mirror of
https://github.com/actions/cache.git
synced 2026-08-22 08:23:01 +00:00
Clean up GCS fork: minimal changeset vs upstream actions/cache
Realign the fork so it diffs from upstream actions/cache only by the GCS cache backend, instead of carrying unrelated downgrades and deletions. - Restore package.json/package-lock.json to upstream 5.0.4 deps; the fork had downgraded to 4.2.x. Re-add @google-cloud/storage (gcsCache.ts needs it). - Rebuild dist/ against the restored deps so it bundles the real GCS client rather than a stale build against downgraded deps. - Restore deleted upstream files: 7 workflow YAMLs, .github/CODEOWNERS, .licensed.yml. (To be disabled in the fork, not removed.) - Revert action.yml/restore/save manifests to upstream name/description/ author; keep only the gcs-bucket/gcs-path-prefix inputs as the fork diff. - auto-tag.yml: track upstream's highest semver release tag, moving both the exact-version tag and the major alias, instead of force-pinning v1. - Remove checkout/ composite action; relocated to Cula-Technologies/checkout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
be02de94c3
commit
5ed4dd939d
1
.github/CODEOWNERS
vendored
Normal file
1
.github/CODEOWNERS
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
* @actions/actions-cache
|
||||||
45
.github/workflows/auto-tag.yml
vendored
45
.github/workflows/auto-tag.yml
vendored
@ -1,5 +1,11 @@
|
|||||||
name: Auto-tag main
|
name: Auto-tag main
|
||||||
|
|
||||||
|
# Keeps this fork's release tags in lockstep with upstream actions/cache.
|
||||||
|
# On every push to main we look up upstream's highest semver release tag and
|
||||||
|
# point both that exact-version tag (e.g. v5.0.5) and its moving major alias
|
||||||
|
# (e.g. v5) at the current commit. Consumers can therefore pin
|
||||||
|
# Cula-Technologies/cache@v5 and stay aligned with upstream's major line.
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches: [main]
|
branches: [main]
|
||||||
@ -11,8 +17,39 @@ jobs:
|
|||||||
tag:
|
tag:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- name: Checkout
|
||||||
- name: Force-update v1 tag
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Sync release tags with upstream actions/cache
|
||||||
run: |
|
run: |
|
||||||
git tag -f v1
|
set -euo pipefail
|
||||||
git push -f origin v1
|
|
||||||
|
git config user.name "github-actions[bot]"
|
||||||
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||||
|
|
||||||
|
UPSTREAM="https://github.com/actions/cache.git"
|
||||||
|
|
||||||
|
# Highest upstream stable release tag (vMAJOR.MINOR.PATCH), by semver.
|
||||||
|
LATEST=$(git ls-remote --tags --refs "$UPSTREAM" \
|
||||||
|
| awk -F/ '{print $NF}' \
|
||||||
|
| grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
|
||||||
|
| sort -V \
|
||||||
|
| tail -n1)
|
||||||
|
|
||||||
|
if [ -z "$LATEST" ]; then
|
||||||
|
echo "Could not determine upstream latest release tag" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
MAJOR="${LATEST%%.*}" # e.g. v5.0.5 -> v5
|
||||||
|
|
||||||
|
echo "Upstream latest release: $LATEST (major alias: $MAJOR)"
|
||||||
|
|
||||||
|
# Point the exact-version tag and the moving major alias at this commit.
|
||||||
|
git tag -f "$LATEST"
|
||||||
|
git tag -f "$MAJOR"
|
||||||
|
|
||||||
|
git push -f origin "refs/tags/$LATEST"
|
||||||
|
git push -f origin "refs/tags/$MAJOR"
|
||||||
|
|||||||
23
.github/workflows/close-inactive-issues.yml
vendored
Normal file
23
.github/workflows/close-inactive-issues.yml
vendored
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
name: Close inactive issues
|
||||||
|
|
||||||
|
on:
|
||||||
|
schedule:
|
||||||
|
- cron: "30 8 * * *"
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
close-issues:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
permissions:
|
||||||
|
issues: write
|
||||||
|
pull-requests: write
|
||||||
|
steps:
|
||||||
|
- uses: actions/stale@v9
|
||||||
|
with:
|
||||||
|
days-before-issue-stale: 200
|
||||||
|
days-before-issue-close: 5
|
||||||
|
stale-issue-label: "stale"
|
||||||
|
stale-issue-message: "This issue is stale because it has been open for 200 days with no activity. Leave a comment to avoid closing this issue in 5 days."
