test(multiplayer): verify observability manifests locally

server/security/test_observability_manifests.py

@@ -0,0 +1,36 @@
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).parents[2]
+CHECKER = ROOT / "scripts" / "verify_observability_manifests.py"
+
+
+class ObservabilityManifestTest(unittest.TestCase):
+    def run_checker(self, directory=None):
+        command = [sys.executable, str(CHECKER)]
+        if directory is not None:
+            command += ["--directory", str(directory)]
+        return subprocess.run(command, cwd=ROOT, text=True, capture_output=True)
+
+    def test_checked_in_resources_match_service_and_metric_contract(self):
+        result = self.run_checker()
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_checker_rejects_wrong_namespace_and_broad_scrape(self):
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory)
+            for name in ("prometheus-service-monitor.yaml", "prometheus-rules.yaml"):
+                (target / name).write_text((ROOT / "deploy/observability" / name).read_text())
+            monitor = target / "prometheus-service-monitor.yaml"
+            monitor.write_text(monitor.read_text().replace("path: /metrics", "path: /").replace("- cosmic-clash", "- default"))
+            result = self.run_checker(target)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn("namespace", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()