auth/.github/workflows/security.yml at master · bnecko/auth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: security

on:
  pull_request:
  push:
    branches:
      - master

jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    env:
      DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres
      REDIS_URL: redis://localhost:6379
      AUTH_BASE_URL: http://localhost:3000
      OIDC_KEY_ID: ci
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: |
          openssl genrsa 2048 > /tmp/oidc.pem
          {
            echo "OIDC_PRIVATE_KEY_PEM<<EOF"
            cat /tmp/oidc.pem
            echo "EOF"
          } >> "$GITHUB_ENV"
      - run: npm ci
      - run: npm audit --omit=dev --audit-level=high
      - run: npm run public:hygiene
      - run: npm run migrate
      - run: npm run typecheck
      - run: npm run test:run
      - run: npm run migrate:smoke
      - run: npm run build
      - run: docker build --target runner -t auth-runner:ci .
      - run: docker build --target worker .
      - run: docker build -t auth-bot:ci ./bot && docker run --rm auth-bot:ci node -e "import('./status.js')"
      # The image that ships is the one under test: nonce CSP, HSTS, the
      # standalone server and migrate-on-boot only exist in production mode.
      # --network host lets the container reach the service containers on
      # localhost and lets Playwright reach it on 127.0.0.1:3000. The
      # Turnstile pair is Cloudflare's documented always-pass test keypair.
      - name: Boot the runner image
        run: |
          docker run -d --name auth-runner --network host \
            -e DATABASE_URL -e REDIS_URL -e OIDC_PRIVATE_KEY_PEM -e OIDC_KEY_ID \
            -e AUTH_BASE_URL=http://127.0.0.1:3000 \
            -e OAUTH_CSRF_SECRET=ci-oauth-csrf-secret \
            -e TELEGRAM_BOT_WEBHOOK_SECRET=ci-telegram-webhook-secret \
            -e TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA \
            -e TURNSTILE_SITE_KEY=1x00000000000000000000AA \
            auth-runner:ci
      - run: npx playwright install --with-deps chromium
      - name: Wait for the runner to be ready
        run: |
          for i in $(seq 1 45); do
            if curl -fsS http://127.0.0.1:3000/api/health/ready; then exit 0; fi
            sleep 2
          done
          echo "runner image did not become ready" >&2
          docker logs auth-runner
          exit 1
      - run: npm run test:e2e
        env:
          PLAYWRIGHT_BASE_URL: http://127.0.0.1:3000
      # Runs on any earlier failure, including ones before the container exists.
      - if: failure()
        run: docker logs auth-runner 2>/dev/null || true
      - if: always()
        run: docker rm -f auth-runner

  monitor:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: monitor
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: monitor/package-lock.json
      - run: npm ci
      # typecheck regenerates worker-configuration.d.ts from wrangler.jsonc (it
      # is not committed) before tsc; `wrangler deploy --dry-run` bundles the
      # Worker without publishing and needs no credentials.
      - run: npm run typecheck
      - run: npm test
      - run: npx wrangler deploy --dry-run --outdir /tmp/bundle

  sdk:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # The full engines range: the floor the package claims, plus the
        # current LTS lines.
        node-version: ["18.17", "20", "22"]
    defaults:
      run:
        working-directory: sdk/node
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
          cache-dependency-path: sdk/node/package-lock.json
      - run: npm ci
      - run: npm run typecheck
      - run: npm test
      - run: npm run test:pack