From d19411273c607a5613df7f9072174a66ae62d5d0 Mon Sep 17 00:00:00 2001 From: Bassem Dghaidi <568794+Link-@users.noreply.github.com> Date: Thu, 29 Jan 2026 08:52:36 -0800 Subject: [PATCH] Simplify --- .github/workflows/workflow.yml | 143 +++++++++++++++++++++------------ 1 file changed, 93 insertions(+), 50 deletions(-) diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml index c223c43..5782b9a 100644 --- a/.github/workflows/workflow.yml +++ b/.github/workflows/workflow.yml @@ -91,22 +91,38 @@ jobs: container: image: ubuntu:latest options: --privileged - services: - squid-proxy: - image: ubuntu/squid:latest - ports: - - 3128:3128 - env: - http_proxy: http://squid-proxy:3128 - https_proxy: http://squid-proxy:3128 steps: - name: Checkout uses: actions/checkout@v5 - - name: Install dependencies + - name: Install dependencies and setup Squid proxy run: | apt-get update - apt-get install -y iptables dnsutils curl jq ipset + apt-get install -y iptables dnsutils curl jq ipset squid + + # Configure squid for forward proxy + cat >> /etc/squid/squid.conf << 'EOF' + # Allow all traffic through proxy + http_access allow all + # Enable SSL bumping for HTTPS CONNECT + http_port 3128 + EOF + + # Start squid + service squid start + sleep 2 + + # Verify squid is running + if service squid status; then + echo "Squid proxy started successfully" + else + echo "Failed to start squid" + cat /var/log/squid/cache.log + exit 1 + fi - name: Fetch GitHub meta and configure firewall + env: + http_proxy: http://127.0.0.1:3128 + https_proxy: http://127.0.0.1:3128 run: | # Fetch GitHub meta API to get all IP ranges echo "Fetching GitHub meta API..." @@ -212,6 +228,9 @@ jobs: - name: Generate files run: __tests__/create-cache-files.sh proxy test-cache - name: Save cache + env: + http_proxy: http://127.0.0.1:3128 + https_proxy: http://127.0.0.1:3128 uses: ./ with: key: test-proxy-${{ github.run_id }} @@ -220,28 +239,24 @@ jobs: run: | echo "=== Verifying cache traffic went through proxy ===" - # Get the squid container ID - SQUID_CONTAINER=$(docker ps --filter "ancestor=ubuntu/squid:latest" --format "{{.ID}}" | head -1) - - if [ -z "$SQUID_CONTAINER" ]; then - SQUID_CONTAINER=$(docker ps --format "{{.ID}}\t{{.Image}}" | grep squid | cut -f1) - fi + # Read squid access log directly + SQUID_LOG="/var/log/squid/access.log" # Initialize summary echo "## 🔒 Proxy Traffic Verification - Cache Save" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - if [ -n "$SQUID_CONTAINER" ]; then - echo "Found Squid container: $SQUID_CONTAINER" + if [ -f "$SQUID_LOG" ]; then + echo "Found Squid access log at: $SQUID_LOG" # Get the full access log - ACCESS_LOG=$(docker exec "$SQUID_CONTAINER" cat /var/log/squid/access.log 2>/dev/null || echo "") + ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "") # Extract traffic details RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true) BLOB_LINES=$(echo "$ACCESS_LOG" | grep -i "blob.core.windows.net" || true) - RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" || echo "0") - BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" || echo "0") + RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" 2>/dev/null || echo "0") + BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" 2>/dev/null || echo "0") # Build summary table echo "### 📊 Traffic Summary" >> $GITHUB_STEP_SUMMARY @@ -322,10 +337,15 @@ jobs: echo "Blob storage requests: $BLOB_COUNT" echo "Verification status: $VERIFY_STATUS" else - echo "⚠️ **WARNING**: Could not access Squid proxy container logs" >> $GITHUB_STEP_SUMMARY + echo "⚠️ **WARNING**: Could not find Squid access log at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - echo "This may occur when service containers are isolated from the job container." >> $GITHUB_STEP_SUMMARY - echo "Could not access squid container logs" + echo "Checking squid log directory..." >> $GITHUB_STEP_SUMMARY + echo "\`\`\`" >> $GITHUB_STEP_SUMMARY + ls -la /var/log/squid/ 2>&1 >> $GITHUB_STEP_SUMMARY || echo "Directory not found" >> $GITHUB_STEP_SUMMARY + echo "\`\`\`" >> $GITHUB_STEP_SUMMARY + + echo "Could not find squid access log" + ls -la /var/log/squid/ 2>&1 || echo "Directory /var/log/squid not found" fi test-proxy-restore: @@ -334,29 +354,45 @@ jobs: container: image: ubuntu:latest