Use wernight/squid (permissive proxy) and fix verification tests

- Switch from ubuntu/squid to wernight/squid which allows all HTTPS CONNECT - Fix verification tests to explicitly use -x flag to prove proxy works - Tests now verify: 1. Proxy accepts and forwards requests (using curl -x) 2. Direct blob storage access is blocked by iptables 3. Blob storage access through proxy succeeds The cache action should now fail because it doesn't use the proxy, not because the proxy rejects the connection.
Add explicit iptables rules to block blob storage IPs
2026-03-07 10:13:07 +08:00 · 2026-01-29 09:41:44 -08:00 · 2026-01-29 09:31:15 -08:00 · 2026-01-29 09:27:29 -08:00 · 2026-01-29 09:22:42 -08:00 · 2026-01-29 09:20:18 -08:00
1 changed files with 160 additions and 329 deletions
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@ -91,46 +91,55 @@ jobs:
    container:
      image: ubuntu:latest
      options: --privileged
+    services:
+      squid-proxy:
+        image: wernight/squid
+        ports:
+          - 3128:3128
    steps:
    - name: Checkout
      uses: actions/checkout@v5
-    - name: Install dependencies and setup Squid proxy
+    - name: Install dependencies
      run: |
        apt-get update
-        apt-get install -y iptables dnsutils curl jq ipset squid
-        
-        # Configure squid for forward proxy
-        cat >> /etc/squid/squid.conf << 'EOF'
-        # Allow all traffic through proxy
-        http_access allow all
-        # Enable SSL bumping for HTTPS CONNECT
-        http_port 3128
-        EOF
-        
-        # Start squid
-        service squid start
-        sleep 2
-        
-        # Verify squid is running
-        if service squid status; then
-          echo "Squid proxy started successfully"
-        else
-          echo "Failed to start squid"
-          cat /var/log/squid/cache.log
-          exit 1
-        fi
+        apt-get install -y iptables dnsutils curl jq ipset
    - name: Fetch GitHub meta and configure firewall
-      env:
-        http_proxy: http://127.0.0.1:3128
-        https_proxy: http://127.0.0.1:3128
      run: |
        # Fetch GitHub meta API to get all IP ranges
        echo "Fetching GitHub meta API..."
        curl -sS https://api.github.com/meta > /tmp/github-meta.json

-        # Proxy is on localhost
-        PROXY_IP="127.0.0.1"
-        echo "Proxy IP: $PROXY_IP"
+        # Wait for squid-proxy service to be resolvable and accepting connections
+        echo "Waiting for squid-proxy service..."
+        for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+          PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
+          if [ -n "$PROXY_IP" ]; then
+            echo "squid-proxy resolved to: $PROXY_IP"
+            # Test that proxy is actually accepting connections
+            if curl --connect-timeout 2 --max-time 5 -x http://squid-proxy:3128 -sS https://api.github.com/zen 2>/dev/null; then
+              echo "Proxy is working!"
+              break
+            else
+              echo "Attempt $i: Proxy resolved but not ready yet, waiting..."
+            fi
+          else
+            echo "Attempt $i: squid-proxy not resolvable yet, waiting..."
+          fi
+          sleep 2
+        done
+
+        if [ -z "$PROXY_IP" ]; then
+          echo "ERROR: Could not resolve squid-proxy after 15 attempts"
+          exit 1
+        fi
+
+        # Verify proxy works before locking down firewall
+        echo "Final proxy connectivity test..."
+        if ! curl --connect-timeout 5 --max-time 10 -x http://squid-proxy:3128 -sS https://api.github.com/zen; then
+          echo "ERROR: Proxy is not working properly"
+          exit 1
+        fi
+        echo "Proxy verified working!"

