FilesExpand file tree

main

/

parallel_steps_test.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

110 lines (102 loc) · 3.73 KB

main

/

parallel_steps_test.go

Copy path

Top

File metadata and controls

• Code
• Blame

110 lines (102 loc) · 3.73 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

package main

import (

"encoding/json"

"os"

"path/filepath"

"testing"

parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"

"github.com/github/gh-actions-lock/cmd/gh-actions-lock/format"

"github.com/github/gh-actions-lock/internal/ghapi/httpmock"

"github.com/stretchr/testify/assert"

"github.com/stretchr/testify/require"

)

// writeParallelStepsRepo writes workflow.yml plus a lockfile that already pins

// checkout@v6 and setup-go@v6 (mutable refs trusted without a network call),

// and chdirs into the repo. Returns the lockfile path.

func writeParallelStepsRepo(t *testing.T, workflow string) string {

t.Helper()

dir := t.TempDir()

require.NoError(t, os.MkdirAll(filepath.Join(dir, ".github", "workflows"), 0o755))

require.NoError(t, os.WriteFile(filepath.Join(dir, ".github", "workflows", "workflow.yml"), []byte(workflow), 0o600))

lockYAML := "version: '" + parserlock.Version + "'\ndependencies:\n" +

" 'actions/checkout@v6':\n ref: 'v6'\n commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'\n owner_id: 1\n repo_id: 1\n" +

" 'actions/setup-go@v6':\n ref: 'v6'\n commit: 'sha1-4a3601121dd01d1626a1e23e37211e3254c1c06c'\n owner_id: 1\n repo_id: 1\n" +

"workflows:\n '.github/workflows/workflow.yml':\n - 'actions/checkout@v6'\n - 'actions/setup-go@v6'\n"

lockPath := filepath.Join(dir, ".github", "workflows", "actions.lock")

require.NoError(t, os.WriteFile(lockPath, []byte(lockYAML), 0o600))

t.Chdir(dir)

return lockPath

}

func TestCheck_ParallelStepGroups(t *testing.T) {

t.Run("full scan keeps a dependency used only in a parallel group", func(t *testing.T) {

reg := &httpmock.Registry{}

defer reg.Verify(t)

lockPath := writeParallelStepsRepo(t, `on: push

jobs:

build:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v6

- parallel:

- uses: actions/setup-go@v6

- run: echo hi

`)

_, _, err := runCommandWithHTTP(t, reg, "--json=valid")

require.NoError(t, err)

got, err := os.ReadFile(lockPath)

require.NoError(t, err)

assert.Contains(t, string(got), "'actions/setup-go@v6'")

})

t.Run("full scan drops a dependency removed from a parallel group", func(t *testing.T) {

reg := &httpmock.Registry{}

defer reg.Verify(t)

lockPath := writeParallelStepsRepo(t, `on: push

jobs:

build:

runs-on: ubuntu-latest

steps:

- parallel:

- uses: actions/checkout@v6

- run: echo hi

`)

_, _, err := runCommandWithHTTP(t, reg, "--json=valid")

require.NoError(t, err)

got, err := os.ReadFile(lockPath)

require.NoError(t, err)

assert.Contains(t, string(got), "'actions/checkout@v6'")

assert.NotContains(t, string(got), "setup-go")

})

t.Run("verify-local rejects a parallel action missing from the lockfile", func(t *testing.T) {

reg := &httpmock.Registry{}

defer reg.Verify(t)

lockPath := writeParallelStepsRepo(t, `on: push

jobs:

build:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v6

- parallel:

- uses: actions/setup-go@v6

- uses: actions/setup-node@v6

`)

before, err := os.ReadFile(lockPath)

require.NoError(t, err)

stdout, _, _ := runCommandWithHTTP(t, reg, "--verify-local", "--json=valid,findings")

var payload struct {

Valid bool `json:"valid"`

Findings []format.Finding `json:"findings"`

}

require.NoError(t, json.Unmarshal([]byte(stdout), &payload), stdout)

assert.False(t, payload.Valid)

var flagged bool

for _, f := range payload.Findings {

if f.Severity == "error" && f.Dependency == "actions/setup-node@v6" {

flagged = true

}

}

assert.True(t, flagged, "findings: %+v", payload.Findings)

after, err := os.ReadFile(lockPath)

require.NoError(t, err)

assert.Equal(t, string(before), string(after))

})

}