From b79c5807ae6b297f589f2e778fd7ea117b28fc82 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Wed, 7 Oct 2026 14:57:34 +0800 Subject: [PATCH] ci: harden workflows and run the runtime firewall VM test (#398) * ci: pin actions, scope tokens, run the runtime security VM test * test: add a just recipe for the runtime firewall VM test --- .github/workflows/flake_evaltests.yml | 30 +++++++++++++++++++++++++-- .github/workflows/mirror_to_gitee.yml | 17 ++++++++++++--- Justfile | 6 ++++++ WORKAROUNDS.md | 6 +++--- 4 files changed, 51 insertions(+), 8 deletions(-) diff --git a/.github/workflows/flake_evaltests.yml b/.github/workflows/flake_evaltests.yml index e76b7204..95241619 100644 --- a/.github/workflows/flake_evaltests.yml +++ b/.github/workflows/flake_evaltests.yml @@ -18,6 +18,9 @@ on: - "**.nu" - "Justfile" +permissions: + contents: read + jobs: checks: name: Check expressions @@ -25,9 +28,9 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 - name: Install nix - uses: cachix/install-nix-action@v31 + uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: install_url: https://nixos.org/nix/install extra_nix_config: | @@ -40,3 +43,26 @@ jobs: # `nix eval` prints the suite result but still exits 0 on failure, so # compare the JSON boolean explicitly to fail the job. test "$(nix eval .#evalTests --json --show-trace)" = "true" + + runtime-security: + name: Runtime security VM tests + runs-on: ubuntu-latest + needs: checks + steps: + - name: Checkout repository + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - name: Install nix + uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 + with: + install_url: https://nixos.org/nix/install + extra_nix_config: | + experimental-features = nix-command flakes + # Hosted runners have /dev/kvm but the runner user cannot open it. This + # udev rule hands the group mode to everyone for the job's lifetime. + - name: Enable KVM + run: | + echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules + sudo udevadm control --reload-rules + sudo udevadm trigger --name-match=kvm + - name: Run the firewall VM test + run: nix build --no-link --print-build-logs .#checks.x86_64-linux.security-exporters diff --git a/.github/workflows/mirror_to_gitee.yml b/.github/workflows/mirror_to_gitee.yml index 92b1ce7d..ae4f3a24 100644 --- a/.github/workflows/mirror_to_gitee.yml +++ b/.github/workflows/mirror_to_gitee.yml @@ -6,14 +6,26 @@ on: tags: - "*" +permissions: + contents: read + jobs: mirror: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: fetch-depth: 0 + - name: Pin the Gitee host key + run: | + mkdir -p ~/.ssh + cat > ~/.ssh/known_hosts <<'HOSTS' + gitee.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKxHSJ7084RmkJ4YdEi5tngynE8aZe2uEoVVsB/OvYN + gitee.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMzG3r+88lWSDK9fyjcZmYsWGDBDmGoAasKMAmjoFloGt9HRQX2Qp4f9FY2XK/hsHYinvoh5Xytl9iaUNUWMfYR8q6VEMtOO87DgoAFcfKZHt0/nbAg9RoNTKYt6v8tPwYpr7N0JP/01nE4LFsNDnstr6H0bXSAzbKWCETLZfdPV4l2uSpRn3bU0ugoZ0aSKz5Dc/IloBfGCTvkSsxUydMRd/Chpjt6VxncDbp+Fa6pzsseK8OQzrg6Fgc5783EN3EQqZ2skqyCwExtx95BJlfx1B3luZnWfpkwNDnrZRT/Qx0OrWqyf0q6f9uQr+UG1S8qDcUn3e/9onq3rwBri8/ + HOSTS + chmod 600 ~/.ssh/known_hosts + - name: Mirror repo to Gitee id: mirror-to-gitee shell: bash @@ -23,10 +35,9 @@ jobs: run: | set -eu - mkdir -p ~/.ssh echo "$INPUT_SSH_PRIVATE_KEY" > ~/.ssh/id_rsa chmod 600 ~/.ssh/id_rsa - export GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no" + export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts" git remote add mirror "$INPUT_TARGET_REPO_URL" git push --tags --force --prune mirror "refs/remotes/origin/*:refs/heads/*" diff --git a/Justfile b/Justfile index 89f1f0b0..344e3610 100644 --- a/Justfile +++ b/Justfile @@ -23,6 +23,12 @@ default: test: let result = (nix eval .#evalTests --json --show-trace --print-build-logs --verbose | str trim); if $result != "true" { error make { msg: $"eval tests failed: evalTests returned ($result)" } } +# Build and run the runtime security VM test (needs /dev/kvm; not run by just test) +[linux] +[group('nix')] +test-vm: + nix build --no-link --print-build-logs .#checks.x86_64-linux.security-exporters + # Evaluate a NixOS host configuration without building it. [group('nix')] eval-host host: diff --git a/WORKAROUNDS.md b/WORKAROUNDS.md index 6804149a..d8720d26 100644 --- a/WORKAROUNDS.md +++ b/WORKAROUNDS.md @@ -59,9 +59,9 @@ A known limitation with no fix yet. An unfinished feature or gap. -| ID | What & where | Why | Removal condition | Added | Revisit | Status | -| ------ | --------------------------------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---------- | --------- | ------ | -| WA-013 | NixOS tests — `outputs/README.md` | tests rebuild custom packages (no private cache) and hosts need their own ssh host key to decrypt agenix | Resolve when a private cache exists and tests can run per-service | 2024-03-13 | quarterly | active | +| ID | What & where | Why | Removal condition | Added | Revisit | Status | +| ------ | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---------- | --------- | ------ | +| WA-013 | NixOS tests — `outputs/README.md` | full-host tests still rebuild custom packages (no private cache) and need the host ssh key to decrypt agenix; the shared-firewall security-exporters VM test now runs in CI (KVM) | Resolve when a private cache exists and tests can run per-service | 2024-03-13 | quarterly | active | ## Related