options: --privileged - services: - squid-proxy: - image: ubuntu/squid:latest - ports: - - 3128:3128 - env: - http_proxy: http://squid-proxy:3128 - https_proxy: http://squid-proxy:3128 steps: - name: Checkout uses: actions/checkout@v5 - - name: Install dependencies + - name: Install dependencies and setup Squid proxy run: | apt-get update - apt-get install -y iptables dnsutils curl jq ipset + apt-get install -y iptables dnsutils curl jq ipset squid + + # Configure squid for forward proxy + cat >> /etc/squid/squid.conf << 'EOF' + # Allow all traffic through proxy + http_access allow all + # Enable SSL bumping for HTTPS CONNECT + http_port 3128 + EOF + + # Start squid + service squid start + sleep 2 + + # Verify squid is running + if service squid status; then + echo "Squid proxy started successfully" + else + echo "Failed to start squid" + cat /var/log/squid/cache.log + exit 1 + fi - name: Fetch GitHub meta and configure firewall + env: + http_proxy: http://127.0.0.1:3128 + https_proxy: http://127.0.0.1:3128 run: | # Fetch GitHub meta API to get all IP ranges echo "Fetching GitHub meta API..." curl -sS https://api.github.com/meta > /tmp/github-meta.json - # Get squid-proxy IP address - PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + # Proxy is on localhost + PROXY_IP="127.0.0.1" echo "Proxy IP: $PROXY_IP" # Allow established connections @@ -421,6 +457,9 @@ jobs: echo "" echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries" - name: Verify proxy enforcement + env: + http_proxy: http://127.0.0.1:3128 + https_proxy: http://127.0.0.1:3128 run: | echo "=== Testing proxy enforcement ===" @@ -453,6 +492,9 @@ jobs: echo "Note: Proxy connection may have failed, but that's OK if it's not a network block" fi - name: Restore cache + env: + http_proxy: http://127.0.0.1:3128 + https_proxy: http://127.0.0.1:3128 uses: ./ with: key: test-proxy-${{ github.run_id }} @@ -461,28 +503,24 @@ jobs: run: | echo "=== Verifying cache restore traffic went through proxy ===" - # Get the squid container ID - SQUID_CONTAINER=$(docker ps --filter "ancestor=ubuntu/squid:latest" --format "{{.ID}}" | head -1) - - if [ -z "$SQUID_CONTAINER" ]; then - SQUID_CONTAINER=$(docker ps --format "{{.ID}}\t{{.Image}}" | grep squid | cut -f1) - fi + # Read squid access log directly + SQUID_LOG="/var/log/squid/access.log" # Initialize summary echo "## 🔒 Proxy Traffic Verification - Cache Restore" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - if [ -n "$SQUID_CONTAINER" ]; then - echo "Found Squid container: $SQUID_CONTAINER" + if [ -f "$SQUID_LOG" ]; then + echo "Found Squid access log at: $SQUID_LOG" # Get the full access log - ACCESS_LOG=$(docker exec "$SQUID_CONTAINER" cat /var/log/squid/access.log 2>/dev/null || echo "") + ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "") # Extract traffic details RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true) BLOB_LINES=$(echo "$ACCESS_LOG" | grep -i "blob.core.windows.net" || true) - RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" || echo "0") - BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" || echo "0") + RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" 2>/dev/null || echo "0") + BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" 2>/dev/null || echo "0") # Build summary table echo "### 📊 Traffic Summary" >> $GITHUB_STEP_SUMMARY @@ -562,10 +600,15 @@ jobs: echo "Blob storage requests: $BLOB_COUNT" echo "Verification status: $VERIFY_STATUS" else - echo "⚠️ **WARNING**: Could not access Squid proxy container logs" >> $GITHUB_STEP_SUMMARY + echo "⚠️ **WARNING**: Could not find Squid access log at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - echo "This may occur when service containers are isolated from the job container." >> $GITHUB_STEP_SUMMARY - echo "Could not access squid container logs" + echo "Checking squid log directory..." >> $GITHUB_STEP_SUMMARY + echo "\`\`\`" >> $GITHUB_STEP_SUMMARY + ls -la /var/log/squid/ 2>&1 >> $GITHUB_STEP_SUMMARY || echo "Directory not found" >> $GITHUB_STEP_SUMMARY + echo "\`\`\`" >> $GITHUB_STEP_SUMMARY + + echo "Could not find squid access log" + ls -la /var/log/squid/ 2>&1 || echo "Directory /var/log/squid not found" fi - name: Verify cache run: __tests__/verify-cache-files.sh proxy test-cache