mirror of
https://github.com/nimbold/Firelink.git
synced 2026-09-10 01:35:43 +00:00
NimBold
d8a6440998
- cache target-scoped engine payloads with exact lock and toolchain keys\n- validate manifest provenance, checksums, and paths before reuse\n- restrict cache writes to trusted main pushes while allowing release restores\n- fall back to source provisioning when a cache is absent or invalid\n- harden release checksum generation against pipeline races
46 lines
2.0 KiB
JavaScript
46 lines
2.0 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import test from 'node:test';
|
|
|
|
const repositoryRoot = path.resolve(import.meta.dirname, '..');
|
|
const ciWorkflow = fs.readFileSync(
|
|
path.join(repositoryRoot, '.github', 'workflows', 'ci.yml'),
|
|
'utf8',
|
|
);
|
|
const releaseWorkflow = fs.readFileSync(
|
|
path.join(repositoryRoot, '.github', 'workflows', 'release.yml'),
|
|
'utf8',
|
|
);
|
|
const cacheActionSha = '1bd1e32a3bdc45362d1e726936510720a7c30a57';
|
|
|
|
function assertSafeEngineCacheWorkflow(workflow) {
|
|
assert.match(workflow, new RegExp(`actions/cache/restore@${cacheActionSha}`));
|
|
assert.match(workflow, /key: firelink-engine-payload-v1-\$\{\{ matrix\.target \}\}-\$\{\{ steps\.engine-toolchain\.outputs\.fingerprint \}\}/);
|
|
assert.match(workflow, /engine-sources\.lock\.json/);
|
|
assert.match(workflow, /scripts\/aria2\/\*\*/);
|
|
assert.match(workflow, /scripts\/engine-\*\.js/);
|
|
assert.match(workflow, /scripts\/verify-binaries\.js/);
|
|
assert.doesNotMatch(workflow, /restore-keys:/);
|
|
|
|
const restore = workflow.indexOf('actions/cache/restore@');
|
|
const validation = workflow.indexOf('id: engine-cache-validation');
|
|
const provision = workflow.indexOf('node scripts/provision-engines.js');
|
|
assert.ok(restore >= 0 && restore < validation && validation < provision);
|
|
assert.match(workflow, /continue-on-error: true/);
|
|
assert.match(workflow, /FIRELINK_TARGET_TRIPLE: \$\{\{ matrix\.target \}\}/);
|
|
}
|
|
|
|
test('CI and release restore only exact, validated engine payload caches', () => {
|
|
assertSafeEngineCacheWorkflow(ciWorkflow);
|
|
assertSafeEngineCacheWorkflow(releaseWorkflow);
|
|
});
|
|
|
|
test('only trusted main pushes save the shared engine cache', () => {
|
|
assert.match(ciWorkflow, new RegExp(`actions/cache/save@${cacheActionSha}`));
|
|
const save = ciWorkflow.slice(ciWorkflow.indexOf('- name: Save verified engine payload cache'));
|
|
assert.match(save, /github\.event_name == 'push'/);
|
|
assert.match(save, /github\.ref == 'refs\/heads\/main'/);
|
|
assert.doesNotMatch(releaseWorkflow, /actions\/cache\/save@/);
|
|
});
|