        # Allow established connections
        iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
@ -175,12 +184,10 @@ jobs:
          iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
        done

-        # Block known blob storage endpoints used by cache
-        # Resolve and block common productionresultssa*.blob.core.windows.net endpoints
-        for i in 0 1 2 3 4 5 6 7 8 9 10 11 12; do
-          BLOB_HOST="productionresultssa${i}.blob.core.windows.net"
-          for ip in $(getent ahosts "$BLOB_HOST" 2>/dev/null | awk '{print $1}' | sort -u); do
-            echo "Blocking direct access to $BLOB_HOST: $ip"
+        # Block blob.core.windows.net (Azure blob storage used for cache)
+        for host in productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net; do
+          for ip in $(getent ahosts "$host" 2>/dev/null | awk '{print $1}' | sort -u); do
+            echo "Blocking direct access to blob storage ($host): $ip"
            iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
          done
        done
@ -194,162 +201,70 @@ jobs:
        echo ""
        echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries"
    - name: Verify proxy enforcement
-      env:
-        http_proxy: http://127.0.0.1:3128
-        https_proxy: http://127.0.0.1:3128
      run: |
        echo "=== Testing proxy enforcement ==="

-        # Test 1: Direct connection to github.com should work (it's in allowed IPs)
-        echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://api.github.com/zen 2>/dev/null; then
-          echo "✓ Direct GitHub API access works (expected)"
+        # Test 1: Verify proxy is working by explicitly using it
+        echo "Test 1: Connection through proxy (should SUCCEED)"
+        if curl --connect-timeout 10 --max-time 15 -x http://squid-proxy:3128 -sS -o /dev/null -w "%{http_code}" https://api.github.com/zen; then
+          echo ""
+          echo "✓ Proxy connection works"
        else
-          echo "✗ Direct GitHub API access failed (unexpected but not critical)"
+          echo "✗ ERROR: Proxy is not working!"
+          exit 1
        fi

-        # Test 2: Direct connection to blob storage should FAIL
+        # Test 2: Direct connection to blob storage should FAIL (blocked by iptables)
        echo ""
-        echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
+        echo "Test 2: Direct connection to blob storage (should FAIL - blocked by iptables)"
+        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
          echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!"
          exit 1
        else
-          echo "✓ Direct blob storage correctly blocked"
+          echo "✓ Direct blob storage correctly blocked by iptables"
        fi

