Repository navigation
fix(echidnabot): move the pin to the upstream repair, and mark 1 fleet test value #1778
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is managed by gh actions-lock. | |
| # SPDX-License-Identifier: MPL-2.0 | |
| # This workflow is managed by gh actions-lock. | |
| # This workflow is managed by gh actions-lock. | |
| name: E2E Tests | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: ['**'] | |
| permissions: {} | |
| jobs: | |
| e2e: | |
| name: E2E tests | |
| permissions: | |
| actions: read | |
| contents: read | |
| needs: pinned-source-closure | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Require verified pinned-source closure | |
| env: | |
| CLOSURE_RESULT: ${{ needs.pinned-source-closure.result }} | |
| run: | | |
| if [ "$CLOSURE_RESULT" != success ]; then | |
| echo "Pinned-source closure did not pass: $CLOSURE_RESULT" >&2 | |
| exit 1 | |
| fi | |
| - uses: actions/checkout@v7.0.1 | |
| - name: Audit workflow lock auditor dependencies | |
| run: | | |
| set -euo pipefail | |
| # Official RustSec binary, immutable content hash from its release asset. | |
| archive="$RUNNER_TEMP/cargo-audit.tgz" | |
| curl --proto '=https' --proto-redir '=https' -fsSL --retry 3 https://github.com/rustsec/rustsec/releases/download/cargo-audit/v0.22.2/cargo-audit-x86_64-unknown-linux-gnu-v0.22.2.tgz -o "$archive" | |
| printf '%s %s\n' ab28a1bdb54db4d5d8ad5981cf1f959410370b3d28250dbd35f6a44248620e39 "$archive" | sha256sum -c - | |
| tar -xzf "$archive" -C "$RUNNER_TEMP" | |
| "$RUNNER_TEMP/cargo-audit-x86_64-unknown-linux-gnu-v0.22.2/cargo-audit" audit --file tools/workflow-lock-audit/Cargo.lock --deny warnings | |
| - name: Test workflow lock-map and regeneration audit | |
| run: | | |
| cargo test --locked --manifest-path tools/workflow-lock-audit/Cargo.toml | |
| bash scripts/audit-workflow-lock-map.sh | |
| - name: Test audit workflow diagnostics | |
| run: | | |
| python3 -c 'import yaml' || python3 -m pip install --user --only-binary=:all: --require-hashes -r .github/requirements/e2e.txt | |
| bash scripts/tests/pr-audit-workflows-test.sh | |
| - name: Verify automation quarantine | |
| run: bash tests/automation-quarantine-test.sh | |
| - name: Verify fix-outcome verdicts | |
| run: bash tests/outcome-verdict-test.sh | |
| - name: PA rule IDs agree with panic-attack's table | |
| run: bash tests/panic-attack-rule-ids-test.sh | |
| - name: Run E2E tests | |
| run: bash tests/e2e.sh | |
| - name: Verify canonical descriptile policy repair | |
| run: bash tests/retired-descriptile-policy-test.sh | |
| - name: Verify the template-drift recipes | |
| run: bash tests/template-drift-recipes-test.sh | |
| - name: Verify star-list enrollment discovery | |
| run: bash tests/enroll-discovery-test.sh | |
| - name: Verify the fleet report-back driver (envelope contract) | |
| run: bash tests/fleet-report-back-test.sh | |
| - name: Fleet enrolment fixer (report-back rollout) | |
| run: bash tests/fix-fleet-enrolment-test.sh | |
| pinned-source-closure: | |
| name: Pinned source closure | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - name: Set source cache | |
| run: printf 'PINNED_SOURCE_CACHE=%s/fleet-pinned-sources\n' "$RUNNER_TEMP" >> "$GITHUB_ENV" | |
| - name: Test pinned-source failure modes | |
| run: bash scripts/tests/pinned-reusable-sources-test.sh | |
| - name: Authenticate pinned reusable sources | |
| run: bash scripts/audit-pinned-reusable-sources.sh --fetch-sources | |
| - name: Verify live scanner caller and negative controls | |
| run: bash scripts/tests/scanner-caller-contract-test.sh | |
