docs: More details in the plugin catalog #1934
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI - Lint, test, and build for all modules | |
| # | |
| # Runs on PRs and pushes to main/release branches. | |
| # Covers the AuthProxy Go module and Python tests. | |
| # | |
| name: CI | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - "release-*" | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| pre-commit: | |
| name: Pre-commit Checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: authbridge/authlib/go.mod | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.12' | |
| - name: Run pre-commit | |
| uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 | |
| # TODO: Remove continue-on-error after fixing pre-existing style issues repo-wide | |
| continue-on-error: true | |
| env: | |
| SKIP: ai-assisted-by-trailer | |
| go-ci-authlib: | |
| name: Go CI (authlib) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: authbridge/authlib | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: authbridge/authlib/go.mod | |
| cache-dependency-path: authbridge/authlib/go.sum | |
| - name: Lint | |
| run: | | |
| go fmt ./... | |
| go vet ./... | |
| - name: Build | |
| run: go build -v ./... | |
| - name: Test | |
| run: go test -v -race -cover ./... | |
| go-ci-authbridge-cmd: | |
| name: Go CI (authbridge ${{ matrix.binary }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| binary: | |
| - authbridge-proxy | |
| - authbridge-envoy | |
| defaults: | |
| run: | |
| working-directory: authbridge/cmd/${{ matrix.binary }} | |
| env: | |
| # Disable go.work so each cmd/* module resolves authlib via its own | |
| # `replace` directive in go.mod (the workspace would otherwise pull | |
| # all sibling modules in and slow down CI). | |
| GOWORK: "off" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: authbridge/cmd/${{ matrix.binary }}/go.mod | |
| cache-dependency-path: authbridge/cmd/${{ matrix.binary }}/go.sum | |
| - name: Lint | |
| run: | | |
| go fmt ./... | |
| go vet ./... | |
| - name: Build | |
| run: go build -v ./... | |
| # The authbridge-lite image is this same authbridge-proxy binary built | |
| # with exclude_plugin_* tags (only jwt-validation + token-exchange). | |
| # Build AND test that tag set on every PR — build.yaml only exercises | |
| # it on tag/main pushes, and this guards against lite-only regressions. | |
| - name: Build + test lite variant (exclude_plugin_* tags) | |
| if: matrix.binary == 'authbridge-proxy' | |
| run: | | |
| TAGS="exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser" | |
| TAGS="$TAGS,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker" | |
| go build -v -tags "$TAGS" ./... | |
| go test -v -race -cover -tags "$TAGS" ./... | |
| - name: Test | |
| run: go test -v -race -cover ./... | |
| proxy-init-iptables: | |
| name: proxy-init iptables rules | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # This job runs a repo script as root via `sudo -E` and needs no git | |
| # access afterwards, so don't leave the job token in .git/config. | |
| persist-credentials: false | |
| # The harness builds its rules inside `unshare --net`, so it never touches | |
| # the runner's own networking. It needs root for unshare + iptables, the | |
| # dummy module to generate a routable external packet, and both iptables | |
| # backends so the legacy-detection case is exercised rather than skipped. | |
| - name: Install iptables backends | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y -qq iptables iproute2 kmod | |
| sudo modprobe dummy || echo "dummy module unavailable; capture packet may not be generated" | |
| # Gates the interception rules themselves: chain placement and ordering, | |
| # the DNS carve-out, the non-TCP drop, the fail-closed guards, and — for | |
| # transparent inbound — that the ambient DNAT precedes AB_REDIRECT's | |
| # ztunnel-mark RETURN. That ordering decides whether mesh-delivered traffic | |
| # is validated or waved through, and nothing else in CI covers it. | |
| - name: Test enforce-redirect + transparent inbound rules | |
| run: sudo -E authbridge/proxy-init/test-enforce-redirect.sh | |
| python-test: | |
| name: Python Tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.12' | |
| - name: Install dependencies | |
| run: | | |
| pip install pytest==8.* python-keycloak==5.3.1 pyjwt==2.10.1 pyyaml==6.* | |
| - name: Run tests | |
| run: pytest tests/ -v -x --ignore=tests/e2e |