|
||||||
|
close-issue-message: "This issue was closed because it has been inactive for 5 days since being marked as stale."
|
||||||
|
days-before-pr-stale: -1
|
||||||
|
days-before-pr-close: -1
|
||||||
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
21
.github/workflows/issue-opened-workflow.yml
vendored
Normal file
21
.github/workflows/issue-opened-workflow.yml
vendored
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
name: Assign issue
|
||||||
|
|
||||||
|
on:
|
||||||
|
issues:
|
||||||
|
types: [opened]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
issues: write
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
run-action:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Get current oncall
|
||||||
|
id: oncall
|
||||||
|
run: |
|
||||||
|
echo "CURRENT=$(curl --request GET 'https://api.pagerduty.com/oncalls?include[]=users&schedule_ids[]=P5VG2BX&earliest=true' --header 'Authorization: Token token=${{ secrets.PAGERDUTY_TOKEN }}' --header 'Accept: application/vnd.pagerduty+json;version=2' --header 'Content-Type: application/json' | jq -r '.oncalls[].user.name')" >> $GITHUB_OUTPUT
|
||||||
|
|
||||||
|
- name: add_assignees
|
||||||
|
run: |
|
||||||
|
curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN}}" https://api.github.com/repos/${{github.repository}}/issues/${{ github.event.issue.number}}/assignees -d '{"assignees":["${{steps.oncall.outputs.CURRENT}}"]}'
|
||||||
43
.github/workflows/licensed.yml
vendored
Normal file
43
.github/workflows/licensed.yml
vendored
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
name: License check
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
pull_request:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
workflow_dispatch:
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
validate-cached-dependency-records:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
name: Check licenses
|
||||||
|
steps:
|
||||||
|
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v5
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: npm ci --ignore-scripts
|
||||||
|
|
||||||
|
- name: Set up Ruby
|
||||||
|
uses: ruby/setup-ruby@v1
|
||||||
|
with:
|
||||||
|
ruby-version: '3.1.7'
|
||||||
|
|
||||||
|
- name: Install licensed tool
|
||||||
|
run: |
|
||||||
|
cd "$RUNNER_TEMP"
|
||||||
|
curl -Lfs -o licensed.tar.gz https://github.com/licensee/licensed/archive/refs/tags/v5.0.4.tar.gz
|
||||||
|
tar -xzf licensed.tar.gz
|
||||||
|
cd licensed-5.0.4
|
||||||
|
bundle install
|
||||||
|
|
||||||
|
- name: Check cached dependency records
|
||||||
|
run: |
|
||||||
|
cd ${{ github.workspace }}
|
||||||
|
BUNDLE_GEMFILE=$RUNNER_TEMP/licensed-5.0.4/Gemfile bundle exec $RUNNER_TEMP/licensed-5.0.4/exe/licensed status
|
||||||
25
.github/workflows/pr-opened-workflow.yml
vendored
Normal file
25
.github/workflows/pr-opened-workflow.yml
vendored
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
name: Assign pull request reviewer
|
||||||
|
|
||||||
|
on:
|
||||||
|
pull_request_target:
|
||||||
|
types: [opened]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
pull-requests: write
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
run-action:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Get current oncall
|
||||||
|
id: oncall
|
||||||
|
run: |
|
||||||
|
echo "CURRENT=$(curl --request GET 'https://api.pagerduty.com/oncalls?include[]=users&schedule_ids[]=P5VG2BX&earliest=true' --header 'Authorization: Token token=${{ secrets.PAGERDUTY_TOKEN }}' --header 'Accept: application/vnd.pagerduty+json;version=2' --header 'Content-Type: application/json' | jq -r '.oncalls[].user.name')" >> $GITHUB_OUTPUT
|
||||||
|
|
||||||
|
- name: Request Review
|
||||||
|
run: |
|
||||||
|
curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN}}" https://api.github.com/repos/${{github.repository}}/pulls/${{ github.event.pull_request.number}}/requested_reviewers -d '{"reviewers":["${{steps.oncall.outputs.CURRENT}}"]}'
