Mathieu Virbel
da3a2ac3a4
Rebrand the project from Fence to Greywall, the sandboxing layer of the GreyHaven platform. This updates: - Go module path to gitea.app.monadical.io/monadical/greywall - Binary name, CLI help text, and all usage examples - Config paths (~/.config/greywall/greywall.json), env vars (GREYWALL_*) - Log prefixes ([greywall:*]), temp file prefixes (greywall-*) - All documentation, scripts, CI workflows, and example files - README rewritten with GreyHaven branding and Fence attribution Directory/file renames: cmd/fence → cmd/greywall, pkg/fence → pkg/greywall, docs/why-fence.md → docs/why-greywall.md, example JSON files, and banner.
164 lines
4.3 KiB
YAML
164 lines
4.3 KiB
YAML
name: Build and test
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
name: Build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Download dependencies
|
|
run: go mod download
|
|
|
|
- name: Build
|
|
run: make build-ci
|
|
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Download dependencies
|
|
run: go mod download
|
|
|
|
- name: Lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
with:
|
|
install-mode: goinstall
|
|
version: v1.64.8
|
|
|
|
test-linux:
|
|
name: Test (Linux)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
|
|
- name: Download dependencies
|
|
run: go mod download
|
|
|
|
- name: Install Linux sandbox dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
bubblewrap \
|
|
socat \
|
|
uidmap \
|
|
curl \
|
|
netcat-openbsd \
|
|
ripgrep
|
|
# Configure subuid/subgid for the runner user (required for unprivileged user namespaces)
|
|
echo "$(whoami):100000:65536" | sudo tee -a /etc/subuid
|
|
echo "$(whoami):100000:65536" | sudo tee -a /etc/subgid
|
|
# Make bwrap setuid so it can create namespaces as non-root user
|
|
sudo chmod u+s $(which bwrap)
|
|
|
|
- name: Verify sandbox dependencies
|
|
run: |
|
|
echo "=== Checking sandbox dependencies ==="
|
|
bwrap --version
|
|
socat -V | head -1
|
|
echo "User namespaces enabled: $(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null || echo 'check not available')"
|
|
echo "Kernel version: $(uname -r)"
|
|
echo "uidmap installed: $(which newuidmap 2>/dev/null && echo yes || echo no)"
|
|
echo "subuid configured: $(grep $(whoami) /etc/subuid 2>/dev/null || echo 'not configured')"
|
|
echo "bwrap setuid: $(ls -la $(which bwrap) | grep -q '^-rws' && echo yes || echo no)"
|
|
echo "=== Testing bwrap basic functionality ==="
|
|
bwrap --ro-bind / / -- /bin/echo "bwrap works!"
|
|
echo "=== Testing bwrap with user namespace ==="
|
|
bwrap --ro-bind / / --unshare-user --uid 0 --gid 0 -- /bin/echo "bwrap user namespace works!"
|
|
|
|
- name: Run unit and integration tests
|
|
run: make test-ci
|
|
|
|
- name: Build binary for smoke tests
|
|
run: make build-ci
|
|
|
|
- name: Run smoke tests
|
|
run: GREYWALL_TEST_NETWORK=1 ./scripts/smoke_test.sh ./greywall
|
|
|
|
test-macos:
|
|
name: Test (macOS)
|
|
runs-on: macos-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
|
|
- name: Download dependencies
|
|
run: go mod download
|
|
|
|
- name: Install macOS dependencies
|
|
run: |
|
|
brew install ripgrep coreutils
|
|
|
|
- name: Verify sandbox dependencies
|
|
run: |
|
|
echo "=== Checking sandbox dependencies ==="
|
|
echo "macOS version: $(sw_vers -productVersion)"
|
|
sandbox-exec -p '(version 1)(allow default)' /bin/echo "sandbox-exec works"
|
|
|
|
- name: Run unit and integration tests
|
|
run: make test-ci
|
|
|
|
- name: Build binary for smoke tests
|
|
run: make build-ci
|
|
|
|
- name: Run smoke tests
|
|
run: GREYWALL_TEST_NETWORK=1 ./scripts/smoke_test.sh ./greywall
|