Skip to content

Commit c728562

Browse files
ciarams87ciarams87
committed
feat: add secure build pipeline test
- Test workflow to validate self-hosted runner access - Test production artifactory configuration - Verify fork safety with repository_owner checks - Safe testing with no artifact publishing
1 parent 950d895 commit c728562

File tree

2 files changed

+311
-0
lines changed

2 files changed

+311
-0
lines changed

‎.github/workflows/test-secure-build.yml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
name: Test Secure Build Pipeline
2+
3+
on:
4+
push:
5+
branches:
6+
- chore/secure-build-pipeline
7+
workflow_dispatch: {} # Allow manual triggering
8+
9+
defaults:
10+
run:
11+
shell: bash
12+
13+
env:
14+
GOPROXY: ${{ github.repository_owner == 'nginx' && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.ref_type == 'tag') && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-dev', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || 'direct' }}
15+
16+
permissions:
17+
contents: read
18+
19+
jobs:
20+
test-production-conditions:
21+
name: Test Production Runner & Artifactory
22+
# Force production conditions by simulating a main branch push
23+
runs-on: ${{ github.repository_owner == 'nginx' && 'ubuntu-22.04-amd64' || 'ubuntu-24.04' }}
24+
steps:
25+
- name: Checkout Repository
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
28+
- name: Verify Runner Type
29+
run: |
30+
echo "🏃 Runner Information:"
31+
echo "Runner OS: $(uname -a)"
32+
echo "Runner Architecture: $(uname -m)"
33+
echo "Runner Name: $RUNNER_NAME"
34+
echo "Runner Environment: $RUNNER_ENVIRONMENT"
35+
echo "GitHub Repository Owner: ${{ github.repository_owner }}"
36+
echo "GitHub Event Name: ${{ github.event_name }}"
37+
echo "GitHub Ref: ${{ github.ref }}"
38+
39+
# Check if we're on a self-hosted runner
40+
if [[ "$RUNNER_NAME" == *"amd64"* ]] || [[ "$RUNNER_ENVIRONMENT" == "self-hosted" ]]; then
41+
echo "✅ SUCCESS: Running on self-hosted runner"
42+
else
43+
echo "ℹ️ INFO: Running on GitHub-hosted runner (expected for forks)"
44+
fi
45+
46+
- name: Test Production Artifactory Access
47+
run: |
48+
echo "🔐 Testing Artifactory Access:"
49+
echo "GOPROXY value: $GOPROXY"
50+
51+
# Force production artifactory URL for testing
52+
export TEST_GOPROXY="${{ github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || 'direct' }}"
53+
echo "Test Production GOPROXY: $TEST_GOPROXY"
54+
55+
if [[ "$TEST_GOPROXY" == *"f5-nginx-go-local-approved-dependency"* ]]; then
56+
echo "✅ SUCCESS: Production artifactory URL configured"
57+
elif [[ "$TEST_GOPROXY" == "direct" ]]; then
58+
echo "ℹ️ INFO: Using direct proxy (expected for forks)"
59+
else
60+
echo "ℹ️ INFO: Using development artifactory"
61+
fi
62+
63+
- name: Setup Golang Environment
64+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
65+
with:
66+
go-version: stable
67+
cache-dependency-path: go.sum
68+
env:
69+
# Force production GOPROXY for this test
70+
GOPROXY: ${{ github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || 'direct' }}
71+
72+
- name: Test Go Module Resolution
73+
run: |
74+
echo "🧪 Testing Go Module Resolution:"
75+
76+
# Test basic Go functionality without modifying go.mod
77+
go version
78+
go env GOPROXY
79+
80+
# Verify we can list modules (read-only operation)
81+
echo "Current modules:"
82+
go list -m all | head -10
83+
84+
