feat: optional header-trust auth with per-user session isolation #390
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| backend: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.9", "3.12"] | |
| # `with` exercises the encrypted-flow tests; `without` asserts | |
| # the 501 gate path so a deploy without cryptography stays sane. | |
| crypto: ["with", "without"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - if: matrix.crypto == 'with' | |
| run: pip install 'cryptography>=42' | |
| - run: python -m unittest discover -s tests/backend -t . -v | |
| frontend: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Install deps | |
| working-directory: tests/frontend | |
| run: npm install --no-audit --no-fund | |
| - name: Run frontend tests | |
| working-directory: tests/frontend | |
| run: node test_connect.js | |
| php-lint: | |
| # The PHP proxy shipped untested — not even syntax-checked. The | |
| # ubuntu-latest runner image includes the PHP CLI (with curl). | |
| # The behavioral smoke boots api.php under `php -S` against an echo | |
| # backend and asserts the proxy contract: method/query/body | |
| # passthrough, X-Forwarded-For injection, save_delete POST→DELETE. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: php -l api.php | |
| run: php -l api.php | |
| - name: Behavioral smoke (php -S vs echo backend) | |
| run: bash tests/php/smoke.sh | |
| ruff: | |
| # Correctness-only families (F/E9/B/PLE — see ruff.toml); style | |
| # rules are deliberately off so real findings aren't buried in | |
| # churn on a codebase that predates the linter. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - run: pip install 'ruff==0.15.*' | |
| - run: ruff check . | |
| docker: | |
| # The image could break (bad base rebase, missing COPY) without CI | |
| # noticing. Build it and smoke-test that the container boots and the | |
| # backend answers /api/ping. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build image | |
| run: docker build -t websh . | |
| - name: Boot + ping | |
| run: | | |
| docker run -d --name websh -p 127.0.0.1:8765:8765 websh | |
| ok= | |
| for i in $(seq 1 20); do | |
| if curl -fsS http://127.0.0.1:8765/api/ping >/dev/null 2>&1; then | |
| ok=1; break | |
| fi | |
| sleep 1 | |
| done | |
| # Beyond liveness: config must be JSON with the expected keys | |
| # (a broken websh.json default or missing env shows up here), | |
| # and the static bundle must actually be served. | |
| cfg= | |
| page= | |
| if [ -n "$ok" ]; then | |
| curl -fsS http://127.0.0.1:8765/api/config | grep -q '"restrict_hosts"' && cfg=1 | |
| curl -fsS http://127.0.0.1:8765/ | grep -qi '<title>' && page=1 | |
| fi | |
| docker logs websh | |
| docker rm -f websh >/dev/null | |
| test -n "$ok" || { echo "backend never answered /api/ping"; exit 1; } | |
| test -n "$cfg" || { echo "/api/config missing or malformed"; exit 1; } | |
| test -n "$page" || { echo "static index not served"; exit 1; } |