ci: harden workflows and run the runtime firewall VM test (#398)

* ci: pin actions, scope tokens, run the runtime security VM test

* test: add a just recipe for the runtime firewall VM test

.github/workflows/flake_evaltests.yml

@@ -18,6 +18,9 @@ on:
       - "**.nu"
       - "Justfile"
 
+permissions:
+  contents: read
+
 jobs:
   checks:
     name: Check expressions
@@ -25,9 +28,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
       - name: Install nix
-        uses: cachix/install-nix-action@v31
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           install_url: https://nixos.org/nix/install
           extra_nix_config: |
@@ -40,3 +43,26 @@ jobs:
           # `nix eval` prints the suite result but still exits 0 on failure, so
           # compare the JSON boolean explicitly to fail the job.
           test "$(nix eval .#evalTests --json --show-trace)" = "true"
+
+  runtime-security:
+    name: Runtime security VM tests
+    runs-on: ubuntu-latest
+    needs: checks
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - name: Install nix
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
+        with:
+          install_url: https://nixos.org/nix/install
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+      # Hosted runners have /dev/kvm but the runner user cannot open it. This
+      # udev rule hands the group mode to everyone for the job's lifetime.
+      - name: Enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+      - name: Run the firewall VM test
+        run: nix build --no-link --print-build-logs .#checks.x86_64-linux.security-exporters

.github/workflows/mirror_to_gitee.yml

@@ -6,14 +6,26 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: read
+
 jobs:
   mirror:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0
 
+      - name: Pin the Gitee host key
+        run: |
+          mkdir -p ~/.ssh
+          cat > ~/.ssh/known_hosts <<'HOSTS'
+          gitee.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKxHSJ7084RmkJ4YdEi5tngynE8aZe2uEoVVsB/OvYN
+          gitee.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMzG3r+88lWSDK9fyjcZmYsWGDBDmGoAasKMAmjoFloGt9HRQX2Qp4f9FY2XK/hsHYinvoh5Xytl9iaUNUWMfYR8q6VEMtOO87DgoAFcfKZHt0/nbAg9RoNTKYt6v8tPwYpr7N0JP/01nE4LFsNDnstr6H0bXSAzbKWCETLZfdPV4l2uSpRn3bU0ugoZ0aSKz5Dc/IloBfGCTvkSsxUydMRd/Chpjt6VxncDbp+Fa6pzsseK8OQzrg6Fgc5783EN3EQqZ2skqyCwExtx95BJlfx1B3luZnWfpkwNDnrZRT/Qx0OrWqyf0q6f9uQr+UG1S8qDcUn3e/9onq3rwBri8/
+          HOSTS
+          chmod 600 ~/.ssh/known_hosts
+
       - name: Mirror repo to Gitee
         id: mirror-to-gitee
         shell: bash
@@ -23,10 +35,9 @@ jobs:
         run: |
           set -eu
 
-          mkdir -p ~/.ssh
           echo "$INPUT_SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
 
-          export GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no"
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
           git remote add mirror "$INPUT_TARGET_REPO_URL"
           git push --tags --force --prune mirror "refs/remotes/origin/*:refs/heads/*"

Justfile

@@ -23,6 +23,12 @@ default:
 test:
   let result = (nix eval .#evalTests --json --show-trace --print-build-logs --verbose | str trim); if $result != "true" { error make { msg: $"eval tests failed: evalTests returned ($result)" } }
 
+# Build and run the runtime security VM test (needs /dev/kvm; not run by just test)
+[linux]
+[group('nix')]
+test-vm:
+  nix build --no-link --print-build-logs .#checks.x86_64-linux.security-exporters
+
 # Evaluate a NixOS host configuration without building it.
 [group('nix')]
 eval-host host:

WORKAROUNDS.md

@@ -59,9 +59,9 @@ A known limitation with no fix yet.
 
 An unfinished feature or gap.
 
-| ID     | What & where                      | Why                                                                                                      | Removal condition                                                 | Added      | Revisit   | Status |
-| ------ | --------------------------------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---------- | --------- | ------ |
-| WA-013 | NixOS tests — `outputs/README.md` | tests rebuild custom packages (no private cache) and hosts need their own ssh host key to decrypt agenix | Resolve when a private cache exists and tests can run per-service | 2024-03-13 | quarterly | active |
+| ID     | What & where                      | Why                                                                                                                                                                               | Removal condition                                                 | Added      | Revisit   | Status |
+| ------ | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---------- | --------- | ------ |
+| WA-013 | NixOS tests — `outputs/README.md` | full-host tests still rebuild custom packages (no private cache) and need the host ssh key to decrypt agenix; the shared-firewall security-exporters VM test now runs in CI (KVM) | Resolve when a private cache exists and tests can run per-service | 2024-03-13 | quarterly | active |
 
 ## Related