Skip to content

Commit 3b0222d

Browse files
ciarams87ciarams87
committed
feat: add secure build pipeline test
- Test workflow to validate self-hosted runner access - Test production artifactory configuration - Verify fork safety with repository_owner checks - Safe testing with no artifact publishing
1 parent 950d895 commit 3b0222d

File tree

2 files changed

+333
-0
lines changed

2 files changed

+333
-0
lines changed

‎.github/workflows/test-secure-build.yml‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
name: Test Secure Build Pipeline
2+
3+
on:
4+
push:
5+
branches:
6+
- chore/secure-build-pipeline
7+
workflow_dispatch: {} # Allow manual triggering
8+
9+
defaults:
10+
run:
11+
shell: bash
12+
13+
env:
14+
# Use development artifactory for this test branch (matches current logic)
15+
GOPROXY: ${{ github.repository_owner == 'nginx' && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.ref_type == 'tag') && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-dev', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || 'direct' }}
16+
17+
permissions:
18+
contents: read
19+
20+
jobs:
21+
test-production-conditions:
22+
name: Test Production Runner & Artifactory (Simulated)
23+
# Force self-hosted runner for testing (override normal logic)
24+
runs-on: ${{ github.repository_owner == 'nginx' && 'ubuntu-22.04-amd64' || 'ubuntu-24.04' }}
25+
steps:
26+
- name: Checkout Repository
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
29+
- name: Verify Runner Type
30+
run: |
31+
echo "🏃 Runner Information:"
32+
echo "Runner OS: $(uname -a)"
33+
echo "Runner Architecture: $(uname -m)"
34+
echo "Runner Name: $RUNNER_NAME"
35+
echo "Runner Environment: $RUNNER_ENVIRONMENT"
36+
echo "GitHub Repository Owner: ${{ github.repository_owner }}"
37+
echo "GitHub Event Name: ${{ github.event_name }}"
38+
echo "GitHub Ref: ${{ github.ref }}"
39+
40+
# Check if we're on a self-hosted runner
41+
if [[ "$RUNNER_NAME" == *"amd64"* ]] || [[ "$RUNNER_ENVIRONMENT" == "self-hosted" ]]; then
42+
echo "✅ SUCCESS: Running on self-hosted runner"
43+
else
44+
echo "ℹ️ INFO: Running on GitHub-hosted runner (expected for forks)"
45+
fi
46+
47+
- name: Test Production Artifactory Access
48+
run: |
49+
echo "🔐 Testing Artifactory Access:"
50+
echo "Current GOPROXY (should be dev for this branch): $GOPROXY"
51+
52+
# Test what production GOPROXY would be
53+
export TEST_PROD_GOPROXY="${{ github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || 'direct' }}"
54+
echo "Production GOPROXY would be: $TEST_PROD_GOPROXY"
55+
56+
# Test what development GOPROXY is
57+
export TEST_DEV_GOPROXY="${{ github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-dev', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || 'direct' }}"
58+
echo "Development GOPROXY (current): $TEST_DEV_GOPROXY"
59+
60+
# Verify current behavior
61+
if [[ "$GOPROXY" == *"f5-nginx-go-dev"* ]]; then
62+
echo "✅ SUCCESS: Using development artifactory as expected for feature branch"
63+
elif [[ "$GOPROXY" == "direct" ]]; then
64+
echo "ℹ️ INFO: Using direct proxy (expected for forks)"
65+
else
66+
echo "ℹ️ INFO: Unexpected GOPROXY configuration"
67+
fi
68+
69+
# Test that production URL is properly formatted
70+
if [[ "$TEST_PROD_GOPROXY" == *"f5-nginx-go-local-approved-dependency"* ]]; then
71+
echo "✅ SUCCESS: Production artifactory URL is correctly formatted"
72+
else
73+
echo "❌ ERROR: Production artifactory URL formatting issue"
74+
fi
75+
76+
- name: Setup Golang Environment
77+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
78+
with:
79+
go-version: stable
80+
cache-dependency-path: go.sum
81+
# Use current GOPROXY (development for this branch)
82+
83+
- name: Test Go Module Resolution
84+
run: |
85+
echo "🧪 Testing Go Module Resolution:"
86+
87+
# Test basic Go functionality
88+
go version
89+
echo "Current GOPROXY: $(go env GOPROXY)"
90+
91+
# Verify we can list modules (read-only operation) - avoid SIGPIPE
92+
echo "Current modules (first 10):"
93+
