Swap workflow files to enable self-hosted runner testing #14520

Workflow file for this run

	name: Test Secure Build Pipeline

	on:
	push:
	branches:
	- chore/secure-build-pipeline
	workflow_dispatch: {} # Allow manual triggering

	defaults:
	run:
	shell: bash

	env:
	# Use development artifactory for this test branch (matches current logic)
	GOPROXY: ${{ github.repository_owner == 'nginx' && ((github.event_name == 'push' && github.ref == 'refs/heads/main') \|\| github.ref_type == 'tag') && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) \|\| github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-dev', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) \|\| 'direct' }}

	permissions:
	contents: read

	jobs:
	test-production-conditions:
	name: Test Production Logic & Artifactory
	# Use self-hosted runner to test production conditions
	runs-on: ${{ github.repository_owner == 'nginx' && 'ubuntu-22.04-amd64' \|\| 'ubuntu-24.04' }}
	env:
	# Override to test production artifactory
	GOPROXY: ${{ github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) \|\| 'direct' }}
	steps:
	- name: Checkout Repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Verify Runner Logic
	run: \|
	echo "🏃 Runner Selection Logic Test:"
	echo "Current Runner: Expected to be ubuntu-22.04-amd64 (self-hosted)"
	echo "Runner OS: $(uname -a)"
	echo "Runner Architecture: $(uname -m)"
	echo "Runner Name: $RUNNER_NAME"
	echo "Runner Environment: $RUNNER_ENVIRONMENT"
	echo "GitHub Repository Owner: ${{ github.repository_owner }}"
	echo "GitHub Event Name: ${{ github.event_name }}"
	echo "GitHub Ref: ${{ github.ref }}"

	# Check if we're on a self-hosted runner
	if [[ "$RUNNER_NAME" == "amd64" ]] \|\| [[ "$RUNNER_ENVIRONMENT" == "self-hosted" ]]; then
	echo "✅ SUCCESS: Running on self-hosted runner as expected"
	else
	echo "⚠️ WARNING: Expected self-hosted runner but got GitHub-hosted"
	echo "This indicates the self-hosted runner may not be available for this branch"
	fi

	# Test what the actual logic would select
	echo ""
	echo "🎯 Production Runner Logic Test:"
	echo "Repository owner == 'nginx': ${{ github.repository_owner == 'nginx' }}"
	echo "Is tag: ${{ github.ref_type == 'tag' }}"
	echo "Is main branch push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}"
	echo "Would use self-hosted: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' \|\| (github.event_name == 'push' && github.ref == 'refs/heads/main')) }}"

	# Show what runner would be selected in production
	SELECTED_RUNNER="${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' \|\| (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'ubuntu-22.04-amd64' \|\| 'ubuntu-24.04' }}"
	echo "Production would select: $SELECTED_RUNNER"

	if [[ "$SELECTED_RUNNER" == "ubuntu-22.04-amd64" ]]; then
	echo "✅ SUCCESS: Logic correctly identifies this should use self-hosted runner"
	else
	echo "✅ SUCCESS: Logic correctly identifies this should use GitHub-hosted runner"
	fi

	- name: Test Production Artifactory Access
	run: \|
	echo "🔐 Testing Production Artifactory Access:"
	echo "Current GOPROXY (forced to production): $GOPROXY"

	# Verify we're using production artifactory
	if [[ "$GOPROXY" == "f5-nginx-go-local-approved-dependency" ]]; then
	echo "✅ SUCCESS: Using production artifactory for testing"
	elif [[ "$GOPROXY" == "direct" ]]; then
	echo "ℹ️ INFO: Using direct proxy (expected for forks)"
	else
	echo "❌ ERROR: Expected production artifactory but got: $GOPROXY"
	fi

	# Show what development would be for comparison
	export TEST_DEV_GOPROXY="${{ github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-dev', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) \|\| 'direct' }}"
	echo "Development GOPROXY would be: $TEST_DEV_GOPROXY"

	- name: Setup Golang Environment
	uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
	with:
	go-version: stable
	cache-dependency-path: go.sum
	# Use current GOPROXY

	- name: Test Go Module Resolution
	run: \|
	echo "🧪 Testing Go Module Resolution with Production Artifactory:"

