mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
2a7ecdb556
* ci: add E2E for pmg action server-mode Exercises the safedep/pmg action with server-mode enabled: the action starts the proxy daemon and injects HTTP_PROXY + CA env vars, then bare npm/pip installs are intercepted. Asserts benign installs pass, malicious npm/pip installs are blocked, and 'pmg proxy stop --fail-on-violation' fails the job on the blocks. Scoped via paths to action.yml and the proxy server sources so it only runs when relevant. Complements persistent-proxy-e2e.yml, which covers the branch's proxy internals via raw pmg proxy commands. * ci: extract shared proxy E2E assertions into composite action Both the action server-mode E2E and the persistent-proxy E2E run the same benign/malicious install assertions. Factor them into a local composite action (.github/actions/proxy-e2e-assertions) so the assertions live in one place and both workflows exercise the composite itself. Proxy teardown (pmg proxy stop --fail-on-violation) stays inline in each workflow since the setup/teardown differs per binary-under-test (released binary via the action vs. branch build via make).
59 lines
1.5 KiB
YAML
59 lines
1.5 KiB
YAML
# .github/workflows/pmg-action-e2e.yml
|
|
name: PMG Server Action E2E
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "action.yml"
|
|
- "cmd/proxy/**"
|
|
- "internal/proxyserver/**"
|
|
- "internal/flows/cert.go"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pmg-action-server-e2e:
|
|
name: PMG Server Action E2E
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- name: Checkout Source
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: "24"
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Run PMG action in server mode
|
|
uses: ./ # action.yml
|
|
with:
|
|
server-mode: true
|
|
api-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }}
|
|
tenant-id: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN }}
|
|
|
|
- name: Run proxy E2E assertions
|
|
uses: ./.github/actions/proxy-e2e-assertions
|
|
|
|
- name: Stop proxy and verify it fails on the blocks
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
if pmg proxy stop --fail-on-violation; then
|
|
echo "ERROR: stop should have exited non-zero (packages were blocked)"
|
|
exit 1
|
|
fi
|
|
echo "OK: stop correctly failed on the policy violation"
|