fix: resolve final addon review

tests/test_addon_metadata.py

@@ -51,26 +51,40 @@ def test_repository_hostname_derivation() -> None:
     assert f"{repository_id}-stelloauth" == "0031621f-stelloauth"
 
 
-def test_documentation_contract() -> None:
-    documentation = "\n".join(
-        (ROOT / path).read_text(encoding="utf-8")
-        for path in ("README.md", "stelloauth/README.md", "stelloauth/DOCS.md")
-    )
+def test_user_guide_documentation_contract() -> None:
+    documentation = (ROOT / "stelloauth/DOCS.md").read_text(encoding="utf-8")
     for required_text in (
         REPOSITORY_URL,
+        "Installér **Stelloauth**",
+        "aktivér **Start ved opstart** og **Watchdog**",
         "http://0031621f-stelloauth:8080/worker",
         "http://192.168.1.20:8080/worker",
         "Brand: Opel",
         "Country: DK",
-        "v0.6.0",
-        "0.5.10",
-        "CloakBrowser Binary License",
+        "Image: 2,571,693,650 bytes (2.571 GB decimal / 2452.56 MiB).",
+        "Dokumenteret Task 4-måling: 121,5 MiB.",
+        "Stop: cirka 9.3 sekunder.",
         "approximately 4 GB free",
         "Der er ikke gennemført et live MyOpel-login.",
         "Login-flow RAM: not measured without real MyOpel credentials.",
     ):
         assert required_text in documentation
     assert "deaktivér porttilknytningen igen" in documentation
+    assert "Seneste idle RAM" not in documentation
+
+
+def test_root_readme_repository_source_and_license_facts() -> None:
+    readme = (ROOT / "README.md").read_text(encoding="utf-8")
+    for required_text in (
+        REPOSITORY_URL,
+        "v0.6.0",
+        "367d4f8c02a3b072c59142c49dffc129edc8548b",
+        "0.5.10",
+        "f04c23da285b3b3d3cf10c8f9d282e7adc1d52ce",
+        "CloakBrowser Binary License",
+        "MIT-licenseret",
+    ):
+        assert required_text in readme
 
 def test_translations_cover_every_option() -> None:
     keys = set(load_yaml("stelloauth/config.yaml")["options"])
@@ -107,6 +121,8 @@ def test_dockerfile_declares_home_assistant_runtime_contract() -> None:
         "io.hass.version",
     ):
         assert label in dockerfile
+    assert 'io.hass.type="app"' in dockerfile
+    assert 'io.hass.type="addon"' not in dockerfile
     assert re.search(r"^EXPOSE 8080$", dockerfile, re.MULTILINE)
     assert not re.search(r"^EXPOSE .*\b9222\b", dockerfile, re.MULTILINE)
     assert "ENTRYPOINT []" in dockerfile
@@ -127,6 +143,64 @@ def test_runtime_accepts_docker_port_unpublished_status() -> None:
     assert 'docker port "$container" 9222/tcp 2>/dev/null || true' in runtime_test
 
 
+def test_ci_builds_and_loads_only_the_amd64_test_image() -> None:
+    workflow = (ROOT / ".gitea/workflows/ci.yml").read_text(encoding="utf-8")
+    parsed = yaml.safe_load(workflow)
+    steps = parsed["jobs"]["validate"]["steps"]
+    build_command = next(
+        step["run"] for step in steps if step.get("name") == "Build amd64 image"
+    )
+    assert build_command.split() == [
+        "docker",
+        "buildx",
+        "build",
+        "--platform",
+        "linux/amd64",
+        "--build-arg",
+        "BUILD_ARCH=amd64",
+        "--load",
+        "--tag",
+        "homeassistant-stelloauth-addon:test",
+        "stelloauth",
+    ]
+    for publication_primitive in (
+        "--push",
+        "docker push",
+        "docker/login-action",
+        "docker/build-push-action",
+        "packages: write",
+    ):
+        assert publication_primitive not in workflow
+
+
+def test_patch_payloads_disable_git_whitespace_errors() -> None:
+    result = subprocess.run(
+        [
+            "git",
+            "check-attr",
+            "whitespace",
+            "--",
+            "stelloauth/patches/stelloauth-security.patch",
+            "stelloauth/patches/cloakserve-loopback.patch",
+        ],
+        cwd=ROOT,
+        text=True,
+        capture_output=True,
+        check=True,
+    )
+    assert result.stdout.splitlines() == [
+        "stelloauth/patches/stelloauth-security.patch: whitespace: unset",
+        "stelloauth/patches/cloakserve-loopback.patch: whitespace: unset",
+    ]
+
+
+def test_runtime_rejects_every_ipv6_cdp_listener() -> None:
+    runtime_test = (ROOT / "tests/test_runtime.sh").read_text(encoding="utf-8")
+    assert 'cat /proc/net/tcp6 > "$tcp6_artifact"' in runtime_test
+    assert 'for table in ("/proc/net/tcp", "/proc/net/tcp6"):' in runtime_test
+    assert 'if table == "/proc/net/tcp6":' in runtime_test
+
+
 def test_runtime_requires_process_baseline_after_cdp_close_and_zero_stopped_pid() -> None:
     runtime_test = (ROOT / "tests/test_runtime.sh").read_text(encoding="utf-8")
     assert 'docker top "$container" -eo pid,args' in runtime_test