Skip to content

Commit 00a6b57

Browse files
jaypipesjaypipes
committed
harden and refactor GH action for unit tests
Updates the GH Action workflow for unit testing with security best practices, including reduce permissions, the step security action hardener, and using SHA-specific Action releases. Signed-off-by: Jay Pipes <jaypipes@gmail.com>
1 parent bd2bdde commit 00a6b57

File tree

2 files changed

+154
-131
lines changed

2 files changed

+154
-131
lines changed

‎.github/workflows/go.yml

Lines changed: 0 additions & 131 deletions
This file was deleted.

‎.github/workflows/test.yml

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
name: test
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
9+
permissions:
10+
contents: read
11+
12+
# see: https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners
13+
jobs:
14+
# tier-1
15+
# main development platform, gets features first and it's most tested
16+
ubuntu-latest:
17+
runs-on: ubuntu-latest
18+
strategy:
19+
matrix:
20+
go: [ '1.19', '1.20']
21+
steps:
22+
- name: harden runner
23+
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
24+
with:
25+
egress-policy: block
26+
disable-sudo: true
27+
- name: checkout code
28+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
29+
- name: setup go
30+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
31+
with:
32+
go-version: ${{ matrix.go }}
33+
- name: run tests
34+
env:
35+
GHW_TESTING_SKIP_BLOCK: "1"
36+
GHW_TESTING_SKIP_GPU: "1"
37+
run: go test -v ./...
38+
39+
ubuntu-2004:
40+
runs-on: ubuntu-20.04
41+
strategy:
42+
matrix:
43+
go: [ '1.18', '1.19']
44+
steps:
45+
- name: harden runner
46+
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
47+
with:
48+
egress-policy: block
49+
disable-sudo: true
50+
- name: checkout code
51+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
52+
- name: setup go
53+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
54+
with:
55+
go-version: ${{ matrix.go }}
56+
- name: run tests
57+
env:
58+
GHW_TESTING_SKIP_BLOCK: "1"
59+
GHW_TESTING_SKIP_GPU: "1"
60+
run: go test -v ./...
61+
62+
windows-2022:
63+
runs-on: windows-2022
64+
strategy:
65+
matrix:
66+
go: [ '1.19' ]
67+
steps:
68+
- name: harden runner
69+
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
70+
with:
71+
egress-policy: block
72+
disable-sudo: true
73+
- name: checkout code
74+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
75+
- name: setup go
76+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
77+
with:
78+
go-version: ${{ matrix.go }}
79+
- name: run tests
80+
env:
81+
GHW_TESTING_SKIP_BLOCK: "1"
82+
GHW_TESTING_SKIP_GPU: "1"
83+
GHW_TESTING_SKIP_CPU: "1"
84+
GHW_TESTING_SKIP_MEMORY: "1"
85+
GHW_TESTING_SKIP_HOST: "1"
86+
GHW_TESTING_SKIP_NET: "1"
87+
GHW_TESTING_SKIP_PCI: "1"
88+
GHW_TESTING_SKIP_TOPOLOGY: "1"
89+
run: go test -v ./...
90+
91+
windows-2019:
92+
runs-on: windows-2019
93+
strategy:
94+
matrix:
95+
go: [ '1.18' ]
96+
steps:
97+
- name: harden runner
98+
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
99+
with:
100+
egress-policy: block
101+
disable-sudo: true
102+
- name: checkout code
103+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
104+
- name: setup go
105+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
106+
with:
107+
go-version: ${{ matrix.go }}
108+
- name: run tests
109+
env:
110+
GHW_TESTING_SKIP_BLOCK: "1"
111+
GHW_TESTING_SKIP_GPU: "1"
112+
GHW_TESTING_SKIP_CPU: "1"
113+
GHW_TESTING_SKIP_MEMORY: "1"
114+
GHW_TESTING_SKIP_HOST: "1"
115+
GHW_TESTING_SKIP_NET: "1"
116+
GHW_TESTING_SKIP_PCI: "1"
117+
GHW_TESTING_SKIP_TOPOLOGY: "1"
118+
run: go test -v ./...
119+
120+
# tier-2
121+
# best-effort support, limited to most recent platforms (OS+go)
122+
123+
# NOTE(jaypipes): We currently only support block information on MacOS, and
124+
# the tests have block skipped because we cannot get meaningful information
125+
# about the block devices in the Github Actions Runner virtual machines. So
126+
# this is really just a test of whether the library builds on MacOS 12.
127+
macos-12:
128+
runs-on: macos-12
129+
strategy:
130+
matrix:
131+
go: [ '1.18' ]
132+
steps:
133+
- name: harden runner
134+
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
135+
with:
136+
egress-policy: block
137+
disable-sudo: true
138+
- name: checkout code
139+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
140+
- name: setup go
141+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
142+
with:
143+
go-version: ${{ matrix.go }}
144+
- name: run tests
145+
env:
146+
GHW_TESTING_SKIP_BLOCK: "1"
147+
GHW_TESTING_SKIP_CPU: "1"
148+
GHW_TESTING_SKIP_GPU: "1"
149+
GHW_TESTING_SKIP_HOST: "1"
150+
GHW_TESTING_SKIP_MEMORY: "1"
151+
GHW_TESTING_SKIP_NET: "1"
152+
GHW_TESTING_SKIP_PCI: "1"
153+
GHW_TESTING_SKIP_TOPOLOGY: "1"
154+
run: go test -v ./...

0 commit comments

Comments
 (0)