feat(execd): add filesystem execution identity core #2086
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Egress Tests | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| uses: ./.github/workflows/detect-changes.yml | |
| with: | |
| area: egress | |
| test: | |
| needs: changes | |
| if: needs.changes.outputs.relevant == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25.9' | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.10' | |
| - name: Install mitmproxy | |
| run: pip install mitmproxy==11.0.2 | |
| - name: Check gofmt | |
| working-directory: components/egress | |
| run: | | |
| files="$(gofmt -l . ../internal)" | |
| if [ -n "$files" ]; then | |
| echo "$files" | |
| exit 1 | |
| fi | |
| - name: Run Build | |
| working-directory: components/egress | |
| run: | | |
| go vet ./... | |
| go build . | |
| - name: Run tests | |
| working-directory: components/egress | |
| run: | | |
| go test ./... | |
| - name: Run timed nft element regression | |
| working-directory: components/egress | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y nftables | |
| go test -c -o /tmp/egress-nft.test ./pkg/nftables | |
| sudo env OPENSANDBOX_NFT_TEST=1 /tmp/egress-nft.test -test.run '^TestDynamicElementRenewal$' -test.v | |
| - name: Run mitmscripts unit and runtime tests | |
| working-directory: components/egress | |
| run: | | |
| python -m unittest discover -v -s tests -p "test_*.py" | |
| smoke: | |
| needs: changes | |
| if: needs.changes.outputs.relevant == 'true' | |
| runs-on: self-hosted | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Clean Docker runner cache | |
| run: bash scripts/ci-docker-cleanup.sh | |
| - name: Run dns test | |
| working-directory: components/egress | |
| run: | | |
| chmod +x tests/smoke-dns.sh | |
| ./tests/smoke-dns.sh | |
| - name: Run nft test | |
| working-directory: components/egress | |
| run: | | |
| chmod +x tests/smoke-nft.sh | |
| ./tests/smoke-nft.sh | |
| - name: Run dynamic ip test | |
| working-directory: components/egress | |
| run: | | |
| chmod +x tests/smoke-dynamic-ip.sh | |
| ./tests/smoke-dynamic-ip.sh | |
| - name: Run dns upstream probe test | |
| working-directory: components/egress | |
| run: | | |
| chmod +x tests/smoke-dns-upstream-probe.sh | |
| ./tests/smoke-dns-upstream-probe.sh | |
| - name: Run dns upstream blackhole test | |
| working-directory: components/egress | |
| run: | | |
| chmod +x tests/smoke-dns-upstream-blackhole.sh | |
| ./tests/smoke-dns-upstream-blackhole.sh | |
| - name: Upload blackhole smoke egress log | |
| if: failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: blackhole-smoke-egress-log | |
| path: components/egress/tests/egress-smoke-dns-upstream-blackhole.egress.log | |
| retention-days: 5 | |
| fast-sandbox-smoke: | |
| needs: changes | |
| if: needs.changes.outputs.relevant == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25.9' | |
| - name: Install nftables | |
| run: sudo apt-get update && sudo apt-get install -y nftables | |
| - name: Install mitmproxy (MITM smoke phase, mirrors the egress image) | |
| run: | | |
| sudo apt-get install -y python3-venv | |
| sudo useradd -r -u 10042 -d /var/lib/mitmproxy -s /usr/sbin/nologin mitmproxy | |
| sudo python3 -m venv /opt/mitmproxy | |
| sudo /opt/mitmproxy/bin/pip install --no-cache-dir 'mitmproxy==11.0.2' | |
| sudo ln -sf /opt/mitmproxy/bin/mitmdump /usr/local/bin/mitmdump | |
| - name: Run fast-sandbox profile smoke test (dns+nft+mitm) | |
| working-directory: components/egress | |
| run: | | |
| chmod +x tests/smoke-fast-sandbox.sh | |
| sudo env "PATH=$PATH" ./tests/smoke-fast-sandbox.sh | |
| - name: Upload fast-sandbox egress logs | |
| if: failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: fast-sandbox-egress-log | |
| path: /tmp/fast-sandbox-egress.log | |
| retention-days: 5 | |
| required: | |
| name: Egress CI | |
| if: always() | |
| needs: [changes, test, smoke, fast-sandbox-smoke] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify required jobs | |
| env: | |
| RELEVANT: ${{ needs.changes.outputs.relevant }} | |
| CHANGES_RESULT: ${{ needs.changes.result }} | |
| TEST_RESULT: ${{ needs.test.result }} | |
| SMOKE_RESULT: ${{ needs.smoke.result }} | |
| FAST_SANDBOX_SMOKE_RESULT: ${{ needs.fast-sandbox-smoke.result }} | |
| run: | | |
| if [[ "$CHANGES_RESULT" != "success" ]]; then | |
| echo "Change detection failed: $CHANGES_RESULT" | |
| exit 1 | |
| fi | |
| if [[ "$RELEVANT" == "true" ]]; then | |
| [[ "$TEST_RESULT" == "success" && "$SMOKE_RESULT" == "success" && "$FAST_SANDBOX_SMOKE_RESULT" == "success" ]] | |
| else | |
| [[ "$RELEVANT" == "false" && "$TEST_RESULT" == "skipped" && "$SMOKE_RESULT" == "skipped" && "$FAST_SANDBOX_SMOKE_RESULT" == "skipped" ]] | |
| fi |