Skip to content

fix(release): reject unreadable workflows in action pin checks #443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mikevillari wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(release): reject unreadable workflows in action pin checks #443

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions tests/release/release-rehearsal.test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,10 @@ assert_action_pins() {

uses_count=0
for workflow in "${workflows[@]}"; do
[ -r "$workflow" ] || {
printf 'FAIL: cannot read %s\n' "$workflow" >&2
return 1
}
while IFS= read -r uses_line; do
[ -n "$uses_line" ] || continue
uses_count=$((uses_count + 1))
Expand Down Expand Up @@ -163,6 +167,31 @@ if pin_output="$(assert_action_pins "$pin_fixture/workflows" 1 2>&1)"; then
exit 1
fi
grep -Fq 'extraction is broken, not the workflows' <<<"$pin_output"
# Discovery must fail with its own diagnostic, even when the count floor is zero.
mkdir "$pin_fixture/empty"
if pin_output="$(assert_action_pins "$pin_fixture/empty" 0 2>&1)"; then
printf 'FAIL: pin check passed over an empty workflow directory\n' >&2
exit 1
fi
grep -Fxq "FAIL: no workflow files matched under $pin_fixture/empty" <<<"$pin_output"

# The readable workflow clears the floor on its own: a skipped file must not
# masquerade as a workflow with no uses. Root bypasses mode 000 permissions.
if (( EUID == 0 )); then
printf 'SKIP: unreadable workflow fixture requires a non-root user\n' >&2
else
mkdir "$pin_fixture/unreadable"
printf ' uses: ./.github/workflows/local.yml\n' > "$pin_fixture/unreadable/readable.yml"
cp "$pin_fixture/unreadable/readable.yml" "$pin_fixture/unreadable/blocked.yaml"
assert_action_pins "$pin_fixture/unreadable" 1
chmod 000 "$pin_fixture/unreadable/blocked.yaml"
if pin_output="$(assert_action_pins "$pin_fixture/unreadable" 1 2>&1)"; then
printf 'FAIL: pin check passed over an unreadable workflow\n' >&2
exit 1
fi
grep -Fxq "FAIL: cannot read $pin_fixture/unreadable/blocked.yaml" <<<"$pin_output"
fi

if grep -Fq -- '--no-verify' "$release_workflow"; then
printf 'FAIL: release publication skips generated crate verification\n' >&2
exit 1
Expand Down
Loading