actions/cache
1
0
Fork 0
mirror of https://github.com/actions/cache.git synced 2026-03-07 10:13:07 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix

Browse Source
This commit is contained in:
Bassem Dghaidi 2026-01-29 08:41:53 -08:00 committed by GitHub
parent ef4c2110b5
commit eaa29f93a6
1 changed files with 30 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
.github/workflows/workflow.yml vendored
View File

@ -159,10 +159,15 @@ jobs:
iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
done done
# Block productionresultssa*.blob.core.windows.net (cache blob storage) # Block known blob storage endpoints used by cache
# We block ALL blob.core.windows.net traffic since we can't easily enumerate all storage accounts # Resolve and block common productionresultssa*.blob.core.windows.net endpoints
# The proxy will handle these requests for i in 0 1 2 3 4 5 6 7 8 9 10 11 12; do
echo "Note: *.blob.core.windows.net traffic will be blocked and must go through proxy" BLOB_HOST="productionresultssa${i}.blob.core.windows.net"
for ip in $(getent ahosts "$BLOB_HOST" 2>/dev/null | awk '{print $1}' | sort -u); do
echo "Blocking direct access to $BLOB_HOST: $ip"
iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
done
done
# Block all other outbound HTTP/HTTPS traffic # Block all other outbound HTTP/HTTPS traffic
iptables -A OUTPUT -p tcp --dport 80 -j REJECT iptables -A OUTPUT -p tcp --dport 80 -j REJECT
@ -178,7 +183,7 @@ jobs:
# Test 1: Direct connection to github.com should work (it's in allowed IPs) # Test 1: Direct connection to github.com should work (it's in allowed IPs)
echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)" echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)"
if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://api.github.com/zen 2>/dev/null; then if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://api.github.com/zen 2>/dev/null; then
echo "✓ Direct GitHub API access works (expected)" echo "✓ Direct GitHub API access works (expected)"
else else
echo "✗ Direct GitHub API access failed (unexpected but not critical)" echo "✗ Direct GitHub API access failed (unexpected but not critical)"
@ -187,7 +192,7 @@ jobs:
# Test 2: Direct connection to blob storage should FAIL # Test 2: Direct connection to blob storage should FAIL
echo "" echo ""
echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)" echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)"
if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://productionresultssa0.blob.core.windows.net 2>/dev/null; then if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!" echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!"
exit 1 exit 1
else else
@ -197,8 +202,10 @@ jobs:
# Test 3: Connection through proxy should work # Test 3: Connection through proxy should work
echo "" echo ""
echo "Test 3: Connection through proxy to blob storage (should SUCCEED)" echo "Test 3: Connection through proxy to blob storage (should SUCCEED)"
if curl --connect-timeout 5 --max-time 10 -sS https://productionresultssa0.blob.core.windows.net 2>&1 | head -5; then # Using proxy (from env vars), we should be able to connect even if we get an HTTP error
echo "✓ Proxy connection works (expected - even if 4xx/5xx response, connection succeeded)" HTTP_CODE=$(curl --connect-timeout 5 --max-time 10 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>/dev/null || echo "000")
if [ "$HTTP_CODE" != "000" ]; then
echo "✓ Proxy connection works (HTTP $HTTP_CODE - connection succeeded through proxy)"
else else
echo "Note: Proxy connection may have failed, but that's OK if it's not a network block" echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
fi fi
@ -395,10 +402,15 @@ jobs:
iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
done done
# Block productionresultssa*.blob.core.windows.net (cache blob storage) # Block known blob storage endpoints used by cache
# We block ALL blob.core.windows.net traffic since we can't easily enumerate all storage accounts # Resolve and block common productionresultssa*.blob.core.windows.net endpoints
# The proxy will handle these requests for i in 0 1 2 3 4 5 6 7 8 9 10 11 12; do
echo "Note: *.blob.core.windows.net traffic will be blocked and must go through proxy" BLOB_HOST="productionresultssa${i}.blob.core.windows.net"
for ip in $(getent ahosts "$BLOB_HOST" 2>/dev/null | awk '{print $1}' | sort -u); do
echo "Blocking direct access to $BLOB_HOST: $ip"
iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
done
done
# Block all other outbound HTTP/HTTPS traffic # Block all other outbound HTTP/HTTPS traffic
iptables -A OUTPUT -p tcp --dport 80 -j REJECT iptables -A OUTPUT -p tcp --dport 80 -j REJECT
@ -414,7 +426,7 @@ jobs:
# Test 1: Direct connection to github.com should work (it's in allowed IPs) # Test 1: Direct connection to github.com should work (it's in allowed IPs)
echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)" echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)"
if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://api.github.com/zen 2>/dev/null; then if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://api.github.com/zen 2>/dev/null; then
echo "✓ Direct GitHub API access works (expected)" echo "✓ Direct GitHub API access works (expected)"
else else
echo "✗ Direct GitHub API access failed (unexpected but not critical)" echo "✗ Direct GitHub API access failed (unexpected but not critical)"
@ -423,7 +435,7 @@ jobs:
# Test 2: Direct connection to blob storage should FAIL # Test 2: Direct connection to blob storage should FAIL
echo "" echo ""
echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)" echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)"
if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://productionresultssa0.blob.core.windows.net 2>/dev/null; then if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!" echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!"
exit 1 exit 1
else else
@ -433,8 +445,10 @@ jobs:
# Test 3: Connection through proxy should work # Test 3: Connection through proxy should work
echo "" echo ""
echo "Test 3: Connection through proxy to blob storage (should SUCCEED)" echo "Test 3: Connection through proxy to blob storage (should SUCCEED)"
if curl --connect-timeout 5 --max-time 10 -sS https://productionresultssa0.blob.core.windows.net 2>&1 | head -5; then # Using proxy (from env vars), we should be able to connect even if we get an HTTP error
echo "✓ Proxy connection works (expected - even if 4xx/5xx response, connection succeeded)" HTTP_CODE=$(curl --connect-timeout 5 --max-time 10 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>/dev/null || echo "000")
if [ "$HTTP_CODE" != "000" ]; then
echo "✓ Proxy connection works (HTTP $HTTP_CODE - connection succeeded through proxy)"
else else
echo "Note: Proxy connection may have failed, but that's OK if it's not a network block" echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
fi fi