ci: add E2E for pmg action server-mode (#354)

* ci: add E2E for pmg action server-mode Exercises the safedep/pmg action with server-mode enabled: the action starts the proxy daemon and injects HTTP_PROXY + CA env vars, then bare npm/pip installs are intercepted. Asserts benign installs pass, malicious npm/pip installs are blocked, and 'pmg proxy stop --fail-on-violation' fails the job on the blocks. Scoped via paths to action.yml and the proxy server sources so it only runs when relevant. Complements persistent-proxy-e2e.yml, which covers the branch's proxy internals via raw pmg proxy commands. * ci: extract shared proxy E2E assertions into composite action Both the action server-mode E2E and the persistent-proxy E2E run the same benign/malicious install assertions. Factor them into a local composite action (.github/actions/proxy-e2e-assertions) so the assertions live in one place and both workflows exercise the composite itself. Proxy teardown (pmg proxy stop --fail-on-violation) stays inline in each workflow since the setup/teardown differs per binary-under-test (released binary via the action vs. branch build via make).
2026-08-03 07:24:09 +02:00 · 2026-06-26 16:33:37 +05:30
parent 7b13b6bfb3
commit 2a7ecdb556
3 changed files with 111 additions and 40 deletions
@@ -0,0 +1,50 @@
+name: Proxy E2E Assertions
+description: >
+  Shared assertions for a running PMG persistent proxy. Assumes the proxy is
+  already started and HTTP_PROXY + CA env vars are exported into the job env.
+  Runs benign + malicious installs. The caller owns stopping the proxy (e.g.
+  pmg proxy stop --fail-on-violation) since teardown differs per setup.
+
+runs:
+  using: composite
+  steps:
+    - name: Verify proxy env is set
+      shell: bash
+      run: |
+        echo "HTTP_PROXY=$HTTP_PROXY"
+        test -n "$HTTP_PROXY"
+
+    - name: Benign npm install succeeds
+      shell: bash
+      run: |
+        mkdir benign-test && cd benign-test
+        npm init -y
+        npm install lodash@4.17.21
+        test -d node_modules/lodash
+        cd .. && rm -rf benign-test
+
+    - name: Malicious npm install is blocked
+      shell: bash
+      run: |
+        mkdir mal-npm && cd mal-npm
+        npm init -y
+        # The install MUST fail (proxy blocks it). Assert that, instead of
+        # continue-on-error which would hide a regression where it succeeds.
+        if npm --no-cache --prefer-online install safedep-test-pkg@0.1.3; then
+          echo "ERROR: malicious npm install succeeded but should have been blocked"
+          exit 1
+        fi
+        echo "OK: malicious npm install was blocked"
+        cd .. && rm -rf mal-npm
+
+    - name: Malicious pip install is blocked (python3 -m pip)
+      shell: bash
+      run: |
+        python3 -m venv venv && source venv/bin/activate
+        if python3 -m pip install safedep-test-pkg; then
+          echo "ERROR: malicious pip install succeeded but should have been blocked"
+          deactivate
+          exit 1
+        fi
+        echo "OK: malicious pip install was blocked"
+        deactivate && rm -rf venv