Improve global proxy tests #2718
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Warning: This file is generated automatically, and should not be modified. | |
| # Instead, please modify the template in the pr-checks directory and run: | |
| # pr-checks/sync.sh | |
| # to regenerate this file. | |
| name: PR Check - Proxy test | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GO111MODULE: auto | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - releases/v* | |
| pull_request: {} | |
| merge_group: | |
| types: | |
| - checks_requested | |
| schedule: | |
| - cron: '0 5 * * *' | |
| workflow_dispatch: | |
| inputs: {} | |
| workflow_call: | |
| inputs: {} | |
| defaults: | |
| run: | |
| shell: bash | |
| concurrency: | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} | |
| group: global-proxy-${{github.ref}} | |
| jobs: | |
| global-proxy: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| version: linked | |
| - os: ubuntu-latest | |
| version: nightly-latest | |
| name: Proxy test | |
| if: github.triggering_actor != 'dependabot[bot]' | |
| permissions: | |
| contents: read | |
| security-events: read | |
| timeout-minutes: 45 | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Prepare test | |
| id: prepare-test | |
| uses: ./.github/actions/prepare-test | |
| with: | |
| version: ${{ matrix.version }} | |
| use-all-platform-bundle: 'false' | |
| setup-kotlin: 'false' | |
| - name: Block direct internet access to force proxy usage | |
| run: | | |
| apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 | |
| PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') | |
| echo "Squid proxy IP: $PROXY_IP" | |
| # Allow all traffic to the proxy container | |
| iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT | |
| # Allow DNS resolution | |
| iptables -A OUTPUT -p udp --dport 53 -j ACCEPT | |
| iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT | |
| # Allow loopback | |
| iptables -A OUTPUT -o lo -j ACCEPT | |
| # Allow already-established connections (from checkout/prepare-test) | |
| iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT | |
| # Block all other outbound HTTP and HTTPS, ensuring direct access fails | |
| iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset | |
| iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset | |
| echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" | |
| - name: Set proxy environment variables | |
| shell: bash | |
| run: | | |
| echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV | |
| echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV | |
| echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV | |
| echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV | |
| - uses: ./../action/init | |
| with: | |
| languages: javascript | |
| tools: ${{ steps.prepare-test.outputs.tools-url }} | |
| - uses: ./../action/analyze | |
| env: | |
| CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true | |
| CODEQL_ACTION_TEST_MODE: true | |
| container: | |
| image: ubuntu:22.04 | |
| options: --cap-add=NET_ADMIN | |
| services: | |
| squid-proxy: | |
| image: ubuntu/squid:latest | |
| ports: | |
| - 3128:3128 |