mirror of
https://github.com/actions/cache.git
synced 2026-02-11 11:48:18 +00:00
Compare commits
1 Commits
main
...
e9ad5a287d
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e9ad5a287d |
146
.github/workflows/workflow.yml
vendored
146
.github/workflows/workflow.yml
vendored
@@ -90,86 +90,15 @@ jobs:
|
|||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
container:
|
container:
|
||||||
image: ubuntu:latest
|
image: ubuntu:latest
|
||||||
options: --cap-add=NET_ADMIN
|
options: --dns 127.0.0.1
|
||||||
services:
|
services:
|
||||||
squid-proxy:
|
squid-proxy:
|
||||||
image: ubuntu/squid:latest
|
image: ubuntu/squid:latest
|
||||||
ports:
|
ports:
|
||||||
- 3128:3128
|
- 3128:3128
|
||||||
env:
|
env:
|
||||||
http_proxy: http://squid-proxy:3128
|
|
||||||
https_proxy: http://squid-proxy:3128
|
https_proxy: http://squid-proxy:3128
|
||||||
steps:
|
steps:
|
||||||
- name: Wait for proxy to be ready
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
echo "Waiting for squid proxy to be ready..."
|
|
||||||
echo "Resolving squid-proxy hostname:"
|
|
||||||
getent hosts squid-proxy || echo "DNS resolution failed"
|
|
||||||
for i in $(seq 1 30); do
|
|
||||||
if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then
|
|
||||||
echo "Proxy is ready!"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
echo "Attempt $i: Proxy not ready, waiting..."
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
echo "Proxy failed to become ready"
|
|
||||||
exit 1
|
|
||||||
env:
|
|
||||||
http_proxy: ""
|
|
||||||
https_proxy: ""
|
|
||||||
- name: Install dependencies
|
|
||||||
run: |
|
|
||||||
apt-get update
|
|
||||||
apt-get install -y iptables curl
|
|
||||||
- name: Verify proxy is working
|
|
||||||
run: |
|
|
||||||
echo "Testing proxy connectivity..."
|
|
||||||
curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true
|
|
||||||
echo "Proxy verification complete"
|
|
||||||
- name: Block direct traffic (enforce proxy usage)
|
|
||||||
run: |
|
|
||||||
# Get the squid-proxy container IP
|
|
||||||
PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
|
|
||||||
echo "Proxy IP: $PROXY_IP"
|
|
||||||
|
|
||||||
# Allow loopback traffic
|
|
||||||
iptables -A OUTPUT -o lo -j ACCEPT
|
|
||||||
|
|
||||||
# Allow traffic to the proxy container
|
|
||||||
iptables -A OUTPUT -d $PROXY_IP -j ACCEPT
|
|
||||||
|
|
||||||
# Allow established connections
|
|
||||||
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
||||||
|
|
||||||
# Allow DNS (needed for initial resolution)
|
|
||||||
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
|
|
||||||
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
|
|
||||||
|
|
||||||
# Block all other outbound traffic (HTTP/HTTPS)
|
|
||||||
iptables -A OUTPUT -p tcp --dport 80 -j REJECT
|
|
||||||
iptables -A OUTPUT -p tcp --dport 443 -j REJECT
|
|
||||||
|
|
||||||
# Log the iptables rules for debugging
|
|
||||||
iptables -L -v -n
|
|
||||||
- name: Verify direct HTTPS is blocked
|
|
||||||
run: |
|
|
||||||
echo "Testing that direct HTTPS requests fail..."
|
|
||||||
if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then
|
|
||||||
echo "ERROR: Direct HTTPS request succeeded - blocking is not working!"
|
|
||||||
exit 1
|
|
||||||
else
|
|
||||||
echo "SUCCESS: Direct HTTPS request was blocked as expected"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Testing that HTTPS through proxy succeeds..."
|
|
||||||
if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then
|
|
||||||
echo "SUCCESS: HTTPS request through proxy succeeded"
|
|
||||||
else
|
|
||||||
echo "ERROR: HTTPS request through proxy failed!"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v5
|
uses: actions/checkout@v5
|
||||||
- name: Generate files
|
- name: Generate files
|
||||||
@@ -185,86 +114,15 @@ jobs:
|
|||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
container:
|
container:
|
||||||
image: ubuntu:latest
|
image: ubuntu:latest
|
||||||
options: --cap-add=NET_ADMIN
|
options: --dns 127.0.0.1
|
||||||
services:
|
services:
|
||||||
squid-proxy:
|
squid-proxy:
|
||||||
image: ubuntu/squid:latest
|
image: ubuntu/squid:latest
|
||||||
ports:
|
ports:
|
||||||
- 3128:3128
|
- 3128:3128
|
||||||
env:
|
env:
|
||||||
http_proxy: http://squid-proxy:3128
|
|
||||||
https_proxy: http://squid-proxy:3128
|
https_proxy: http://squid-proxy:3128
|
||||||
steps:
|
steps:
|
||||||
- name: Wait for proxy to be ready
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
echo "Waiting for squid proxy to be ready..."
|
|
||||||
echo "Resolving squid-proxy hostname:"
|
|
||||||
getent hosts squid-proxy || echo "DNS resolution failed"
|
|
||||||
for i in $(seq 1 30); do
|
|
||||||
if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then
|
|
||||||
echo "Proxy is ready!"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
echo "Attempt $i: Proxy not ready, waiting..."
