ci: verify signed packages before protected draft publication
This commit is contained in:
Emil
@@ -0,0 +1,127 @@
|
||||
"""Execute the actual trusted workflow gate against disposable local Git history."""
|
||||
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import tempfile
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
ROOT = Path(os.environ.get("RELEASE_TEST_ROOT", Path(__file__).resolve().parents[1]))
|
||||
WORKFLOWS = [ROOT / ".github/workflows" / name for name in ("release.yml", "release-publish.yml")]
|
||||
GATE = " - name: Resolve tag using trusted workflow Git commands\n"
|
||||
|
||||
|
||||
def workflow_gate(workflow):
|
||||
after = workflow.read_text().split(GATE, 1)[1]
|
||||
lines = after.split(" run: |\n", 1)[1].splitlines()
|
||||
body = []
|
||||
for line in lines:
|
||||
if not line.startswith(" "):
|
||||
break
|
||||
body.append(line[10:])
|
||||
return "\n".join(body) + "\n"
|
||||
|
||||
|
||||
class ReleaseGateTests(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.temporary = tempfile.TemporaryDirectory(prefix="shacraft-source-gate-")
|
||||
self.directory = Path(self.temporary.name)
|
||||
self.environment = dict(os.environ, GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_GLOBAL=os.devnull)
|
||||
self.git("init", "--initial-branch=main")
|
||||
self.git("config", "user.email", "test@example.invalid")
|
||||
self.git("config", "user.name", "Release Gate Test")
|
||||
(self.directory / "reviewed.txt").write_text("Reviewed source\n")
|
||||
self.git("add", ".")
|
||||
self.git("commit", "-m", "Reviewed main commit")
|
||||
self.good = self.git("rev-parse", "HEAD")
|
||||
self.git("update-ref", "refs/remotes/origin/main", self.good)
|
||||
self.git("tag", "v0.2.0")
|
||||
self.git("checkout", "-b", "unreviewed")
|
||||
(self.directory / "scripts").mkdir()
|
||||
# This validator would falsely accept its own tag if a workflow ran it.
|
||||
(self.directory / "scripts/release.py").write_text(
|
||||
"from pathlib import Path\nPath('untrusted-code-ran').write_text('bypassed')\n"
|
||||
)
|
||||
self.git("add", ".")
|
||||
self.git("commit", "-m", "Unreviewed tag with false validator")
|
||||
self.bad = self.git("rev-parse", "HEAD")
|
||||
self.git("tag", "v9.9.9")
|
||||
self.git("checkout", "main")
|
||||
|
||||
def tearDown(self):
|
||||
self.temporary.cleanup()
|
||||
|
||||
def git(self, *args):
|
||||
return subprocess.check_output(["git", *args], cwd=self.directory,
|
||||
env=self.environment, text=True, stderr=subprocess.DEVNULL).strip()
|
||||
|
||||
def run_gate(self, workflow, tag):
|
||||
output = self.directory / (workflow.stem + "-output")
|
||||
output.unlink(missing_ok=True)
|
||||
result = subprocess.run(["bash", "-c", workflow_gate(workflow)], cwd=self.directory,
|
||||
env=dict(self.environment, RELEASE_TAG=tag, GITHUB_OUTPUT=str(output)),
|
||||
capture_output=True, text=True, check=False)
|
||||
return result, output.read_text() if output.exists() else ""
|
||||
|
||||
def test_main_tag_emits_immutable_commit(self):
|
||||
for workflow in WORKFLOWS:
|
||||
with self.subTest(workflow=workflow.name):
|
||||
result, output = self.run_gate(workflow, "v0.2.0")
|
||||
self.assertEqual(result.returncode, 0, result.stderr)
|
||||
self.assertEqual(output, f"commit={self.good}\n")
|
||||
|
||||
def test_unreviewed_tag_cannot_replace_its_own_ancestry_validator(self):
|
||||
for workflow in WORKFLOWS:
|
||||
with self.subTest(workflow=workflow.name):
|
||||
result, output = self.run_gate(workflow, "v9.9.9")
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertEqual(output, "")
|
||||
self.assertFalse((self.directory / "untrusted-code-ran").exists())
|
||||
|
||||
def test_missing_or_retargeted_tag_cannot_change_validated_source(self):
|
||||
for workflow in WORKFLOWS:
|
||||
with self.subTest(workflow=workflow.name):
|
||||
result, output = self.run_gate(workflow, "v8.8.8")
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertEqual(output, "")
|
||||
self.git("tag", "-f", "v0.2.0", self.good)
|
||||
result, output = self.run_gate(workflow, "v0.2.0")
|
||||
self.assertEqual(result.returncode, 0, result.stderr)
|
||||
self.git("tag", "-f", "v0.2.0", self.bad)
|
||||
self.assertEqual(output, f"commit={self.good}\n")
|
||||
result, fresh_output = self.run_gate(workflow, "v0.2.0")
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertEqual(fresh_output, "")
|
||||
|
||||
def test_workflows_execute_candidate_code_only_after_gate_and_checkout_sha(self):
|
||||
for workflow in WORKFLOWS:
|
||||
with self.subTest(workflow=workflow.name):
|
||||
text = workflow.read_text()
|
||||
preflight = text.split(" preflight:\n", 1)[1].split("\n build:\n", 1)[0].split("\n publish:\n", 1)[0]
|
||||
before, after = preflight.split(GATE, 1)
|
||||
self.assertEqual(before.count("uses: actions/checkout@v4"), 1)
|
||||
self.assertIn("fetch-depth: 0", before)
|
||||
self.assertNotIn("ref:", before) # Initial checkout is trusted workflow main.
|
||||
self.assertIn("release.version_tag", before)
|
||||
self.assertLess(after.index("git merge-base --is-ancestor"), after.index("uses: actions/checkout@v4"))
|
||||
self.assertIn("ref: ${{ steps.source.outputs.commit }}", after)
|
||||
self.assertNotIn("ref: ${{ inputs.tag }}", text)
|
||||
downstream = text[len(text.split(" preflight:\n", 1)[0]) + len(" preflight:\n") + len(preflight):]
|
||||
self.assertGreater(downstream.count("ref: ${{ needs.preflight.outputs.commit }}"), 0)
|
||||
self.assertEqual(downstream.count("uses: actions/checkout@v4"), downstream.count("ref: ${{ needs.preflight.outputs.commit }}"))
|
||||
self.assertEqual(text.count("uses: actions/checkout@v4"), text.count("persist-credentials: false"))
|
||||
|
||||
def test_write_token_is_only_exposed_to_explicit_final_publish_step(self):
|
||||
text = WORKFLOWS[1].read_text().split("\n publish:\n", 1)[1]
|
||||
job_environment = re.search(r"(?m)^ env:\n((?: .*\n)+)", text)
|
||||
self.assertIsNotNone(job_environment)
|
||||
self.assertNotIn("GH_TOKEN", job_environment.group(1))
|
||||
before, final = text.split(" - name: Re-download, verify signatures/metadata/assets and explicitly publish\n", 1)
|
||||
self.assertNotIn("GH_TOKEN", before)
|
||||
self.assertIn("GH_TOKEN: ${{ github.token }}", final)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in New Issue
Block a user