ci: add E2E for pmg action server-mode (#354)

* ci: add E2E for pmg action server-mode Exercises the safedep/pmg action with server-mode enabled: the action starts the proxy daemon and injects HTTP_PROXY + CA env vars, then bare npm/pip installs are intercepted. Asserts benign installs pass, malicious npm/pip installs are blocked, and 'pmg proxy stop --fail-on-violation' fails the job on the blocks. Scoped via paths to action.yml and the proxy server sources so it only runs when relevant. Complements persistent-proxy-e2e.yml, which covers the branch's proxy internals via raw pmg proxy commands. * ci: extract shared proxy E2E assertions into composite action Both the action server-mode E2E and the persistent-proxy E2E run the same benign/malicious install assertions. Factor them into a local composite action (.github/actions/proxy-e2e-assertions) so the assertions live in one place and both workflows exercise the composite itself. Proxy teardown (pmg proxy stop --fail-on-violation) stays inline in each workflow since the setup/teardown differs per binary-under-test (released binary via the action vs. branch build via make).
2026-08-03 07:24:09 +02:00 · 2026-06-26 16:33:37 +05:30
parent 7b13b6bfb3
commit 2a7ecdb556
3 changed files with 111 additions and 40 deletions
@@ -0,0 +1,58 @@
+# .github/workflows/pmg-action-e2e.yml
+name: PMG Server Action E2E
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "action.yml"
+      - "cmd/proxy/**"
+      - "internal/proxyserver/**"
+      - "internal/flows/cert.go"
+
+permissions:
+  contents: read
+
+jobs:
+  pmg-action-server-e2e:
+    name: PMG Server Action E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.11"
+
+      - name: Run PMG action in server mode
+        uses: ./ # action.yml
+        with:
+          server-mode: true
+          api-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }}
+          tenant-id: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN }}
+
+      - name: Run proxy E2E assertions
+        uses: ./.github/actions/proxy-e2e-assertions
+
+      - name: Stop proxy and verify it fails on the blocks
+        if: always()
+        shell: bash
+        run: |
+          if pmg proxy stop --fail-on-violation; then
+            echo "ERROR: stop should have exited non-zero (packages were blocked)"
+            exit 1
+          fi
+          echo "OK: stop correctly failed on the policy violation"