mirror of
https://github.com/github/codeql-action.git
synced 2026-08-05 13:02:04 -05:00
Michael B. Gale
102 lines
3.3 KiB
YAML
Generated
102 lines
3.3 KiB
YAML
Generated
# Warning: This file is generated automatically, and should not be modified.
|
|
# Instead, please modify the template in the pr-checks directory and run:
|
|
# pr-checks/sync.sh
|
|
# to regenerate this file.
|
|
|
|
name: PR Check - Proxy test
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GO111MODULE: auto
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- releases/v*
|
|
pull_request: {}
|
|
merge_group:
|
|
types:
|
|
- checks_requested
|
|
schedule:
|
|
- cron: '0 5 * * *'
|
|
workflow_dispatch:
|
|
inputs: {}
|
|
workflow_call:
|
|
inputs: {}
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
concurrency:
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
|
|
group: global-proxy-${{github.ref}}
|
|
jobs:
|
|
global-proxy:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: ubuntu-latest
|
|
version: linked
|
|
- os: ubuntu-latest
|
|
version: nightly-latest
|
|
name: Proxy test
|
|
if: github.triggering_actor != 'dependabot[bot]'
|
|
permissions:
|
|
contents: read
|
|
security-events: read
|
|
timeout-minutes: 45
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Prepare test
|
|
id: prepare-test
|
|
uses: ./.github/actions/prepare-test
|
|
with:
|
|
version: ${{ matrix.version }}
|
|
use-all-platform-bundle: 'false'
|
|
setup-kotlin: 'false'
|
|
- name: Block direct internet access to force proxy usage
|
|
run: |
|
|
apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1
|
|
PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
|
|
echo "Squid proxy IP: $PROXY_IP"
|
|
# Allow all traffic to the proxy container
|
|
iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT
|
|
# Allow DNS resolution
|
|
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
|
|
# Allow loopback
|
|
iptables -A OUTPUT -o lo -j ACCEPT
|
|
# Allow already-established connections (from checkout/prepare-test)
|
|
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
# Block all other outbound HTTP and HTTPS, ensuring direct access fails
|
|
iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
|
|
iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
|
|
echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy"
|
|
|
|
- name: Set proxy environment variables
|
|
shell: bash
|
|
run: |
|
|
echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
|
|
echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
|
|
echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
|
|
echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
|
|
|
|
- uses: ./../action/init
|
|
with:
|
|
languages: javascript
|
|
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
|
|
|
- uses: ./../action/analyze
|
|
env:
|
|
CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true
|
|
CODEQL_ACTION_TEST_MODE: true
|
|
container:
|
|
image: ubuntu:22.04
|
|
options: --cap-add=NET_ADMIN
|
|
services:
|
|
squid-proxy:
|
|
image: ubuntu/squid:latest
|
|
ports:
|
|
- 3128:3128
|