forms-deploy/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml at main · alphagov/forms-deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: "Guardrail: Matching pentester CIDR blocks"

on:
  pull_request:
    branches: [main]
    paths:
      - "infra/deployments/forms/tfvars/staging.tfvars"
      - "infra/deployments/forms/account/staging.tfvars"
      - "infra/deployments/deploy/engineer-access/roles.tf"
      - ".github/workflows/guardrail_matching_pentester_cidr_blocks.yml"
env:
  HCL2JSON_VERSION: "v0.6.1"
jobs:
  check_for_matching_cidr_blocks:
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read
      pull-requests: write

    name: Check for matching CIDR blocks
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install `hcl2json` with mise
        uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
        with:
          install_args: hcl2json

      - name: Check CIDR blocks match everywhere
        run: |
          hcl2json infra/deployments/forms/tfvars/staging.tfvars | jq -rc '.environmental_settings.rate_limit_bypass_cidrs' > forms_tfvars_staging
          hcl2json infra/deployments/forms/account/tfvars/staging.tfvars | jq -rc '.pentester_cidr_ranges' > forms_acct_tfvars_staging
          hcl2json infra/deployments/deploy/engineer-access/roles.tf | jq -rc '.module.engineer_access[0].pentester_cidrs' > deploy_engineer_access_roles


          if ! cmp --silent forms_tfvars_staging forms_acct_tfvars_staging || \
             ! cmp --silent forms_tfvars_staging deploy_engineer_access_roles || \
             ! cmp --silent forms_acct_tfvars_staging deploy_engineer_access_roles; then
            cat <<EOF
              If you're setting pen tester CIDR blocks, make sure you set them the same everywhere
              * infra/deployments/forms/tfvars/staging.tfvars
              * infra/deployments/forms/account/tfvars/staging.tfvars
              * infra/deployments/deploy/engineer-access/roles.tf
          EOF

            echo "infra/deployments/forms/tfvars/staging.tfvars"
            cat forms_tfvars_staging

            echo "infra/deployments/forms/account/tfvars/staging.tfvars"
            cat forms_acct_tfvars_staging

            echo "infra/deployments/deploy/engineer-access/roles.tf"
            cat deploy_engineer_access_roles
            exit 1
          fi

      - name: Check CIDR blocks are only set in staging
        run: |
          while IFS= read -r file
          do
            if "$(jq -rc '.environmental_settings.rate_limit_bypass_cidrs' "${file}")" != "[]"; then
              echo "Rate limiting bypass CIDRs should not be set outside out staging"
              echo "Guilty file: ${file}"
              exit 1
            fi
          done < <(find infra/deployments/forms/tfvars infra/deployments/forms/account/tfvars -not -name "staging.tfvars" -name "*.tfvars")