Merge GitHub upstream into Gitea primary

tests/test_api_server_security.py

@@ -1567,7 +1567,14 @@ def test_capability_audit_scans_registry_and_local_sources() -> None:
     assert audit['local_open_source']['source_count'] >= 3
     assert any(source['name'] == 'dashaflow' for source in audit['local_open_source']['sources'])
     assert all(gap.get('command') != 'varga-full' for gap in audit['priority_gaps'])
-    assert audit['surfaces']['app_routes'] == ['admin/codes', 'home', 'login']
+    assert audit['surfaces']['app_routes'] == [
+        'admin/codes',
+        'admin/packages',
+        'admin/payments',
+        'admin/users',
+        'home',
+        'login',
+    ]
     assert set(audit['surfaces']['app_visible_topics']) == {
         'Birth Rectification',
         'Case Validation',

tests/test_railway_deployment.py

@@ -12,10 +12,13 @@ def test_railway_services_use_the_product_frontend_and_dynamic_ports() -> None:
     assert "--hostname 0.0.0.0" in web and "${PORT:-3000}" in web
     assert "next-env.d.ts" not in web
 
+    assert "FROM m.daocloud.io/docker.io/library/python:3.12-slim" in api
     assert "COPY SKILL.md mcp_server.py" in api
     assert "--host 0.0.0.0" in api and "${PORT:-5200}" in api
     assert "http.server" not in api
 
+    assert "FROM swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-alpine" in web
+
 
 def test_web_image_copies_postcss_config_before_building_frontend() -> None:
     web = (ROOT / "deploy" / "railway-web.Dockerfile").read_text(encoding="utf-8")

tests/test_release_hygiene_contract.py

@@ -8,3 +8,9 @@ def test_release_profile_requires_privacy_and_renderer_probes() -> None:
     assert '"scripts/three_engine_parity_replay_validator.py"' in source
     assert '"--require-external-parity"' in source
     assert 'parity_command.append("--require-pass")' in source
+
+
+def test_release_dasha_audit_uses_runnable_public_fixture() -> None:
+    source = (Path(__file__).resolve().parents[1] / "scripts" / "run_quality_gate.py").read_text(encoding="utf-8")
+    assert '"REDACTED_YEAR"' not in source
+    assert '"synthetic_fixture"' in source

tests/test_shadbala_complete.py

@@ -3,6 +3,7 @@
 
 from __future__ import annotations
 import json
+from pathlib import Path
 import sys, os, pytest
 
 SCRIPTS = os.path.join(os.path.dirname(__file__), '..', 'scripts')
@@ -221,8 +222,9 @@ class TestDrikBala:
 
 class TestShadbalaFull:
     def test_shadbala_module_exposes_reference_constants_path(self):
-        assert SHADBALA_CONSTANTS_PATH.endswith('references/shat_bala_constants.json')
-        assert os.path.exists(SHADBALA_CONSTANTS_PATH)
+        constants_path = Path(SHADBALA_CONSTANTS_PATH).resolve()
+        assert constants_path.parts[-2:] == ('references', 'shat_bala_constants.json')
+        assert constants_path.exists()
 
     def test_static_shadbala_constants_are_loaded_from_reference_json(self):
         constants = _shadbala_constants()