go list -m all > /tmp/modules.txt 2>/dev/null || true
94+
head -10 /tmp/modules.txt 2>/dev/null || echo "No modules found"
95+
96+
# Test downloading a common dependency
97+
echo "Testing module download (read-only):"
98+
go mod download github.com/stretchr/testify 2>/dev/null || echo "Download attempted"
99+
100+
echo "✅ SUCCESS: Go module resolution working with development artifactory"
101+
102+
- name: Test Environment Variables
103+
run: |
104+
echo "🔧 Environment Test Results:"
105+
echo "Repository Owner: ${{ github.repository_owner }}"
106+
echo "Is NGINX repo: ${{ github.repository_owner == 'nginx' }}"
107+
echo "Event Name: ${{ github.event_name }}"
108+
echo "Ref: ${{ github.ref }}"
109+
echo "Ref Type: ${{ github.ref_type }}"
110+
echo "Branch: ${{ github.ref_name }}"
111+
112+
# Show what the actual conditions evaluate to
113+
echo ""
114+
echo "🎯 Condition Evaluations:"
115+
echo "Main branch push condition: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}"
116+
echo "Tag condition: ${{ github.ref_type == 'tag' }}"
117+
echo "Production condition (main/tag): ${{ github.repository_owner == 'nginx' && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.ref_type == 'tag') }}"
118+
echo "Self-hosted runner condition: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) }}"
119+
echo ""
120+
echo "Expected for this test:"
121+
echo "- Self-hosted runner: ✅ (explicitly enabled for this branch)"
122+
echo "- Development artifactory: ✅ (not main branch)"
123+
echo "- Repository owner check: ✅ (nginx repo)"
124+
125+
test-development-conditions:
126+
name: Test Development Configuration
127+
# This should use development artifactory and GitHub-hosted runners
128+
runs-on: ubuntu-24.04
129+
steps:
130+
- name: Checkout Repository
131+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
132+
133+
- name: Verify Development Configuration
134+
run: |
135+
echo "🧪 Testing Development Configuration:"
136+
echo "GOPROXY: $GOPROXY"
137+
echo "Runner: ubuntu-24.04 (GitHub-hosted)"
138+
139+
if [[ "$GOPROXY" == *"f5-nginx-go-dev"* ]]; then
140+
echo "✅ SUCCESS: Using development artifactory as expected"
141+
elif [[ "$GOPROXY" == "direct" ]]; then
142+
echo "ℹ️ INFO: Using direct proxy (expected for forks)"
143+
else
144+
echo "❌ UNEXPECTED: Not using expected development configuration"
145+
fi
146+
147+
- name: Setup Golang Environment
148+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
149+
with:
150+
go-version: stable
151+
cache-dependency-path: go.sum
152+
153+
- name: Test Development Access
154+
run: |
155+
echo "🔧 Testing development Go proxy access:"
156+
go version
157+
go env GOPROXY
158+
159+
# Avoid SIGPIPE with safer module listing
160+
echo "Module list (first 5):"
161+
go list -m all > /tmp/dev_modules.txt 2>/dev/null || true
162+
head -5 /tmp/dev_modules.txt 2>/dev/null || echo "No modules found"
163+
164+
echo "✅ SUCCESS: Development configuration working"
165+
166+
summary:
167+
name: Test Summary
168+
needs: [test-production-conditions, test-development-conditions]
169+
runs-on: ubuntu-24.04
170+
if: always()
171+
steps:
172+
- name: Report Results
173+
run: |
174+
echo "🎉 Secure Build Pipeline Test Summary:"
175+
echo "=================================="
176+
echo ""
177+
echo "Production Test: ${{ needs.test-production-conditions.result }}"
178+
echo "Development Test: ${{ needs.test-development-conditions.result }}"
179+
echo ""
180+
echo "This test validates:"
181+
echo "✅ Self-hosted runner access (forced for this test branch)"
182+
echo "✅ Development artifactory configuration (expected for feature branches)"
183+
echo "✅ Fork safety (repository_owner checks)"
184+
echo "✅ Condition logic correctness"
185+
echo ""
186+
if [[ "${{ needs.test-production-conditions.result }}" == "success" ]] && [[ "${{ needs.test-development-conditions.result }}" == "success" ]]; then
187+
echo "🎯 ALL TESTS PASSED - Secure build pipeline ready!"
188+
else
189+
echo "❌ Some tests failed - check logs above"
190+
exit 1
191+
fi