# Test downloading a common dependency that should be in approved registry
85+
echo "Testing module download (read-only):"
86+
go mod download -x github.com/stretchr/testify
87+
88+
echo "✅ SUCCESS: Go module resolution working with configured proxy"
89+
90+
- name: Test Environment Variables
91+
run: |
92+
echo "🔧 Environment Test Results:"
93+
echo "Repository Owner: ${{ github.repository_owner }}"
94+
echo "Is NGINX repo: ${{ github.repository_owner == 'nginx' }}"
95+
echo "Event Name: ${{ github.event_name }}"
96+
echo "Ref: ${{ github.ref }}"
97+
echo "Ref Type: ${{ github.ref_type }}"
98+
echo "Branch: ${{ github.ref_name }}"
99+
100+
# Show what the actual conditions evaluate to
101+
echo ""
102+
echo "🎯 Condition Evaluations:"
103+
echo "Main branch push condition: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}"
104+
echo "Tag condition: ${{ github.ref_type == 'tag' }}"
105+
echo "Production condition: ${{ github.repository_owner == 'nginx' && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.ref_type == 'tag') }}"
106+
echo "Self-hosted runner condition: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) }}"
107+
108+
test-development-conditions:
109+
name: Test Development Configuration
110+
# This should use development artifactory and GitHub-hosted runners
111+
runs-on: ubuntu-24.04
112+
steps:
113+
- name: Checkout Repository
114+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
115+
116+
- name: Verify Development Configuration
117+
run: |
118+
echo "🧪 Testing Development Configuration:"
119+
echo "GOPROXY: $GOPROXY"
120+
echo "Runner: ubuntu-24.04 (GitHub-hosted)"
121+
122+
if [[ "$GOPROXY" == *"f5-nginx-go-dev"* ]]; then
123+
echo "✅ SUCCESS: Using development artifactory as expected"
124+
elif [[ "$GOPROXY" == "direct" ]]; then
125+
echo "ℹ️ INFO: Using direct proxy (expected for forks)"
126+
else
127+
echo "❌ UNEXPECTED: Not using expected development configuration"
128+
fi
129+
130+
- name: Setup Golang Environment
131+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
132+
with:
133+
go-version: stable
134+
cache-dependency-path: go.sum
135+
136+
- name: Test Development Access
137+
run: |
138+
echo "🔧 Testing development Go proxy access:"
139+
go version
140+
go env GOPROXY
141+
go list -m all | head -5
142+
echo "✅ SUCCESS: Development configuration working"
143+
144+
summary:
145+
name: Test Summary
146+
needs: [test-production-conditions, test-development-conditions]
147+
runs-on: ubuntu-24.04
148+
if: always()
149+
steps:
150+
- name: Report Results
151+
run: |
152+
echo "🎉 Secure Build Pipeline Test Summary:"
153+
echo "=================================="
154+
echo ""
155+
echo "Production Test: ${{ needs.test-production-conditions.result }}"
156+
echo "Development Test: ${{ needs.test-development-conditions.result }}"
157+
echo ""
158+
echo "This test validates:"
159+
echo "✅ Self-hosted runner selection logic"
160+
echo "✅ GOPROXY artifactory configuration"
161+
echo "✅ Fork safety (repository_owner checks)"
162+
echo "✅ Environment-specific behavior"
163+
echo ""
164+
if [[ "${{ needs.test-production-conditions.result }}" == "success" ]] && [[ "${{ needs.test-development-conditions.result }}" == "success" ]]; then
165+
echo "🎯 ALL TESTS PASSED - Secure build pipeline ready!"
166+
else
167+
echo "❌ Some tests failed - check logs above"
168+
exit 1
169+
fi

