mirror of
https://github.com/Ed1s0nZ/CyberStrikeAI.git
synced 2026-09-17 15:12:24 +02:00
50 lines
2.3 KiB
YAML
50 lines
2.3 KiB
YAML
name: Process isolation
|
|
on:
|
|
push:
|
|
paths: ['internal/processguard/**', 'internal/runlease/**', 'internal/security/**', 'internal/handler/task*', 'internal/mcp/**', 'go.mod', 'go.sum', '.github/workflows/process-isolation.yml']
|
|
pull_request:
|
|
paths: ['internal/processguard/**', 'internal/runlease/**', 'internal/security/**', 'internal/handler/task*', 'internal/mcp/**', 'go.mod', 'go.sum', '.github/workflows/process-isolation.yml']
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
lifecycle:
|
|
strategy:
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
- run: go test -race ./internal/processguard ./internal/runlease
|
|
- name: Test Linux cgroup isolation
|
|
if: runner.os == 'Linux'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
case "$(docker info --format '{{.Architecture}}')" in
|
|
aarch64|arm64) fixture_arch=arm64 ;;
|
|
x86_64|amd64) fixture_arch=amd64 ;;
|
|
*) echo 'Unsupported Docker architecture' >&2; exit 1 ;;
|
|
esac
|
|
fixture_dir="$(mktemp -d)"
|
|
trap 'rm -rf "$fixture_dir"' EXIT
|
|
CGO_ENABLED=0 GOOS=linux GOARCH="$fixture_arch" go test ./internal/processguard -c -o "$fixture_dir/processguard.test"
|
|
docker run --rm --user 0 --privileged --cgroupns=private --network none --init \
|
|
--mount "type=bind,src=$fixture_dir/processguard.test,dst=/fixture,readonly" \
|
|
--entrypoint /bin/sh "${CSAI_TEST_IMAGE:-debian:bookworm-slim}" -c '
|
|
set -eu
|
|
mkdir /sys/fs/cgroup/infra /sys/fs/cgroup/csai-fixture
|
|
# cat may already have exited when its PID is visited.
|
|
for pid in $(cat /sys/fs/cgroup/cgroup.procs); do
|
|
echo "$pid" > /sys/fs/cgroup/infra/cgroup.procs 2>/dev/null || true
|
|
done
|
|
echo "+cpu +memory +pids" > /sys/fs/cgroup/cgroup.subtree_control
|
|
echo "+cpu +memory +pids" > /sys/fs/cgroup/csai-fixture/cgroup.subtree_control
|
|
export CSAI_TEST_CGROUP_ROOT=/sys/fs/cgroup/csai-fixture
|
|
exec /fixture -test.v -test.timeout=60s
|
|
'
|
|
- if: runner.os == 'Linux'
|
|
run: go test ./internal/security ./internal/handler ./internal/mcp
|