‎test-secure-build.sh‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
#!/bin/bash
2+
3+
# Test script to validate secure build pipeline configuration
4+
# This script can be run locally to check the logic before pushing
5+
6+
echo "🔍 Secure Build Pipeline Configuration Test"
7+
echo "==========================================="
8+
echo ""
9+
10+
# Test environment variables (simulated)
11+
export GITHUB_REPOSITORY_OWNER="nginx"
12+
export GITHUB_EVENT_NAME="push"
13+
export GITHUB_REF="refs/heads/chore/secure-build-pipeline"
14+
export GITHUB_REF_TYPE="branch"
15+
16+
echo "📋 Test Scenario: Push to feature branch (chore/secure-build-pipeline)"
17+
echo "Repository Owner: $GITHUB_REPOSITORY_OWNER"
18+
echo "Event Name: $GITHUB_EVENT_NAME"
19+
echo "Ref: $GITHUB_REF"
20+
echo "Ref Type: $GITHUB_REF_TYPE"
21+
echo ""
22+
23+
# Test GOPROXY logic
24+
echo "🔧 Testing GOPROXY Logic:"
25+
echo "------------------------"
26+
27+
# Simulate production condition (main branch push)
28+
MAIN_BRANCH_PUSH="false"
29+
if [[ $GITHUB_EVENT_NAME == "push" && $GITHUB_REF == "refs/heads/main" ]]; then
30+
MAIN_BRANCH_PUSH="true"
31+
fi
32+
33+
# Simulate tag condition
34+
IS_TAG="false"
35+
if [[ $GITHUB_REF_TYPE == "tag" ]]; then
36+
IS_TAG="true"
37+
fi
38+
39+
# Production condition
40+
IS_PRODUCTION="false"
41+
if [[ $GITHUB_REPOSITORY_OWNER == "nginx" && ($MAIN_BRANCH_PUSH == "true" || $IS_TAG == "true") ]]; then
42+
IS_PRODUCTION="true"
43+
fi
44+
45+
echo "Main branch push: $MAIN_BRANCH_PUSH"
46+
echo "Is tag: $IS_TAG"
47+
echo "Is production: $IS_PRODUCTION"
48+
echo ""
49+
50+
if [[ $IS_PRODUCTION == "true" ]]; then
51+
GOPROXY_URL="https://user:[email protected]/artifactory/api/go/f5-nginx-go-local-approved-dependency"
52+
echo "✅ Would use PRODUCTION artifactory: f5-nginx-go-local-approved-dependency"
53+
elif [[ $GITHUB_REPOSITORY_OWNER == "nginx" ]]; then
54+
GOPROXY_URL="https://user:[email protected]/artifactory/api/go/f5-nginx-go-dev"
55+
echo "✅ Would use DEVELOPMENT artifactory: f5-nginx-go-dev"
56+
else
57+
GOPROXY_URL="direct"
58+
echo "✅ Would use DIRECT proxy (for forks)"
59+
fi
60+
61+
echo ""
62+
63+
# Test runner selection
64+
echo "🏃 Testing Runner Selection:"
65+
echo "---------------------------"
66+
67+
if [[ $GITHUB_REPOSITORY_OWNER == "nginx" && $IS_PRODUCTION == "true" ]]; then
68+
RUNNER="ubuntu-22.04-amd64"
69+
echo "✅ Would use SELF-HOSTED runner: $RUNNER"
70+
else
71+
RUNNER="ubuntu-24.04"
72+
echo "✅ Would use GITHUB-HOSTED runner: $RUNNER"
73+
fi
74+
75+
echo ""
76+
77+
# Test different scenarios
78+
echo "🎯 Testing Different Scenarios:"
79+
echo "------------------------------"
80+
81+
scenarios=(
82+
"nginx|push|refs/heads/main|branch|PRODUCTION|ubuntu-22.04-amd64|approved-dependency"
83+
"nginx|push|refs/heads/chore/test|branch|DEVELOPMENT|ubuntu-24.04|go-dev"
84+
"nginx|push|refs/tags/v1.0.0|tag|PRODUCTION|ubuntu-22.04-amd64|approved-dependency"
85+
"forked-user|push|refs/heads/main|branch|FORK|ubuntu-24.04|direct"
86+
)
87+
88+
for scenario in "${scenarios[@]}"; do
89+
IFS='|' read -r owner event ref ref_type expected_env expected_runner expected_proxy <<<"$scenario"
90+
91+
echo ""
92+
echo "Scenario: $owner / $event / $ref"
93+
94+
# Determine conditions
95+
if [[ $event == "push" && $ref == "refs/heads/main" ]]; then
96+
main_push="true"
97+
else
98+
main_push="false"
99+
fi
100+
101+
if [[ $ref_type == "tag" ]]; then
102+
is_tag="true"
103+
else
104+
is_tag="false"
105+
fi
106+
107+
if [[ $owner == "nginx" && ($main_push == "true" || $is_tag == "true") ]]; then
108+
is_prod="true"
109+
if [[ $owner == "nginx" ]]; then
110+
runner="ubuntu-22.04-amd64"
111+
proxy="approved-dependency"
112+
else
113+
runner="ubuntu-24.04"
114+
proxy="direct"
115+
fi
116+
elif [[ $owner == "nginx" ]]; then
117+
is_prod="false"
118+
runner="ubuntu-24.04"
119+
proxy="go-dev"
120+
else
121+
is_prod="false"
122+
runner="ubuntu-24.04"
123+
proxy="direct"
124+
fi
125+
126+
echo " Expected: $expected_env / $expected_runner / $expected_proxy"
127+
echo " Actual: $([ "$is_prod" == "true" ] && echo "PRODUCTION" || echo "DEVELOPMENT") / $runner / $proxy"
128+
129+
if [[ $runner == "$expected_runner" && $proxy == *"$expected_proxy"* ]]; then
130+
echo " ✅ PASS"
131+
else
132+
echo " ❌ FAIL"
133+
fi
134+
done
135+
136+
echo ""
137+
echo "🎉 Test Complete!"
138+
echo ""
139+
echo "To run the actual GitHub Actions test:"
140+
echo "1. Commit and push this branch"
141+
echo "2. Check GitHub Actions tab for 'Test Secure Build Pipeline' workflow"
142+
echo "3. Verify the self-hosted runner is used and artifactory access works"

0 commit comments

Comments
 (0)