ci: add Socket Firewall (SFW) composite action and test workflow #250
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,124 @@ | ||
| name: Setup Socket Firewall (SFW) | ||
| description: > | ||
| Installs and configures Socket Firewall to monitor package installations. | ||
| On bare-metal Linux runners, installs via socketdev/action with MITM proxy | ||
| and CA cert trust. Inside containers, installs the sfw CLI via npm. | ||
| Skips on macOS/Windows where the MITM proxy is incompatible. | ||
|
|
||
| inputs: | ||
| mode: | ||
| description: 'SFW mode: "firewall" blocks risky packages, "audit" only warns' | ||
| required: false | ||
| default: 'firewall' | ||
|
|
||
| outputs: | ||
| available: | ||
| description: 'Whether SFW is available for use (true/false)' | ||
| value: ${{ steps.set-prefix.outputs.available }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Detect platform support | ||
| id: detect | ||
| shell: bash | ||
| run: | | ||
| # SFW's MITM proxy is only compatible with Linux TLS stacks. | ||
| # macOS (LibreSSL) and Windows (Schannel) reject the SFW cert | ||
| # at the crypto level — not a CA trust issue. | ||
| if [[ "$RUNNER_OS" != "Linux" ]]; then | ||
| echo "::notice::SFW skipped: MITM proxy not compatible with $RUNNER_OS TLS stack" | ||
| echo "method=none" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
|
|
||
| # Inside containers, the socketdev/action MITM proxy doesn't work, | ||
| # but the sfw CLI wrapper can be installed directly via npm. | ||
| # (GitHub sets 'container' env var for container jobs; | ||
| # /.dockerenv is a fallback heuristic) | ||
| if [[ -n "${container:-}" ]] || [[ -f /.dockerenv ]]; then | ||
|
Comment on lines
+37
to
+39
Contributor
There was a problem hiding this comment. The comment says "GitHub sets 'container' env var for container jobs" but GitHub Actions exposes the container configuration through the Consider simplifying to just |
||
| echo "method=npm" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
|
|
||
| echo "method=action" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Install SFW (container) | ||
| if: steps.detect.outputs.method == 'npm' | ||
| shell: bash | ||
| run: npm install -g sfw@2.0.4 | ||
|
|
||
| - name: Install SFW | ||
| if: steps.detect.outputs.method == 'action' | ||
| uses: socketdev/action@4337a545deecc20f19a909e52db7a2f6ba292f42 # v1 | ||
| with: | ||
| mode: ${{ inputs.mode }} | ||
|
|
||
| - name: Configure cargo TLS trust for SFW | ||
| if: steps.detect.outputs.method == 'action' | ||
| shell: bash | ||
| run: | | ||
| # Trigger SFW cert generation (may be lazy) | ||
| sfw npm ping > /dev/null 2>&1 || true | ||
|
|
||
| # Discover SFW CA cert path via temp file to avoid | ||
| # stdout pollution (sfw prepends/appends banner lines) | ||
| cat > "${RUNNER_TEMP}/sfw-get-cert.js" << 'SCRIPT' | ||
| const fs = require("fs"); | ||
| const p = process.env.NODE_EXTRA_CA_CERTS || ""; | ||
| fs.writeFileSync(process.env.RUNNER_TEMP + "/sfw-cert-path.txt", p); | ||
| SCRIPT | ||
| sfw node "${RUNNER_TEMP}/sfw-get-cert.js" > /dev/null 2>&1 || true | ||
| SFW_CA="" | ||
| [ -f "${RUNNER_TEMP}/sfw-cert-path.txt" ] && SFW_CA=$(cat "${RUNNER_TEMP}/sfw-cert-path.txt") | ||
| rm -f "${RUNNER_TEMP}/sfw-get-cert.js" "${RUNNER_TEMP}/sfw-cert-path.txt" | ||
|
|
||
| if [ -z "$SFW_CA" ] || [ ! -f "$SFW_CA" ]; then | ||
| echo "::warning::SFW CA cert not found — cargo may fail with SSL errors under sfw" | ||
| exit 0 | ||
|
Comment on lines
+76
to
+78
Contributor
There was a problem hiding this comment. When the SFW CA cert isn't found, this warns and exits 0, but the Consider either skipping the prefix setup on cert failure (e.g. set an output that the |
||
| fi | ||
|
|
||
| echo "SFW CA cert: $SFW_CA" | ||
| BUNDLE="${RUNNER_TEMP}/sfw-ca-bundle.pem" | ||
|
|
||
| # Find system CA bundle (Linux paths only — macOS/Windows are skipped above) | ||
| FOUND_SYSTEM=false | ||
| for f in \ | ||
| /etc/ssl/certs/ca-certificates.crt \ | ||
| /etc/ssl/certs/ca-bundle.crt \ | ||
| /etc/pki/tls/certs/ca-bundle.crt; do | ||
| if [ -f "$f" ]; then | ||
| cp "$f" "$BUNDLE" | ||
| echo "System CA bundle: $f" | ||
| FOUND_SYSTEM=true | ||
| break | ||
| fi | ||
| done | ||
|
|
||
| if [ "$FOUND_SYSTEM" = false ]; then | ||
| echo "::warning::Could not find system CA bundle — using SFW cert only" | ||
| cp "$SFW_CA" "$BUNDLE" | ||
| else | ||
| # Append SFW CA cert to system bundle | ||
| echo "" >> "$BUNDLE" | ||
| cat "$SFW_CA" >> "$BUNDLE" | ||
| fi | ||
|
|
||
| # Export for cargo, git, and rustup (SSL_CERT_FILE is needed by rustls-native-certs) | ||
| echo "CARGO_HTTP_CAINFO=$BUNDLE" >> "$GITHUB_ENV" | ||
| echo "GIT_SSL_CAINFO=$BUNDLE" >> "$GITHUB_ENV" | ||
| echo "SSL_CERT_FILE=$BUNDLE" >> "$GITHUB_ENV" | ||
| echo "CA bundle created at $BUNDLE ($(wc -l < "$BUNDLE") lines)" | ||
|
|
||
| - name: Set SFW prefix | ||
| id: set-prefix | ||
| if: steps.detect.outputs.method != 'none' | ||
|
Comment on lines
+113
to
+115
Contributor
There was a problem hiding this comment. When Either add a separate step for the |
||
| shell: bash | ||
| run: | | ||
| if command -v sfw &>/dev/null; then | ||
| echo "SFW_PREFIX=sfw" >> "$GITHUB_ENV" | ||
| echo "available=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "::warning::SFW command not found after install" | ||
| echo "available=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nebasuke marked this conversation as resolved.
Show resolved
Hide resolved
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cargo install cargo-udepsis prefixed (line 39) butcargo +nightly udeps --frozenon the next line is not. The--frozenflag means it doesn't hit the network, so this is functionally fine, but it's inconsistent with the approach inrust-unit-testswhich prefixes all cargo commands including--frozenones.