feat: add path validation options to restore action #1685
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - releases/** | |
| push: | |
| branches: | |
| - main | |
| - releases/** | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Build and unit test | |
| build: | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macOS-latest] | |
| fail-fast: false | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Node.js 24.x | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.x | |
| cache: npm | |
| - run: npm ci | |
| - name: Prettier Format Check | |
| run: npm run format-check | |
| - name: ESLint Check | |
| run: npm run lint | |
| - name: Build & Test | |
| run: npm run test | |
| # End to end save and restore | |
| test-save: | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macOS-latest] | |
| fail-fast: false | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Generate files in working directory | |
| shell: bash | |
| run: __tests__/create-cache-files.sh ${{ runner.os }} test-cache | |
| - name: Generate files outside working directory | |
| shell: bash | |
| run: __tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache | |
| - name: Save cache | |
| uses: ./ | |
| with: | |
| key: test-${{ runner.os }}-${{ github.run_id }} | |
| path: | | |
| test-cache | |
| ~/test-cache | |
| test-restore: | |
| needs: test-save | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macOS-latest] | |
| fail-fast: false | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Restore cache | |
| uses: ./ | |
| with: | |
| key: test-${{ runner.os }}-${{ github.run_id }} | |
| path: | | |
| test-cache | |
| ~/test-cache | |
| - name: Verify cache files in working directory | |
| shell: bash | |
| run: __tests__/verify-cache-files.sh ${{ runner.os }} test-cache | |
| - name: Verify cache files outside working directory | |
| shell: bash | |
| run: __tests__/verify-cache-files.sh ${{ runner.os }} ~/test-cache | |
| # End to end with proxy | |
| test-proxy-save: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ubuntu:latest | |
| options: --cap-add=NET_ADMIN | |
| services: | |
| squid-proxy: | |
| image: ubuntu/squid:latest | |
| ports: | |
| - 3128:3128 | |
| env: | |
| http_proxy: http://squid-proxy:3128 | |
| https_proxy: http://squid-proxy:3128 | |
| steps: | |
| - name: Wait for proxy to be ready | |
| shell: bash | |
| run: | | |
| echo "Waiting for squid proxy to be ready..." | |
| echo "Resolving squid-proxy hostname:" | |
| getent hosts squid-proxy || echo "DNS resolution failed" | |
| for i in $(seq 1 30); do | |
| if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then | |
| echo "Proxy is ready!" | |
| exit 0 | |
| fi | |
| echo "Attempt $i: Proxy not ready, waiting..." | |
| sleep 2 | |
| done | |
| echo "Proxy failed to become ready" | |
| exit 1 | |
| env: | |
| http_proxy: "" | |
| https_proxy: "" | |
| - name: Install dependencies | |
| run: | | |
| apt-get update | |
| apt-get install -y iptables curl | |
| - name: Verify proxy is working | |
| run: | | |
| echo "Testing proxy connectivity..." | |
| curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true | |
| echo "Proxy verification complete" | |
| - name: Block direct traffic (enforce proxy usage) | |
| run: | | |
| # Get the squid-proxy container IP | |
| PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') | |
| echo "Proxy IP: $PROXY_IP" | |
| # Allow loopback traffic | |
| iptables -A OUTPUT -o lo -j ACCEPT | |
| # Allow traffic to the proxy container | |
| iptables -A OUTPUT -d $PROXY_IP -j ACCEPT | |
| # Allow established connections | |
| iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| # Allow DNS (needed for initial resolution) | |
| iptables -A OUTPUT -p udp --dport 53 -j ACCEPT | |
| iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT | |
| # Block all other outbound traffic (HTTP/HTTPS) | |
| iptables -A OUTPUT -p tcp --dport 80 -j REJECT | |
| iptables -A OUTPUT -p tcp --dport 443 -j REJECT | |
