mirror of
https://github.com/actions/cache.git
synced 2026-03-07 10:13:07 +08:00
Simplify
This commit is contained in:
Bassem Dghaidi
GitHub
parent
eaa29f93a6
commit
d19411273c
143
.github/workflows/workflow.yml
vendored
143
.github/workflows/workflow.yml
vendored
@ -91,22 +91,38 @@ jobs:
|
||||
container:
|
||||
image: ubuntu:latest
|
||||
options: --privileged
|
||||
services:
|
||||
squid-proxy:
|
||||
image: ubuntu/squid:latest
|
||||
ports:
|
||||
- 3128:3128
|
||||
env:
|
||||
http_proxy: http://squid-proxy:3128
|
||||
https_proxy: http://squid-proxy:3128
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v5
|
||||
- name: Install dependencies
|
||||
- name: Install dependencies and setup Squid proxy
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y iptables dnsutils curl jq ipset
|
||||
apt-get install -y iptables dnsutils curl jq ipset squid
|
||||
|
||||
# Configure squid for forward proxy
|
||||
cat >> /etc/squid/squid.conf << 'EOF'
|
||||
# Allow all traffic through proxy
|
||||
http_access allow all
|
||||
# Enable SSL bumping for HTTPS CONNECT
|
||||
http_port 3128
|
||||
EOF
|
||||
|
||||
# Start squid
|
||||
service squid start
|
||||
sleep 2
|
||||
|
||||
# Verify squid is running
|
||||
if service squid status; then
|
||||
echo "Squid proxy started successfully"
|
||||
else
|
||||
echo "Failed to start squid"
|
||||
cat /var/log/squid/cache.log
|
||||
exit 1
|
||||
fi
|
||||
- name: Fetch GitHub meta and configure firewall
|
||||
env:
|
||||
http_proxy: http://127.0.0.1:3128
|
||||
https_proxy: http://127.0.0.1:3128
|
||||
run: |
|
||||
# Fetch GitHub meta API to get all IP ranges
|
||||
echo "Fetching GitHub meta API..."
|
||||
@ -212,6 +228,9 @@ jobs:
|
||||
- name: Generate files
|
||||
run: __tests__/create-cache-files.sh proxy test-cache
|
||||
- name: Save cache
|
||||
env:
|
||||
http_proxy: http://127.0.0.1:3128
|
||||
https_proxy: http://127.0.0.1:3128
|
||||
uses: ./
|
||||
with:
|
||||
key: test-proxy-${{ github.run_id }}
|
||||
@ -220,28 +239,24 @@ jobs:
|
||||
run: |
|
||||
echo "=== Verifying cache traffic went through proxy ==="
|
||||
|
||||
# Get the squid container ID
|
||||
SQUID_CONTAINER=$(docker ps --filter "ancestor=ubuntu/squid:latest" --format "{{.ID}}" | head -1)
|
||||
|
||||
if [ -z "$SQUID_CONTAINER" ]; then
|
||||
SQUID_CONTAINER=$(docker ps --format "{{.ID}}\t{{.Image}}" | grep squid | cut -f1)
|
||||
fi
|
||||
# Read squid access log directly
|
||||
SQUID_LOG="/var/log/squid/access.log"
|
||||
|
||||
# Initialize summary
|
||||
echo "## 🔒 Proxy Traffic Verification - Cache Save" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
if [ -n "$SQUID_CONTAINER" ]; then
|
||||
echo "Found Squid container: $SQUID_CONTAINER"
|
||||
if [ -f "$SQUID_LOG" ]; then
|
||||
echo "Found Squid access log at: $SQUID_LOG"
|
||||
|
||||
# Get the full access log
|
||||
ACCESS_LOG=$(docker exec "$SQUID_CONTAINER" cat /var/log/squid/access.log 2>/dev/null || echo "")
|
||||
ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "")
|
||||
|
||||
# Extract traffic details
|
||||
RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true)
|
||||
BLOB_LINES=$(echo "$ACCESS_LOG" | grep -i "blob.core.windows.net" || true)
|
||||
RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" || echo "0")
|
||||
BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" || echo "0")
|
||||
RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" 2>/dev/null || echo "0")
|
||||
BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" 2>/dev/null || echo "0")
|
||||
|
||||
# Build summary table
|
||||
echo "### 📊 Traffic Summary" >> $GITHUB_STEP_SUMMARY
|
||||
@ -322,10 +337,15 @@ jobs:
|
||||
echo "Blob storage requests: $BLOB_COUNT"
|
||||
echo "Verification status: $VERIFY_STATUS"
|
||||
else
|
||||
echo "⚠️ **WARNING**: Could not access Squid proxy container logs" >> $GITHUB_STEP_SUMMARY
|
||||
echo "⚠️ **WARNING**: Could not find Squid access log at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "This may occur when service containers are isolated from the job container." >> $GITHUB_STEP_SUMMARY
|
||||
echo "Could not access squid container logs"
|
||||
echo "Checking squid log directory..." >> $GITHUB_STEP_SUMMARY
|
||||
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
||||
ls -la /var/log/squid/ 2>&1 >> $GITHUB_STEP_SUMMARY || echo "Directory not found" >> $GITHUB_STEP_SUMMARY
|
||||
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
echo "Could not find squid access log"
|
||||
ls -la /var/log/squid/ 2>&1 || echo "Directory /var/log/squid not found"
|
||||
fi
|
||||
|
||||
test-proxy-restore:
|
||||
@ -334,29 +354,45 @@ jobs:
|
||||
container:
|
||||
image: ubuntu:latest
|
||||
options: --privileged
|
||||
services:
|
||||
squid-proxy:
|
||||
image: ubuntu/squid:latest
|
||||
ports:
|
||||
- 3128:3128
|
||||
env:
|
||||
http_proxy: http://squid-proxy:3128
|
||||
https_proxy: http://squid-proxy:3128
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v5
|
||||
- name: Install dependencies
|
||||
- name: Install dependencies and setup Squid proxy
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y iptables dnsutils curl jq ipset
|
||||
apt-get install -y iptables dnsutils curl jq ipset squid
|
||||
|
||||
# Configure squid for forward proxy
|
||||
cat >> /etc/squid/squid.conf << 'EOF'
|
||||
# Allow all traffic through proxy
|
||||
http_access allow all
|
||||
# Enable SSL bumping for HTTPS CONNECT
|
||||
http_port 3128
|
||||
EOF
|
||||
|
||||
# Start squid
|
||||
service squid start
|
||||
sleep 2
|
||||
|
||||
# Verify squid is running
|
||||
if service squid status; then
|
||||
echo "Squid proxy started successfully"
|
||||
else
|
||||
echo "Failed to start squid"
|
||||
cat /var/log/squid/cache.log
|
||||
exit 1
|
||||
fi
|
||||
- name: Fetch GitHub meta and configure firewall
|
||||
env:
|
||||
http_proxy: http://127.0.0.1:3128
|
||||
https_proxy: http://127.0.0.1:3128
|
||||
run: |
|
||||
# Fetch GitHub meta API to get all IP ranges
|
||||
echo "Fetching GitHub meta API..."