-        # Test 3: Connection through proxy should work
+        # Test 3: Connection to blob storage THROUGH proxy should work
        echo ""
        echo "Test 3: Connection through proxy to blob storage (should SUCCEED)"
-        # Using proxy (from env vars), we should be able to connect even if we get an HTTP error
-        HTTP_CODE=$(curl --connect-timeout 5 --max-time 10 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>/dev/null || echo "000")
-        if [ "$HTTP_CODE" != "000" ]; then
-          echo "✓ Proxy connection works (HTTP $HTTP_CODE - connection succeeded through proxy)"
+        HTTP_CODE=$(curl --connect-timeout 10 --max-time 15 -x http://squid-proxy:3128 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>&1) || true
+        echo "HTTP response code: $HTTP_CODE"
+        if [ "$HTTP_CODE" = "400" ] || [ "$HTTP_CODE" = "409" ] || [ "$HTTP_CODE" = "200" ]; then
+          echo "✓ Proxy successfully forwarded request to blob storage (got HTTP $HTTP_CODE)"
        else
-          echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
+          echo "✗ ERROR: Proxy failed to forward request (got: $HTTP_CODE)"
+          exit 1
        fi
+        
+        echo ""
+        echo "=== All proxy enforcement tests passed ==="
+        echo "The proxy is working. If cache operations fail, it's because the action doesn't use the proxy."
    - name: Generate files
      run: __tests__/create-cache-files.sh proxy test-cache
    - name: Save cache
      env:
-        http_proxy: http://127.0.0.1:3128
-        https_proxy: http://127.0.0.1:3128
+        http_proxy: http://squid-proxy:3128
+        https_proxy: http://squid-proxy:3128
      uses: ./
      with:
        key: test-proxy-${{ github.run_id }}
        path: test-cache
-    - name: Verify cache traffic went through proxy
+    - name: Verify proxy setup
      run: |
-        echo "=== Verifying cache traffic went through proxy ==="
-        
-        # Read squid access log directly
-        SQUID_LOG="/var/log/squid/access.log"
-        
-        # Initialize summary
-        echo "## 🔒 Proxy Traffic Verification - Cache Save" >> $GITHUB_STEP_SUMMARY
+        echo "## 🔒 Proxy Integration Test - Cache Save" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
-        
-        if [ -f "$SQUID_LOG" ]; then
-          echo "Found Squid access log at: $SQUID_LOG"
-          
-          # Get the full access log
-          ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "")
-          
-          # Extract traffic details
-          RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true)
-          BLOB_LINES=$(echo "$ACCESS_LOG" | grep -i "blob.core.windows.net" || true)
-          RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" 2>/dev/null || echo "0")
-          BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" 2>/dev/null || echo "0")
-          
-          # Build summary table
-          echo "### 📊 Traffic Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| Endpoint | Requests | Status |" >> $GITHUB_STEP_SUMMARY
-          echo "|----------|----------|--------|" >> $GITHUB_STEP_SUMMARY
-          
-          if [ "$RESULTS_RECEIVER_COUNT" -gt 0 ]; then
-            echo "| results-receiver.actions.githubusercontent.com | $RESULTS_RECEIVER_COUNT | ✅ Proxied |" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "| results-receiver.actions.githubusercontent.com | 0 | ⚠️ Not detected |" >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          if [ "$BLOB_COUNT" -gt 0 ]; then
-            echo "| *.blob.core.windows.net | $BLOB_COUNT | ✅ Proxied |" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "| *.blob.core.windows.net | 0 | ⚠️ Not detected |" >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          # Verification result
-          echo "### 🎯 Verification Result" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          if [ "$RESULTS_RECEIVER_COUNT" -gt 0 ] && [ "$BLOB_COUNT" -gt 0 ]; then
-            echo "✅ **SUCCESS**: All cache save traffic verified going through proxy!" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "- ✅ CreateCacheEntry API call routed through proxy" >> $GITHUB_STEP_SUMMARY
-            echo "- ✅ FinalizeCacheEntryUpload API call routed through proxy" >> $GITHUB_STEP_SUMMARY  
-            echo "- ✅ Blob storage upload routed through proxy" >> $GITHUB_STEP_SUMMARY
-            VERIFY_STATUS="success"
-          else
-            echo "⚠️ **WARNING**: Some expected cache traffic not found in proxy logs" >> $GITHUB_STEP_SUMMARY
-            VERIFY_STATUS="warning"
-          fi
-          
-          # Detailed traffic logs
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "<details>" >> $GITHUB_STEP_SUMMARY
-          echo "<summary>📋 Detailed Proxy Traffic Logs</summary>" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          echo "#### Results Receiver Traffic (Cache API)" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          if [ -n "$RESULTS_RECEIVER_LINES" ]; then
-            echo "$RESULTS_RECEIVER_LINES" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "(no results-receiver traffic found)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "#### Blob Storage Traffic (Cache Upload)" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          if [ -n "$BLOB_LINES" ]; then
-            echo "$BLOB_LINES" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "(no blob storage traffic found)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "#### Full Squid Access Log" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          if [ -n "$ACCESS_LOG" ]; then
-            echo "$ACCESS_LOG" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "(access log empty or not accessible)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          echo "</details>" >> $GITHUB_STEP_SUMMARY
-          
-          # Also output to logs for debugging
-          echo ""
-          echo "=== Traffic Summary ==="
-          echo "Results-receiver requests: $RESULTS_RECEIVER_COUNT"
-          echo "Blob storage requests: $BLOB_COUNT"
-          echo "Verification status: $VERIFY_STATUS"
-        else
-          echo "⚠️ **WARNING**: Could not find Squid access log at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Checking squid log directory..." >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          ls -la /var/log/squid/ 2>&1 >> $GITHUB_STEP_SUMMARY || echo "Directory not found" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          
-          echo "Could not find squid access log"
-          ls -la /var/log/squid/ 2>&1 || echo "Directory /var/log/squid not found"
-        fi
+        echo "### ✅ Test Configuration" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "- **Proxy**: squid-proxy:3128" >> $GITHUB_STEP_SUMMARY
+        echo "- **Firewall**: iptables blocking direct access to cache endpoints" >> $GITHUB_STEP_SUMMARY
+        echo "- **Test**: Cache save operation completed successfully through proxy" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "If the cache save step succeeded, it means:" >> $GITHUB_STEP_SUMMARY
+        echo "1. Direct access to results-receiver.actions.githubusercontent.com was blocked" >> $GITHUB_STEP_SUMMARY
+        echo "2. Direct access to *.blob.core.windows.net was blocked" >> $GITHUB_STEP_SUMMARY  
+        echo "3. Cache operations were routed through the squid proxy" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "✅ **SUCCESS**: Proxy integration test passed!" >> $GITHUB_STEP_SUMMARY

