62 lines
2.7 KiB
JavaScript
62 lines
2.7 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { readFile } from 'node:fs/promises';
|
|
import test from 'node:test';
|
|
|
|
const workflowUrl = new URL('../examples/gitea-actions/forgeflow-approved-deploy.yml', import.meta.url);
|
|
const deployUrl = new URL('../examples/server/forgeflow-deploy', import.meta.url);
|
|
|
|
|
|
test('central approved workflow transports signed target evidence only to the root-owned deploy wrapper', async () => {
|
|
const workflow = await readFile(workflowUrl, 'utf8');
|
|
|
|
for (const input of [
|
|
'repository',
|
|
'environment',
|
|
'commit_sha',
|
|
'request_id',
|
|
'approval_id',
|
|
'approval_fingerprint',
|
|
'evidence_issued_at',
|
|
'evidence_signature',
|
|
]) {
|
|
assert.match(workflow, new RegExp(`\\b${input}:`));
|
|
}
|
|
assert.match(workflow, /\$\{\{ inputs\.repository \}\}/);
|
|
assert.doesNotMatch(workflow, /\$\{\{ gitea\.repository \}\}/);
|
|
assert.match(workflow, /FF_APPROVAL_ID.*FF_REQUEST_ID/s);
|
|
assert.match(workflow, /sudo \/usr\/local\/bin\/forgeflow-deploy/);
|
|
assert.doesNotMatch(workflow, /actions\/checkout/);
|
|
assert.doesNotMatch(workflow, /docker compose/);
|
|
assert.doesNotMatch(workflow, /git\s+-C/);
|
|
});
|
|
|
|
|
|
test('server wrapper verifies Ed25519 evidence before any live git or compose mutation', async () => {
|
|
const script = await readFile(deployUrl, 'utf8');
|
|
const verifyIndex = script.indexOf('openssl pkeyutl -verify');
|
|
const resetIndex = script.indexOf('git -C "$APP_DIR" reset --hard "$SHA"');
|
|
const composeIndex = script.indexOf('docker compose -f "$COMPOSE_FILE" up -d --build');
|
|
|
|
assert.ok(verifyIndex > 0, 'expected cryptographic verification');
|
|
assert.ok(resetIndex > verifyIndex, 'git reset must happen after evidence verification');
|
|
assert.ok(composeIndex > verifyIndex, 'compose mutation must happen after evidence verification');
|
|
assert.match(script, /EVIDENCE_PUBLIC_KEY_FILE="\/etc\/forgeflow\/evidence\.pub"/);
|
|
assert.match(script, /evidence_owner.*root/s);
|
|
assert.match(script, /8#022/);
|
|
assert.match(script, /EVIDENCE_ISSUED_AT >= now_epoch - 1800/);
|
|
assert.match(script, /"evidence_verified": \$EVIDENCE_VERIFIED/);
|
|
assert.match(script, /\(\( \$# == 3 \|\| \$# == 4 \|\| \$# == 8 \)\)/);
|
|
});
|
|
|
|
|
|
test('signed message fields match the AppOps evidence v1 contract and exclude runner-chosen workflow/ref', async () => {
|
|
const script = await readFile(deployUrl, 'utf8');
|
|
const marker = "printf 'forgeflow-evidence-v1\\n%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n'";
|
|
assert.ok(script.includes(marker));
|
|
assert.match(
|
|
script,
|
|
/"\$APPROVAL_ID"[\s\\]+"\$APPROVAL_FINGERPRINT"[\s\\]+"\$REPOSITORY"[\s\\]+"\$ENVIRONMENT"[\s\\]+"\$\{SHA,,\}"[\s\\]+"\$REQUEST_ID"[\s\\]+"\$EVIDENCE_ISSUED_AT"/s,
|
|
);
|
|
assert.doesNotMatch(script.slice(0, script.indexOf('APP_DIR=""')), /WORKFLOW|workflow|ref=/);
|
|
});
|