🔧 收紧本地脚本与 runner 产物边界

tests/check_crlf_test.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+REPO_ROOT=$(cd "${SCRIPT_DIR}/.." && pwd)
+
+fail() {
+    echo "FAIL: $*" >&2
+    exit 1
+}
+
+has_crlf() {
+    local file_path=$1
+
+    file "${file_path}" | grep -qi "CRLF\|with CR"
+}
+
+test_check_crlf_works_from_preset_directory() {
+    local temp_root common_dir preset_dir output_file file_name
+
+    temp_root=$(mktemp -d)
+    common_dir="${temp_root}/common"
+    preset_dir="${temp_root}/preset"
+    output_file="${temp_root}/output.txt"
+
+    mkdir -p "${common_dir}" "${preset_dir}"
+    cp "${REPO_ROOT}/docker-runner/common/check_crlf.sh" "${common_dir}/check_crlf.sh"
+    chmod +x "${common_dir}/check_crlf.sh"
+
+    for file_name in entrypoint.sh setup.sh upgrade.sh register.sh manage.sh; do
+        printf '#!/bin/bash\r\necho test\r\n' > "${common_dir}/${file_name}"
+        chmod 644 "${common_dir}/${file_name}"
+    done
+
+    (
+        cd "${preset_dir}"
+        printf 'n\n' | ../common/check_crlf.sh > "${output_file}"
+    )
+
+    ! rg -q "文件不存在" "${output_file}" || fail "check_crlf.sh should inspect sibling common scripts even when invoked from preset directory"
+
+    for file_name in entrypoint.sh setup.sh upgrade.sh register.sh manage.sh; do
+        ! has_crlf "${common_dir}/${file_name}" || fail "${file_name} should have CRLF fixed"
+        [ -x "${common_dir}/${file_name}" ] || fail "${file_name} should be made executable"
+    done
+
+    rm -rf "${temp_root}"
+}
+
+test_check_crlf_works_from_preset_directory
+
+echo "check_crlf_test.sh: PASS"

tests/template_defaults_test.sh

@@ -55,6 +55,21 @@ test_workflow_docs_and_links_use_actual_paths() {
     ! rg -q '/\\.github/workflows/' "${release_workflow}" || fail "release workflow should not link to .github/workflows"
 }
 
+test_presets_do_not_mount_check_crlf_helper() {
+    ! rg -q 'check_crlf\.sh:/data/check_crlf\.sh:ro' "${REPO_ROOT}/docker-runner/presets" || fail "preset compose files should not mount check_crlf helper into containers"
+}
+
+test_runner_data_is_gitignored() {
+    local path
+
+    for path in \
+        "docker-runner/presets/standard-ubuntu-22/runner-data/config.yaml" \
+        "docker-runner/presets/buildx-ubuntu-22/runner-data/config.yaml" \
+        "docker-runner/presets/buildx-archlinux/runner-data/config.yaml"; do
+        git -C "${REPO_ROOT}" check-ignore -q "${path}" || fail "${path} should be ignored as runtime runner data"
+    done
+}
+
 test_preset_env_examples_exist() {
     local file
 
@@ -72,6 +87,8 @@ test_preset_compose_uses_env_for_instance
 test_workflows_do_not_hardcode_company_server
 test_stats_workflow_uses_workflow_secret_consistently
 test_workflow_docs_and_links_use_actual_paths
+test_presets_do_not_mount_check_crlf_helper
+test_runner_data_is_gitignored
 test_preset_env_examples_exist
 
 echo "template_defaults_test.sh: PASS"