  test-proxy-restore:
    needs: test-proxy-save
@ -357,46 +272,55 @@ jobs:
    container:
      image: ubuntu:latest
      options: --privileged
+    services:
+      squid-proxy:
+        image: wernight/squid
+        ports:
+          - 3128:3128
    steps:
    - name: Checkout
      uses: actions/checkout@v5
-    - name: Install dependencies and setup Squid proxy
+    - name: Install dependencies
      run: |
        apt-get update
-        apt-get install -y iptables dnsutils curl jq ipset squid
-        
-        # Configure squid for forward proxy
-        cat >> /etc/squid/squid.conf << 'EOF'
-        # Allow all traffic through proxy
-        http_access allow all
-        # Enable SSL bumping for HTTPS CONNECT
-        http_port 3128
-        EOF
-        
-        # Start squid
-        service squid start
-        sleep 2
-        
-        # Verify squid is running
-        if service squid status; then
-          echo "Squid proxy started successfully"
-        else
-          echo "Failed to start squid"
-          cat /var/log/squid/cache.log
-          exit 1
-        fi
+        apt-get install -y iptables dnsutils curl jq ipset
    - name: Fetch GitHub meta and configure firewall
-      env:
-        http_proxy: http://127.0.0.1:3128
-        https_proxy: http://127.0.0.1:3128
      run: |
        # Fetch GitHub meta API to get all IP ranges
        echo "Fetching GitHub meta API..."
        curl -sS https://api.github.com/meta > /tmp/github-meta.json

-        # Proxy is on localhost
-        PROXY_IP="127.0.0.1"
-        echo "Proxy IP: $PROXY_IP"
+        # Wait for squid-proxy service to be resolvable and accepting connections
+        echo "Waiting for squid-proxy service..."
+        for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+          PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
+          if [ -n "$PROXY_IP" ]; then
+            echo "squid-proxy resolved to: $PROXY_IP"
+            # Test that proxy is actually accepting connections
+            if curl --connect-timeout 2 --max-time 5 -x http://squid-proxy:3128 -sS https://api.github.com/zen 2>/dev/null; then
+              echo "Proxy is working!"
+              break
+            else
+              echo "Attempt $i: Proxy resolved but not ready yet, waiting..."
+            fi
+          else
+            echo "Attempt $i: squid-proxy not resolvable yet, waiting..."
+          fi
+          sleep 2
+        done
+
+        if [ -z "$PROXY_IP" ]; then
+          echo "ERROR: Could not resolve squid-proxy after 15 attempts"
+          exit 1
+        fi
+
+        # Verify proxy works before locking down firewall
+        echo "Final proxy connectivity test..."
+        if ! curl --connect-timeout 5 --max-time 10 -x http://squid-proxy:3128 -sS https://api.github.com/zen; then
+          echo "ERROR: Proxy is not working properly"
+          exit 1
+        fi
+        echo "Proxy verified working!"