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
echo "Proxy failed to become ready"
|
|
||||||
exit 1
|
|
||||||
env:
|
|
||||||
http_proxy: ""
|
|
||||||
https_proxy: ""
|
|
||||||
- name: Install dependencies
|
|
||||||
run: |
|
|
||||||
apt-get update
|
|
||||||
apt-get install -y iptables curl
|
|
||||||
- name: Verify proxy is working
|
|
||||||
run: |
|
|
||||||
echo "Testing proxy connectivity..."
|
|
||||||
curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true
|
|
||||||
echo "Proxy verification complete"
|
|
||||||
- name: Block direct traffic (enforce proxy usage)
|
|
||||||
run: |
|
|
||||||
# Get the squid-proxy container IP
|
|
||||||
PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
|
|
||||||
echo "Proxy IP: $PROXY_IP"
|
|
||||||
|
|
||||||
# Allow loopback traffic
|
|
||||||
iptables -A OUTPUT -o lo -j ACCEPT
|
|
||||||
|
|
||||||
# Allow traffic to the proxy container
|
|
||||||
iptables -A OUTPUT -d $PROXY_IP -j ACCEPT
|
|
||||||
|
|
||||||
# Allow established connections
|
|
||||||
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
||||||
|
|
||||||
# Allow DNS (needed for initial resolution)
|
|
||||||
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
|
|
||||||
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
|
|
||||||
|
|
||||||
# Block all other outbound traffic (HTTP/HTTPS)
|
|
||||||
iptables -A OUTPUT -p tcp --dport 80 -j REJECT
|
|
||||||
iptables -A OUTPUT -p tcp --dport 443 -j REJECT
|
|
||||||
|
|
||||||
# Log the iptables rules for debugging
|
|
||||||
iptables -L -v -n
|
|
||||||
- name: Verify direct HTTPS is blocked
|
|
||||||
run: |
|
|
||||||
echo "Testing that direct HTTPS requests fail..."
|
|
||||||
if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then
|
|
||||||
echo "ERROR: Direct HTTPS request succeeded - blocking is not working!"
|
|
||||||
exit 1
|
|
||||||
else
|
|
||||||
echo "SUCCESS: Direct HTTPS request was blocked as expected"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Testing that HTTPS through proxy succeeds..."
|
|
||||||
if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then
|
|
||||||
echo "SUCCESS: HTTPS request through proxy succeeded"
|
|
||||||
else
|
|
||||||
echo "ERROR: HTTPS request through proxy failed!"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v5
|
uses: actions/checkout@v5
|
||||||
- name: Restore cache
|
- name: Restore cache
|
||||||
|
|||||||
5474
package-lock.json
generated
5474
package-lock.json
generated
File diff suppressed because it is too large
Load Diff
@@ -29,7 +29,7 @@
|
|||||||
"@actions/io": "^2.0.0"
|
"@actions/io": "^2.0.0"
|
||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@types/jest": "^29.5.14",
|
"@types/jest": "^30.0.0",
|
||||||
"@types/nock": "^11.1.0",
|
"@types/nock": "^11.1.0",
|
||||||
"@types/node": "^24.1.0",
|
"@types/node": "^24.1.0",
|
||||||
"@typescript-eslint/eslint-plugin": "^7.2.0",
|
"@typescript-eslint/eslint-plugin": "^7.2.0",
|
||||||
@@ -41,7 +41,7 @@
|
|||||||
"eslint-plugin-jest": "^27.9.0",
|
"eslint-plugin-jest": "^27.9.0",
|
||||||
"eslint-plugin-prettier": "^5.5.3",
|
"eslint-plugin-prettier": "^5.5.3",
|
||||||
"eslint-plugin-simple-import-sort": "^12.1.1",
|
"eslint-plugin-simple-import-sort": "^12.1.1",
|
||||||
"jest": "^29.7.0",
|
"jest": "^30.2.0",
|
||||||
"jest-circus": "^29.7.0",
|
"jest-circus": "^29.7.0",
|
||||||
"nock": "^13.2.9",
|
"nock": "^13.2.9",
|
||||||
"prettier": "^3.6.2",
|
"prettier": "^3.6.2",
|
||||||
|
|||||||
Reference in New Issue
Block a user