‎test-secure-build.sh‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
#!/bin/bash
2+
3+
# Test script to validate secure build pipeline configuration
4+
# This script can be run locally to check the logic before pushing
5+
6+
echo "🔍 Secure Build Pipeline Configuration Test"
7+
echo "==========================================="
8+
echo ""
9+
10+
# Test environment variables (simulated)
11+
export GITHUB_REPOSITORY_OWNER="nginx"
12+
export GITHUB_EVENT_NAME="push"
13+
export GITHUB_REF="refs/heads/chore/secure-build-pipeline"
14+
export GITHUB_REF_TYPE="branch"
15+
16+
echo "📋 Test Scenario: Push to feature branch (chore/secure-build-pipeline)"
17+
echo "Repository Owner: $GITHUB_REPOSITORY_OWNER"
18+
echo "Event Name: $GITHUB_EVENT_NAME"
19+
echo "Ref: $GITHUB_REF"
20+
echo "Ref Type: $GITHUB_REF_TYPE"
21+
echo ""
22+
23+
# Test GOPROXY logic
24+
echo "🔧 Testing GOPROXY Logic:"
25+
echo "------------------------"
26+
27+
# Simulate production condition (main branch push)
28+
MAIN_BRANCH_PUSH="false"
29+
if [[ $GITHUB_EVENT_NAME == "push" && $GITHUB_REF == "refs/heads/main" ]]; then
30+
MAIN_BRANCH_PUSH="true"
31+
fi
32+
33+
# Simulate tag condition
34+
IS_TAG="false"
35+
if [[ $GITHUB_REF_TYPE == "tag" ]]; then
36+
IS_TAG="true"
37+
fi
38+
39+
# Production condition
40+
IS_PRODUCTION="false"
41+
if [[ $GITHUB_REPOSITORY_OWNER == "nginx" && ($MAIN_BRANCH_PUSH == "true" || $IS_TAG == "true") ]]; then
42+
IS_PRODUCTION="true"
43+
fi
44+
45+
echo "Main branch push: $MAIN_BRANCH_PUSH"
46+
echo "Is tag: $IS_TAG"
47+
echo "Is production: $IS_PRODUCTION"
48+
echo ""
49+
50+
if [[ $IS_PRODUCTION == "true" ]]; then
51+
GOPROXY_URL="https://user:[email protected]/artifactory/api/go/f5-nginx-go-local-approved-dependency"
52+
echo "✅ Would use PRODUCTION artifactory: f5-nginx-go-local-approved-dependency"
53+
elif [[ $GITHUB_REPOSITORY_OWNER == "nginx" ]]; then
54+
GOPROXY_URL="https://user:[email protected]/artifactory/api/go/f5-nginx-go-dev"
55+
echo "✅ Would use DEVELOPMENT artifactory: f5-nginx-go-dev"
56+
else
57+
GOPROXY_URL="direct"
58+
echo "✅ Would use DIRECT proxy (for forks)"
59+
fi
60+
61+
echo ""
62+
63+
# Test runner selection
64+
echo "🏃 Testing Runner Selection:"
65+
echo "---------------------------"
66+
67+
if [[ $GITHUB_REPOSITORY_OWNER == "nginx" && $IS_PRODUCTION == "true" ]]; then
68+
RUNNER="ubuntu-22.04-amd64"
69+
echo "✅ Would use SELF-HOSTED runner: $RUNNER"
70+
else
71+
RUNNER="ubuntu-24.04"
72+
echo "✅ Would use GITHUB-HOSTED runner: $RUNNER"
73+
fi
74+
75+
echo ""
76+
77+
# Test different scenarios
78+
echo "🎯 Testing Different Scenarios:"
79+
echo "------------------------------"
80+
81+
scenarios=(
82+
"nginx|push|refs/heads/main|branch|PRODUCTION|ubuntu-22.04-amd64|approved-dependency"
83+
"nginx|push|refs/heads/chore/test|branch|DEVELOPMENT|ubuntu-24.04|go-dev"
84+
"nginx|push|refs/tags/v1.0.0|tag|PRODUCTION|ubuntu-22.04-amd64|approved-dependency"
85+
"forked-user|push|refs/heads/main|branch|FORK|ubuntu-24.04|direct"
86+
)
87+
88+
for scenario in "${scenarios[@]}"; do
89+
IFS='|' read -r owner event ref ref_type expected_env expected_runner expected_proxy <<<"$scenario"
90+
91+
echo ""
92+
echo "Scenario: $owner / $event / $ref"
93+
94+
# Determine conditions
95+
if [[ $event == "push" && $ref == "refs/heads/main" ]]; then
96+
main_push="true"
97+
else
98+
main_push="false"
99+
fi
100+
101+
if [[ $ref_type == "tag" ]]; then
102+
is_tag="true"
103+
else
104+
is_tag="false"
105+
fi
106+
107+
if [[ $owner == "nginx" && ($main_push == "true" || $is_tag == "true") ]]; then
108+
is_prod="true"
109+
if [[ $owner == "nginx" ]]; then
110+
runner="ubuntu-22.04-amd64"
111+
proxy="approved-dependency"
112+
else
113+
runner="ubuntu-24.04"
114+
proxy="direct"
115+
fi
116+
elif [[ $owner == "nginx" ]]; then
117+
is_prod="false"
118+
runner="ubuntu-24.04"
119+
proxy="go-dev"
120+
else
121+
is_prod="false"
122+
runner="ubuntu-24.04"
123+
proxy="direct"
124+
fi
125+
126+
echo " Expected: $expected_env / $expected_runner / $expected_proxy"
127+
echo " Actual: $([ "$is_prod" == "true" ] && echo "PRODUCTION" || echo "DEVELOPMENT") / $runner / $proxy"
128+
129+
if [[ $runner == "$expected_runner" && $proxy == *"$expected_proxy"* ]]; then
130+
echo " ✅ PASS"
131+
else
132+
echo " ❌ FAIL"
133+
fi
134+
done
135+
136+
echo ""
137+
echo "🎉 Test Complete!"
138+
echo ""
139+
echo "To run the actual GitHub Actions test:"
140+
echo "1. Commit and push this branch"
141+
echo "2. Check GitHub Actions tab for 'Test Secure Build Pipeline' workflow"
142+
echo "3. Verify the self-hosted runner is used and artifactory access works"

0 commit comments

Comments
 (0)