        # Allow established connections
        iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
@ -441,12 +365,10 @@ jobs:
          iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
        done

-        # Block known blob storage endpoints used by cache
-        # Resolve and block common productionresultssa*.blob.core.windows.net endpoints
-        for i in 0 1 2 3 4 5 6 7 8 9 10 11 12; do
-          BLOB_HOST="productionresultssa${i}.blob.core.windows.net"
-          for ip in $(getent ahosts "$BLOB_HOST" 2>/dev/null | awk '{print $1}' | sort -u); do
-            echo "Blocking direct access to $BLOB_HOST: $ip"
+        # Block blob.core.windows.net (Azure blob storage used for cache)
+        for host in productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net; do
+          for ip in $(getent ahosts "$host" 2>/dev/null | awk '{print $1}' | sort -u); do
+            echo "Blocking direct access to blob storage ($host): $ip"
            iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
          done
        done
@ -460,158 +382,67 @@ jobs:
        echo ""
        echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries"
    - name: Verify proxy enforcement
-      env:
-        http_proxy: http://127.0.0.1:3128
-        https_proxy: http://127.0.0.1:3128
      run: |
        echo "=== Testing proxy enforcement ==="

-        # Test 1: Direct connection to github.com should work (it's in allowed IPs)
-        echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://api.github.com/zen 2>/dev/null; then
-          echo "✓ Direct GitHub API access works (expected)"
+        # Test 1: Verify proxy is working by explicitly using it
+        echo "Test 1: Connection through proxy (should SUCCEED)"
+        if curl --connect-timeout 10 --max-time 15 -x http://squid-proxy:3128 -sS -o /dev/null -w "%{http_code}" https://api.github.com/zen; then
+          echo ""
+          echo "✓ Proxy connection works"
        else
-          echo "✗ Direct GitHub API access failed (unexpected but not critical)"
+          echo "✗ ERROR: Proxy is not working!"
+          exit 1
        fi

-        # Test 2: Direct connection to blob storage should FAIL
+        # Test 2: Direct connection to blob storage should FAIL (blocked by iptables)
        echo ""
-        echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
+        echo "Test 2: Direct connection to blob storage (should FAIL - blocked by iptables)"
+        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
          echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!"
          exit 1
        else
-          echo "✓ Direct blob storage correctly blocked"
+          echo "✓ Direct blob storage correctly blocked by iptables"
        fi

