependency_pr.get_ci_token")
+    def test_verify_container_invalid_format(self, mock_token: MagicMock) -> None:
+        mock_token.return_value = "fake-token"
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            [
+                "--package",
+                "sso_bridge",
+                "--new-version",
+                "0.9.1",
+                "--source-repo",
+                "oblachno/sso-bridge",
+                "--verify-container",
+                "no-slash",
+            ],
+        )
+        assert result.exit_code != 0
+
+    @patch("devx.ci.create_dependency_pr.resolve_container_digest")
+    @patch("devx.ci.create_dependency_pr.find_pinned_version")
+    @patch("devx.ci.create_dependency_pr.get_ci_token")
+    def test_container_tag_overrides_new_version(
+        self, mock_token: MagicMock, mock_find: MagicMock, mock_digest: MagicMock
+    ) -> None:
+        """--container-tag selects the image tag when it differs from version."""
+        mock_token.return_value = "fake-token"
+        mock_find.return_value = "0.9.1"
+        mock_digest.return_value = "sha256:abc"
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            [
+                "--package",
+                "sso_bridge",
+                "--new-version",
+                "0.9.1",
+                "--source-repo",
+                "oblachno/sso-bridge",
+                "--verify-container",
+                "oblachno/sso-bridge",
+                "--container-tag",
+                "0.2.4",
+            ],
+        )
+        assert result.exit_code == 0
+        args = mock_digest.call_args[0]
+        assert args[1:4] == ("oblachno", "sso-bridge", "0.2.4")