| # Log the iptables rules for debugging | |
| iptables -L -v -n | |
| - name: Verify direct HTTPS is blocked | |
| run: | | |
| echo "Testing that direct HTTPS requests fail..." | |
| if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then | |
| echo "ERROR: Direct HTTPS request succeeded - blocking is not working!" | |
| exit 1 | |
| else | |
| echo "SUCCESS: Direct HTTPS request was blocked as expected" | |
| fi | |
| echo "Testing that HTTPS through proxy succeeds..." | |
| if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then | |
| echo "SUCCESS: HTTPS request through proxy succeeded" | |
| else | |
| echo "ERROR: HTTPS request through proxy failed!" | |
| exit 1 | |
| fi | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Generate files | |
| run: __tests__/create-cache-files.sh proxy test-cache | |
| - name: Save cache | |
| uses: ./ | |
| with: | |
| key: test-proxy-${{ github.run_id }} | |
| path: test-cache | |
| test-proxy-restore: | |
| needs: test-proxy-save | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ubuntu:latest | |
| options: --cap-add=NET_ADMIN | |
| services: | |
| squid-proxy: | |
| image: ubuntu/squid:latest | |
| ports: | |
| - 3128:3128 | |
| env: | |
| http_proxy: http://squid-proxy:3128 | |
| https_proxy: http://squid-proxy:3128 | |
| steps: | |
| - name: Wait for proxy to be ready | |
| shell: bash | |
| run: | | |
| echo "Waiting for squid proxy to be ready..." | |
| echo "Resolving squid-proxy hostname:" | |
| getent hosts squid-proxy || echo "DNS resolution failed" | |
| for i in $(seq 1 30); do | |
| if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then | |
| echo "Proxy is ready!" | |
| exit 0 | |
| fi | |
| echo "Attempt $i: Proxy not ready, waiting..." | |
| sleep 2 | |
| done | |
| echo "Proxy failed to become ready" | |
| exit 1 | |
| env: | |
| http_proxy: "" | |
| https_proxy: "" | |
| - name: Install dependencies | |
| run: | | |
| apt-get update | |
| apt-get install -y iptables curl | |
| - name: Verify proxy is working | |
| run: | | |
| echo "Testing proxy connectivity..." | |
| curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true | |
| echo "Proxy verification complete" | |
| - name: Block direct traffic (enforce proxy usage) | |
| run: | | |
| # Get the squid-proxy container IP | |
| PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') | |
| echo "Proxy IP: $PROXY_IP" | |
| # Allow loopback traffic | |
| iptables -A OUTPUT -o lo -j ACCEPT | |
| # Allow traffic to the proxy container | |
| iptables -A OUTPUT -d $PROXY_IP -j ACCEPT | |
| # Allow established connections | |
| iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| # Allow DNS (needed for initial resolution) | |
| iptables -A OUTPUT -p udp --dport 53 -j ACCEPT | |
| iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT | |
| # Block all other outbound traffic (HTTP/HTTPS) | |
| iptables -A OUTPUT -p tcp --dport 80 -j REJECT | |
| iptables -A OUTPUT -p tcp --dport 443 -j REJECT | |
| # Log the iptables rules for debugging | |
| iptables -L -v -n | |
| - name: Verify direct HTTPS is blocked | |
| run: | | |
| echo "Testing that direct HTTPS requests fail..." | |
| if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then | |
| echo "ERROR: Direct HTTPS request succeeded - blocking is not working!" | |
| exit 1 | |
| else | |
| echo "SUCCESS: Direct HTTPS request was blocked as expected" | |
| fi | |
| echo "Testing that HTTPS through proxy succeeds..." | |
| if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then | |
| echo "SUCCESS: HTTPS request through proxy succeeded" | |
| else | |
| echo "ERROR: HTTPS request through proxy failed!" | |
| exit 1 | |
| fi | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Restore cache | |
| uses: ./ | |
| with: | |
| key: test-proxy-${{ github.run_id }} | |
| path: test-cache | |
| - name: Verify cache | |
| run: __tests__/verify-cache-files.sh proxy test-cache |