|
||||
curl -sS https://api.github.com/meta > /tmp/github-meta.json
|
||||
|
||||
# Get squid-proxy IP address
|
||||
PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
|
||||
# Proxy is on localhost
|
||||
PROXY_IP="127.0.0.1"
|
||||
echo "Proxy IP: $PROXY_IP"
|
||||
|
||||
# Allow established connections
|
||||
@ -421,6 +457,9 @@ jobs:
|
||||
echo ""
|
||||
echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries"
|
||||
- name: Verify proxy enforcement
|
||||
env:
|
||||
http_proxy: http://127.0.0.1:3128
|
||||
https_proxy: http://127.0.0.1:3128
|
||||
run: |
|
||||
echo "=== Testing proxy enforcement ==="
|
||||
|
||||
@ -453,6 +492,9 @@ jobs:
|
||||
echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
|
||||
fi
|
||||
- name: Restore cache
|
||||
env:
|
||||
http_proxy: http://127.0.0.1:3128
|
||||
https_proxy: http://127.0.0.1:3128
|
||||
uses: ./
|
||||
with:
|
||||
key: test-proxy-${{ github.run_id }}
|
||||
@ -461,28 +503,24 @@ jobs:
|
||||
run: |
|
||||
echo "=== Verifying cache restore traffic went through proxy ==="
|
||||
|
||||
# Get the squid container ID
|
||||
SQUID_CONTAINER=$(docker ps --filter "ancestor=ubuntu/squid:latest" --format "{{.ID}}" | head -1)
|
||||
|
||||
if [ -z "$SQUID_CONTAINER" ]; then
|
||||
SQUID_CONTAINER=$(docker ps --format "{{.ID}}\t{{.Image}}" | grep squid | cut -f1)
|
||||
fi
|
||||
# Read squid access log directly
|
||||
SQUID_LOG="/var/log/squid/access.log"
|
||||
|
||||
# Initialize summary
|
||||
echo "## 🔒 Proxy Traffic Verification - Cache Restore" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
if [ -n "$SQUID_CONTAINER" ]; then
|
||||
echo "Found Squid container: $SQUID_CONTAINER"
|
||||
if [ -f "$SQUID_LOG" ]; then
|
||||
echo "Found Squid access log at: $SQUID_LOG"
|
||||
|
||||
# Get the full access log
|
||||
ACCESS_LOG=$(docker exec "$SQUID_CONTAINER" cat /var/log/squid/access.log 2>/dev/null || echo "")
|
||||
ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "")
|
||||
|
||||
# Extract traffic details
|
||||
RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true)
|
||||
BLOB_LINES=$(echo "$ACCESS_LOG" | grep -i "blob.core.windows.net" || true)
|
||||
RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" || echo "0")
|
||||
BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" || echo "0")
|
||||
RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" 2>/dev/null || echo "0")
|
||||
BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" 2>/dev/null || echo "0")
|
||||
|
||||
# Build summary table
|
||||
echo "### 📊 Traffic Summary" >> $GITHUB_STEP_SUMMARY
|
||||
@ -562,10 +600,15 @@ jobs:
|
||||
echo "Blob storage requests: $BLOB_COUNT"
|
||||
echo "Verification status: $VERIFY_STATUS"
|
||||
else
|
||||
echo "⚠️ **WARNING**: Could not access Squid proxy container logs" >> $GITHUB_STEP_SUMMARY
|
||||
echo "⚠️ **WARNING**: Could not find Squid access log at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "This may occur when service containers are isolated from the job container." >> $GITHUB_STEP_SUMMARY
|
||||
echo "Could not access squid container logs"
|
||||
echo "Checking squid log directory..." >> $GITHUB_STEP_SUMMARY
|
||||
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
||||
ls -la /var/log/squid/ 2>&1 >> $GITHUB_STEP_SUMMARY || echo "Directory not found" >> $GITHUB_STEP_SUMMARY
|
||||
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
echo "Could not find squid access log"
|
||||
ls -la /var/log/squid/ 2>&1 || echo "Directory /var/log/squid not found"
|
||||
fi
|
||||
- name: Verify cache
|
||||
run: __tests__/verify-cache-files.sh proxy test-cache
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user