-        # Test 3: Connection through proxy should work
+        # Test 3: Connection to blob storage THROUGH proxy should work
        echo ""
        echo "Test 3: Connection through proxy to blob storage (should SUCCEED)"
-        # Using proxy (from env vars), we should be able to connect even if we get an HTTP error
-        HTTP_CODE=$(curl --connect-timeout 5 --max-time 10 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>/dev/null || echo "000")
-        if [ "$HTTP_CODE" != "000" ]; then
-          echo "✓ Proxy connection works (HTTP $HTTP_CODE - connection succeeded through proxy)"
+        HTTP_CODE=$(curl --connect-timeout 10 --max-time 15 -x http://squid-proxy:3128 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>&1) || true
+        echo "HTTP response code: $HTTP_CODE"
+        if [ "$HTTP_CODE" = "400" ] || [ "$HTTP_CODE" = "409" ] || [ "$HTTP_CODE" = "200" ]; then
+          echo "✓ Proxy successfully forwarded request to blob storage (got HTTP $HTTP_CODE)"
        else
-          echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
+          echo "✗ ERROR: Proxy failed to forward request (got: $HTTP_CODE)"
+          exit 1
        fi
+        
+        echo ""
+        echo "=== All proxy enforcement tests passed ==="
+        echo "The proxy is working. If cache operations fail, it's because the action doesn't use the proxy."
    - name: Restore cache
      env:
-        http_proxy: http://127.0.0.1:3128
-        https_proxy: http://127.0.0.1:3128
+        http_proxy: http://squid-proxy:3128
+        https_proxy: http://squid-proxy:3128
      uses: ./
      with:
        key: test-proxy-${{ github.run_id }}
        path: test-cache
-    - name: Verify cache traffic went through proxy
+    - name: Verify proxy setup
      run: |
-        echo "=== Verifying cache restore traffic went through proxy ==="
-        
-        # Read squid access log directly
-        SQUID_LOG="/var/log/squid/access.log"
-        
-        # Initialize summary
-        echo "## 🔒 Proxy Traffic Verification - Cache Restore" >> $GITHUB_STEP_SUMMARY
+        echo "## 🔒 Proxy Integration Test - Cache Restore" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
-        
-        if [ -f "$SQUID_LOG" ]; then
-          echo "Found Squid access log at: $SQUID_LOG"
-          
-          # Get the full access log
-          ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "")
-          
-          # Extract traffic details
-          RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true)
-          BLOB_LINES=$(echo "$ACCESS_LOG" | grep -i "blob.core.windows.net" || true)
-          RESULTS_RECEIVER_COUNT=$(echo "$ACCESS_LOG" | grep -ci "results-receiver" 2>/dev/null || echo "0")
-          BLOB_COUNT=$(echo "$ACCESS_LOG" | grep -ci "blob.core.windows.net" 2>/dev/null || echo "0")
-          
-          # Build summary table
-          echo "### 📊 Traffic Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| Endpoint | Requests | Status |" >> $GITHUB_STEP_SUMMARY
-          echo "|----------|----------|--------|" >> $GITHUB_STEP_SUMMARY
-          
-          if [ "$RESULTS_RECEIVER_COUNT" -gt 0 ]; then
-            echo "| results-receiver.actions.githubusercontent.com | $RESULTS_RECEIVER_COUNT | ✅ Proxied |" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "| results-receiver.actions.githubusercontent.com | 0 | ⚠️ Not detected |" >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          if [ "$BLOB_COUNT" -gt 0 ]; then
-            echo "| *.blob.core.windows.net | $BLOB_COUNT | ✅ Proxied |" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "| *.blob.core.windows.net | 0 | ⚠️ Not detected |" >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          # Verification result
-          echo "### 🎯 Verification Result" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          if [ "$RESULTS_RECEIVER_COUNT" -gt 0 ] && [ "$BLOB_COUNT" -gt 0 ]; then
-            echo "✅ **SUCCESS**: All cache restore traffic verified going through proxy!" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "- ✅ GetCacheEntryDownloadURL API call routed through proxy" >> $GITHUB_STEP_SUMMARY
-            echo "- ✅ Blob storage download routed through proxy" >> $GITHUB_STEP_SUMMARY
-            VERIFY_STATUS="success"
-          else
-            echo "⚠️ **WARNING**: Some expected cache traffic not found in proxy logs" >> $GITHUB_STEP_SUMMARY
-            VERIFY_STATUS="warning"
-          fi
-          
-          # Detailed traffic logs
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "<details>" >> $GITHUB_STEP_SUMMARY
-          echo "<summary>📋 Detailed Proxy Traffic Logs</summary>" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          echo "#### Results Receiver Traffic (Cache API)" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          if [ -n "$RESULTS_RECEIVER_LINES" ]; then
