fix: close the 3 remaining review findings (config_hash mask, podman … #264
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: acceptance | |
| # Runs the sluice gate bats suites on Linux. The Docker job is the gate; the rootless Podman | |
| # job is best-effort (informational): it probes whether a user namespace allows the | |
| # route_localnet / disable_ipv6 sysctls + in-netns iptables the egress proxy needs. Rootful | |
| # Podman is unsupported - its netavark backend breaks the box's dnsmasq (see ROADMAP #2). | |
| on: | |
| push: | |
| branches: [main] # branch pushes run via pull_request below; this avoids double runs | |
| pull_request: | |
| permissions: | |
| contents: read # least privilege: these jobs only read the repo | |
| jobs: | |
| lint: | |
| name: lint (shellcheck) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: bin/sluice is in sync with src/ (assembled launcher) | |
| run: make build-check | |
| - name: shellcheck (gate) | |
| run: shellcheck -S warning bin/sluice # shellcheck is preinstalled on ubuntu runners | |
| structure: | |
| name: base image invariants (container-structure-test) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Build the base stage | |
| # Retry: the BuildKit syntax frontend + base layers pull from registries that occasionally | |
| # time out on shared runners (a transient Docker Hub i/o timeout, not a Dockerfile problem). | |
| # `timeout` caps each attempt so a single hung pull yields to the next one instead of eating | |
| # the job budget; set -euo pipefail so any non-build error in the step fails loudly. | |
| run: | | |
| set -euo pipefail | |
| for i in 1 2 3; do | |
| if timeout 240 docker build --target base -t sluice-base:gate core/; then exit 0; fi | |
| echo "::warning::base build attempt $i failed or timed out; retrying" | |
| sleep $((i * 10)) | |
| done | |
| echo "::error::base build failed after 3 attempts" | |
| exit 1 | |
| - name: Install container-structure-test (pinned, checksummed) | |
| run: bash scripts/install-cst.sh | |
| - name: Assert baked invariants (no sudo, uid 1000, firewall packages) | |
| run: container-structure-test test --image sluice-base:gate --config test/structure.yaml | |
| unit: | |
| name: unit suites (no Docker) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: { submodules: recursive, persist-credentials: false } | |
| - name: init detection, CLI surface, doctor scans, agent scaffold, installer, laundering gate | |
| run: make test-unit # the engine-free lane; membership lives in the Makefile (UNIT_BATS) | |
| docker: | |
| name: Linux, Docker | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: { submodules: recursive, persist-credentials: false } | |
| - name: Acceptance tests (egress/run matrix) | |
| run: make test-acceptance | |
| security: | |
| name: security escape-hatches (Docker) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: { submodules: recursive, persist-credentials: false } | |
| - name: Verify the danger knobs (mask, seccomp, readonly, workspace/apply, doh, allow-ips, ...) | |
| run: make test-security | |
| podman-rootless: | |
| name: Linux, Podman (rootless, best-effort) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: { submodules: recursive, persist-credentials: false } | |
| - name: Install + configure rootless podman | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y podman uidmap slirp4netns | |
| # subuid/subgid for the unprivileged runner user (the user namespace needs them). | |
| u="$(id -un)" | |
| grep -q "^$u:" /etc/subuid || echo "$u:100000:65536" | sudo tee -a /etc/subuid | |
| grep -q "^$u:" /etc/subgid || echo "$u:100000:65536" | sudo tee -a /etc/subgid | |
| podman system migrate || true | |
| echo "rootless: $(podman info --format '{{.Host.Security.Rootless}}' 2>/dev/null)" | |
| - name: Acceptance tests (rootless Podman) | |
| # No sudo: runs in the user namespace. The egress proxy needs route_localnet / | |
| # disable_ipv6 sysctls + in-netns iptables - this job reports whether rootless allows | |
| # them. The egress allow/deny/IPv6/non-root matrix is the signal. | |
| run: SLUICE_ENGINE=podman make test-acceptance |