fix(drill): fail toolchain-pins tool rows without sources (D-1184, D-0112 blocked)

free/ci/internal/toolchain/drill_test.go

@@ -174,3 +174,23 @@ func TestDrillVerifiesAPinnedImageRow(t *testing.T) {
 		t.Fatalf("vanished pinned image: exit %d %v", exit, c)
 	}
 }
+
+// TestDrillFailsWhenAToolRowHasNoSources: a tool row without sources has nothing to verify, so it must fail
+// instead of passing with nothing checked (D-1184).
+func TestDrillFailsWhenAToolRowHasNoSources(t *testing.T) {
+	srv := mirror(t)
+	for name, tail := range map[string]string{
+		"absent": "",
+		"empty":  "    sources: []\n",
+	} {
+		t.Run(name, func(t *testing.T) {
+			table := "version: 1\nrows:\n  - name: nosrc\n    kind: tool\n    version: \"1.0.0\"\n    purpose: p\n    owner: o\n    probe: [nosrc, --version]\n    upstream: {type: github, ref: acme/demo}\n" + tail
+			doc, exit, raw := runDrill(t, table, srv)
+			validEvidence(t, raw)
+			c := resultsByTool(doc)["nosrc"]
+			if exit != 1 || doc["result"] != "fail" || c["result"] != "fail" || !strings.Contains(c["excerpt"].(string), "no sources") {
+				t.Fatalf("exit %d result %v check %v", exit, doc["result"], c)
+			}
+		})
+	}
+}

scripts/drill/toolchain-pins/run

@@ -139,11 +139,16 @@ while IFS= read -r row; do
 		fi
 		continue ;;
 	esac
+	# A tool row with no sources has nothing to check. Fail it: a process substitution below would swallow the jq error.
+	if ! sources=$(jq -c '.sources | if type == "array" and length > 0 then .[] else error("no sources") end' <<<"$row" 2>/dev/null); then
+		emit "$name" "$name" "$version" true fail 1 "tool row has no sources to verify"
+		continue
+	fi
 	gone=()
 	while IFS= read -r src; do
 		url=$(jq -r .url <<<"$src")
 		head_ok "$url" || gone+=("$(jq -r '.os + "/" + .arch' <<<"$src")")
-	done < <(jq -c '.sources[]' <<<"$row")
+	done <<<"$sources"
 	if [ "${#gone[@]}" -gt 0 ]; then
 		emit "$name" "$name" "$version" true fail "${#gone[@]}" "pinned artifact no longer downloadable for: ${gone[*]}"
 		continue