-            echo "$RESULTS_RECEIVER_LINES" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "(no results-receiver traffic found)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "#### Blob Storage Traffic (Cache Download)" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          if [ -n "$BLOB_LINES" ]; then
-            echo "$BLOB_LINES" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "(no blob storage traffic found)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "#### Full Squid Access Log" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          if [ -n "$ACCESS_LOG" ]; then
-            echo "$ACCESS_LOG" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "(access log empty or not accessible)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          echo "</details>" >> $GITHUB_STEP_SUMMARY
-          
-          # Also output to logs for debugging
-          echo ""
-          echo "=== Traffic Summary ==="
-          echo "Results-receiver requests: $RESULTS_RECEIVER_COUNT"
-          echo "Blob storage requests: $BLOB_COUNT"
-          echo "Verification status: $VERIFY_STATUS"
-        else
-          echo "⚠️ **WARNING**: Could not find Squid access log at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Checking squid log directory..." >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          ls -la /var/log/squid/ 2>&1 >> $GITHUB_STEP_SUMMARY || echo "Directory not found" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          
-          echo "Could not find squid access log"
-          ls -la /var/log/squid/ 2>&1 || echo "Directory /var/log/squid not found"
-        fi
+        echo "### ✅ Test Configuration" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "- **Proxy**: squid-proxy:3128" >> $GITHUB_STEP_SUMMARY
+        echo "- **Firewall**: iptables blocking direct access to cache endpoints" >> $GITHUB_STEP_SUMMARY
+        echo "- **Test**: Cache restore operation completed successfully through proxy" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "If the cache restore step succeeded, it means:" >> $GITHUB_STEP_SUMMARY
+        echo "1. Direct access to results-receiver.actions.githubusercontent.com was blocked" >> $GITHUB_STEP_SUMMARY
+        echo "2. Direct access to *.blob.core.windows.net was blocked" >> $GITHUB_STEP_SUMMARY  
+        echo "3. Cache operations were routed through the squid proxy" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "✅ **SUCCESS**: Proxy integration test passed!" >> $GITHUB_STEP_SUMMARY
    - name: Verify cache
      run: __tests__/verify-cache-files.sh proxy test-cache
Author	SHA1	Message	Date
Bassem Dghaidi	2e9cddfa69	Use wernight/squid (permissive proxy) and fix verification tests Some checks failed Code scanning / CodeQL-Build (push) Has been cancelled Details - Switch from ubuntu/squid to wernight/squid which allows all HTTPS CONNECT - Fix verification tests to explicitly use -x flag to prove proxy works - Tests now verify: 1. Proxy accepts and forwards requests (using curl -x) 2. Direct blob storage access is blocked by iptables 3. Blob storage access through proxy succeeds The cache action should now fail because it doesn't use the proxy, not because the proxy rejects the connection.	2026-01-29 09:41:44 -08:00
Bassem Dghaidi	34472f2415	Add explicit iptables rules to block blob storage IPs The previous firewall setup relied on a catch-all REJECT rule for blob storage, but it wasn't blocking traffic. Now we explicitly resolve and block the IPs for productionresultssa0-3.blob.core.windows.net using iptables -I OUTPUT 1 to insert rules at the top of the chain.	2026-01-29 09:31:15 -08:00
Bassem Dghaidi	e0d51ac399	Switch to sameersbn/squid image and simplify verification - Replace ubuntu/squid with sameersbn/squid:latest (more reliable) - Remove shared volume mounts that may cause permission issues - Simplify verification steps since we can't access service container logs - The test validates proxy works by verifying cache operations succeed when direct access is blocked by iptables	2026-01-29 09:27:29 -08:00
Bassem Dghaidi	26cd8c103b	Add wait loop for squid-proxy service to be resolvable	2026-01-29 09:22:42 -08:00
Bassem Dghaidi	0d4af5e74f	Remove proxy env from Fetch GitHub meta step - must run before firewall setup	2026-01-29 09:20:18 -08:00
Bassem Dghaidi	61ba4b9b0a	Merge branch 'Link-/fix-proxy-integration-tests' of github.com:actions/cache into Link-/fix-proxy-integration-tests	2026-01-29 09:18:24 -08:00
Bassem Dghaidi	2f8c9d682d	Use shared volume between job container and squid service for log access	2026-01-29 09:17:52 -08:00
Bassem Dghaidi	56cc052f4d	Use shared volume between job container and squid service for log access	2026-01-29 09:13:07 -08:00