Add full and fresh-clone release rehearsals

tests/test_milestone5_fresh_clone.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+import unittest
+
+from tools.milestone5_fresh_clone import (
+    COMMIT_PATTERN,
+    EXPECTED_ORIGINS,
+    PUBLIC_REPOSITORY,
+)
+
+
+class Milestone5FreshCloneTests(unittest.TestCase):
+    def test_public_clone_route_has_no_embedded_credentials(self) -> None:
+        self.assertEqual(
+            "https://repo.andraxion.net/administrator/DocForge2.git",
+            PUBLIC_REPOSITORY,
+        )
+        self.assertNotIn("@", PUBLIC_REPOSITORY)
+        self.assertIn(PUBLIC_REPOSITORY, EXPECTED_ORIGINS)
+
+    def test_release_commit_requires_one_full_lowercase_sha1(self) -> None:
+        self.assertIsNotNone(COMMIT_PATTERN.fullmatch("a" * 40))
+        for invalid in ("a" * 39, "A" * 40, "main", "v1.4.0", "../" + "a" * 40):
+            with self.subTest(invalid=invalid):
+                self.assertIsNone(COMMIT_PATTERN.fullmatch(invalid))
+
+
+if __name__ == "__main__":
+    unittest.main()