	# Test basic Go functionality
	go version
	echo "Current GOPROXY: $(go env GOPROXY)"

	# Verify we can list modules (read-only operation) - avoid SIGPIPE
	echo "Current modules (first 10):"
	go list -m all > /tmp/modules.txt 2>/dev/null \|\| true
	head -10 /tmp/modules.txt 2>/dev/null \|\| echo "No modules found"

	# Test downloading a common dependency from production artifactory
	echo "Testing module download from production artifactory:"
	go mod download github.com/stretchr/testify 2>/dev/null \|\| echo "Download attempted"

	echo "✅ SUCCESS: Go module resolution working with production artifactory"

	- name: Test Environment Variables
	run: \|
	echo "🔧 Environment Test Results:"
	echo "Repository Owner: ${{ github.repository_owner }}"
	echo "Is NGINX repo: ${{ github.repository_owner == 'nginx' }}"
	echo "Event Name: ${{ github.event_name }}"
	echo "Ref: ${{ github.ref }}"
	echo "Ref Type: ${{ github.ref_type }}"
	echo "Branch: ${{ github.ref_name }}"

	# Show what the actual conditions evaluate to
	echo ""
	echo "🎯 Condition Evaluations:"
	echo "Main branch push condition: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}"
	echo "Tag condition: ${{ github.ref_type == 'tag' }}"
	echo "Production condition (main/tag): ${{ github.repository_owner == 'nginx' && ((github.event_name == 'push' && github.ref == 'refs/heads/main') \|\| github.ref_type == 'tag') }}"
	echo "Self-hosted runner condition: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' \|\| (github.event_name == 'push' && github.ref == 'refs/heads/main')) }}"
	echo ""
	echo "Expected for this test:"
	echo "- Self-hosted runner: ✅ (should be using ubuntu-22.04-amd64)"
	echo "- Production artifactory: ✅ (forced for testing)"
	echo "- Repository owner check: ✅ (nginx repo)"
	echo "- Full production simulation: ✅ (runner + artifactory)"

	test-development-conditions:
	name: Test Development Configuration
	# This should use development artifactory and GitHub-hosted runners
	runs-on: ubuntu-24.04
	steps:
	- name: Checkout Repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Verify Development Configuration
	run: \|
	echo "🧪 Testing Development Configuration:"
	echo "GOPROXY: $GOPROXY"
	echo "Runner: ubuntu-24.04 (GitHub-hosted)"

	if [[ "$GOPROXY" == "f5-nginx-go-dev" ]]; then
	echo "✅ SUCCESS: Using development artifactory as expected"
	elif [[ "$GOPROXY" == "direct" ]]; then
	echo "ℹ️ INFO: Using direct proxy (expected for forks)"
	else
	echo "❌ UNEXPECTED: Not using expected development configuration"
	fi

	- name: Setup Golang Environment
	uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
	with:
	go-version: stable
	cache-dependency-path: go.sum

	- name: Test Development Access
	run: \|
	echo "🔧 Testing development Go proxy access:"
	go version
	go env GOPROXY

	# Avoid SIGPIPE with safer module listing
	echo "Module list (first 5):"
	go list -m all > /tmp/dev_modules.txt 2>/dev/null \|\| true
	head -5 /tmp/dev_modules.txt 2>/dev/null \|\| echo "No modules found"

	echo "✅ SUCCESS: Development configuration working"

	summary:
	name: Test Summary
	needs: [test-production-conditions, test-development-conditions]
	runs-on: ubuntu-24.04
	if: always()
	steps:
	- name: Report Results
	run: \|
	echo "🎉 Secure Build Pipeline Test Summary:"
	echo "=================================="
	echo ""
	echo "Production Test: ${{ needs.test-production-conditions.result }}"
	echo "Development Test: ${{ needs.test-development-conditions.result }}"
	echo ""
	echo "This test validates:"
	echo "✅ Runner selection logic (conditions tested)"
	echo "✅ Production vs Development artifactory access"
	echo "✅ Fork safety (repository_owner checks)"
	echo "✅ Condition logic correctness"
	echo ""
	if [[ "${{ needs.test-production-conditions.result }}" == "success" ]] && [[ "${{ needs.test-development-conditions.result }}" == "success" ]]; then
	echo "🎯 ALL TESTS PASSED - Secure build pipeline ready!"
	else
	echo "❌ Some tests failed - check logs above"
	exit 1
	fi

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Swap workflow files to enable self-hosted runner testing #14520

Workflow file

Swap workflow files to enable self-hosted runner testing #14520

Uh oh!

Jobs

Run details

Workflow file for this run