| - name: Authenticate historical scanner source for archived preflight | |
| run: | | |
| set -euo pipefail | |
| tree="$RUNNER_TEMP/historical-scanner-source" | |
| mkdir -p "$tree/scripts/lib" | |
| cp -R .github "$tree/" | |
| cp scripts/lib/{pinned-reusable-sources.json,lock-closure-receipts.tsv} "$tree/scripts/lib/" | |
| bash docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh \ | |
| "$tree" docs/migrations/secret-scanner-cicd-suite/fixtures/historical-source.json | |
| bash scripts/audit-pinned-reusable-sources.sh --repo-root "$tree" --fetch-sources | |
| - name: Preserve lock closure contracts | |
| run: bash scripts/tests/lock-closure-test.sh | |
| - name: Audit vendor lock and pinned-source closure | |
| run: ./scripts/audit-lock-closure.sh | |
| - name: Test source closure through migration preflight | |
| run: | | |
| rc=0 | |
| bash scripts/tests/pinned-source-entrypoints-test.sh > "$RUNNER_TEMP/preflight-tests.log" 2>&1 || rc=$? | |
| cat "$RUNNER_TEMP/preflight-tests.log" | |
| if [ "$rc" -ne 0 ]; then | |
| detail=$(tail -c 5000 "$RUNNER_TEMP/preflight-tests.log") | |
| detail=${detail//'%'/'%25'}; detail=${detail//$'\r'/'%0D'}; detail=${detail//$'\n'/'%0A'} | |
| echo "::error::Historical preflight tests failed (exit $rc): $detail" | |
| fi | |
| exit "$rc" | |
| - name: Prepared secret-scanner migration stays gated | |
| run: | | |
| # 0 = all preconditions hold; 2 = evidence is unavailable. The | |
| # historical canary receipt is now present, but online/source evidence | |
| # may still be unavailable. Findings (1 or 3) must fail the build. | |
| rc=0 | |
| ./docs/migrations/secret-scanner-cicd-suite/preflight.sh --quiet || rc=$? | |
| case "$rc" in | |
| 0|2) echo "preflight exit $rc (no findings)";; | |
| *) echo "preflight exit $rc: findings in the prepared migration" >&2; exit 1;; | |
| esac | |
| - name: Regenerate vendor lock in a disposable worktree | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| git worktree add --detach "$RUNNER_TEMP/lock-regeneration" HEAD | |
| gh extension install github/gh-actions-lock --pin v0.4.1 | |
| cd "$RUNNER_TEMP/lock-regeneration" | |
| gh actions-lock --no-interactive | |
| git diff --stat -- .github/workflows | |
| - name: Compare regenerated and reviewed vendor closures | |
| run: | | |
| set -euo pipefail | |
| bash scripts/audit-lock-regeneration.sh \ | |
| .github/workflows/actions.lock "$RUNNER_TEMP/lock-regeneration/.github/workflows/actions.lock" | |
| - name: Verify reviewed source closure against regeneration | |
| run: | | |
| set -euo pipefail | |
| # The regeneration comparison alone covers only shared vendor roots. | |
| # Independently authenticate the job-level reusable closure, including | |
| # the scanner, against the regenerated lock and caller tree. | |
| rc=0 | |
| bash scripts/audit-pinned-reusable-sources.sh \ | |
| --repo-root "$RUNNER_TEMP/lock-regeneration" \ | |
| --lock "$RUNNER_TEMP/lock-regeneration/.github/workflows/actions.lock" \ | |
| > "$RUNNER_TEMP/regenerated-source-audit.txt" 2>&1 || rc=$? | |
| cat "$RUNNER_TEMP/regenerated-source-audit.txt" | |
| if [ "$rc" -ne 0 ]; then | |
| # Surface a bounded, escaped diagnostic in the check annotation as | |
| # well as the logs; never turn an incomplete comparison into green. | |
| detail=$(head -c 3000 "$RUNNER_TEMP/regenerated-source-audit.txt") | |
| detail=${detail//'%'/'%25'} | |
| detail=${detail//$'\r'/'%0D'} | |
| detail=${detail//$'\n'/'%0A'} | |
| echo "::error::Regenerated source audit exited $rc: $detail" | |
| exit "$rc" | |
| fi |