ci.yaml

# CI - Lint, test, and build for all modules
#
# Runs on PRs and pushes to main/release branches.
# Covers the AuthProxy Go module and Python tests.
#
name: CI

on:
  pull_request:
    branches:
      - main
      - "release-*"
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  pre-commit:
    name: Pre-commit Checks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: authbridge/authlib/go.mod

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: '3.12'

      - name: Run pre-commit
        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
        # TODO: Remove continue-on-error after fixing pre-existing style issues repo-wide
        continue-on-error: true
        env:
          SKIP: ai-assisted-by-trailer

  go-ci-authlib:
    name: Go CI (authlib)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: authbridge/authlib
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: authbridge/authlib/go.mod
          cache-dependency-path: authbridge/authlib/go.sum

      - name: Lint
        run: |
          go fmt ./...
          go vet ./...

      - name: Build
        run: go build -v ./...

      - name: Test
        run: go test -v -race -cover ./...

  go-ci-authbridge-cmd:
    name: Go CI (authbridge ${{ matrix.binary }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        binary:
          - authbridge-proxy
          - authbridge-envoy
    defaults:
      run:
        working-directory: authbridge/cmd/${{ matrix.binary }}
    env:
      # Disable go.work so each cmd/* module resolves authlib via its own
      # `replace` directive in go.mod (the workspace would otherwise pull
      # all sibling modules in and slow down CI).
      GOWORK: "off"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: authbridge/cmd/${{ matrix.binary }}/go.mod
          cache-dependency-path: authbridge/cmd/${{ matrix.binary }}/go.sum

      - name: Lint
        run: |
          go fmt ./...
          go vet ./...

      - name: Build
        run: go build -v ./...

      # The authbridge-lite image is this same authbridge-proxy binary built
      # with exclude_plugin_* tags (only jwt-validation + token-exchange).
      # Build AND test that tag set on every PR — build.yaml only exercises
      # it on tag/main pushes, and this guards against lite-only regressions.
      - name: Build + test lite variant (exclude_plugin_* tags)
        if: matrix.binary == 'authbridge-proxy'
        run: |
          TAGS="exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser"
          TAGS="$TAGS,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker"
          TAGS="$TAGS,exclude_plugin_toolprune"
          go build -v -tags "$TAGS" ./...
          go test -v -race -cover -tags "$TAGS" ./...

      - name: Test
        run: go test -v -race -cover ./...

  proxy-init-iptables:
    name: proxy-init iptables rules
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # This job runs a repo script as root via `sudo -E` and needs no git
          # access afterwards, so don't leave the job token in .git/config.
          persist-credentials: false

      # The harness builds its rules inside `unshare --net`, so it never touches
      # the runner's own networking. It needs root for unshare + iptables, the
      # dummy module to generate a routable external packet, and both iptables
      # backends so the legacy-detection case is exercised rather than skipped.
      - name: Install iptables backends
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq iptables iproute2 kmod
          sudo modprobe dummy || echo "dummy module unavailable; capture packet may not be generated"

      # Gates the interception rules themselves: chain placement and ordering,
      # the DNS carve-out, the non-TCP drop, the fail-closed guards, and — for
      # transparent inbound — that the ambient DNAT precedes AB_REDIRECT's
      # ztunnel-mark RETURN. That ordering decides whether mesh-delivered traffic
      # is validated or waved through, and nothing else in CI covers it.
      - name: Test enforce-redirect + transparent inbound rules
        run: sudo -E authbridge/proxy-init/test-enforce-redirect.sh

  python-test:
    name: Python Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          pip install pytest==8.* python-keycloak==5.3.1 pyjwt==2.10.1 pyyaml==6.*

      - name: Run tests
        run: pytest tests/ -v -x --ignore=tests/e2e