|
||||||
|
|
||||||
|
- name: Add Assignee
|
||||||
|
run: |
|
||||||
|
curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN}}" https://api.github.com/repos/${{github.repository}}/issues/${{ github.event.pull_request.number}}/assignees -d '{"assignees":["${{steps.oncall.outputs.CURRENT}}"]}'
|
||||||
20
.github/workflows/publish-immutable-actions.yml
vendored
Normal file
20
.github/workflows/publish-immutable-actions.yml
vendored
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
name: Publish immutable action
|
||||||
|
|
||||||
|
on:
|
||||||
|
release:
|
||||||
|
types: [released]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
id-token: write
|
||||||
|
packages: write
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
publish:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Checking out
|
||||||
|
uses: actions/checkout@v5
|
||||||
|
- name: Publish
|
||||||
|
id: publish
|
||||||
|
uses: actions/publish-immutable-action@0.0.3
|
||||||
30
.github/workflows/release-new-action-version.yml
vendored
Normal file
30
.github/workflows/release-new-action-version.yml
vendored
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
name: Release new action version
|
||||||
|
|
||||||
|
on:
|
||||||
|
release:
|
||||||
|
types: [released]
|
||||||
|
workflow_dispatch:
|
||||||
|
inputs:
|
||||||
|
TAG_NAME:
|
||||||
|
description: 'Tag name that the major tag will point to'
|
||||||
|
required: true
|
||||||
|
|
||||||
|
env:
|
||||||
|
TAG_NAME: ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }}
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: write
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
update_tag:
|
||||||
|
name: Update the major tag to include the ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }} changes
|
||||||
|
environment:
|
||||||
|
name: releaseNewActionVersion
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Update the ${{ env.TAG_NAME }} tag
|
||||||
|
id: update-major-tag
|
||||||
|
uses: actions/publish-action@v0.3.0
|
||||||
|
with:
|
||||||
|
source-tag: ${{ env.TAG_NAME }}
|
||||||
|
slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
|
||||||
276
.github/workflows/workflow.yml
vendored
Normal file
276
.github/workflows/workflow.yml
vendored
Normal file
@ -0,0 +1,276 @@
|
|||||||
|
name: Tests
|
||||||
|
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
- releases/**
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
- releases/**
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
# Build and unit test
|
||||||
|
build:
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
os: [ubuntu-latest, windows-latest, macOS-latest]
|
||||||
|
fail-fast: false
|
||||||
|
runs-on: ${{ matrix.os }}
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v5
|
||||||
|
- name: Setup Node.js 24.x
|
||||||
|
uses: actions/setup-node@v4
|
||||||
|
with:
|
||||||
|
node-version: 24.x
|
||||||
|
cache: npm
|
||||||
|
- run: npm ci
|
||||||
|
- name: Prettier Format Check
|
||||||
|
run: npm run format-check
|
||||||
|
- name: ESLint Check
|
||||||
|
run: npm run lint
|
||||||
|
- name: Build & Test
|
||||||
|
run: npm run test
|
||||||
|
|
||||||
|
# End to end save and restore
|
||||||
|
test-save:
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
os: [ubuntu-latest, windows-latest, macOS-latest]
|
||||||
|
fail-fast: false
|
||||||
|
runs-on: ${{ matrix.os }}
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v5
|
||||||
|
- name: Generate files in working directory
|
||||||
|
shell: bash
|
||||||
|
run: __tests__/create-cache-files.sh ${{ runner.os }} test-cache
|
||||||
|
- name: Generate files outside working directory
|
||||||
|
shell: bash
|
||||||
|
run: __tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache
|
||||||
|
- name: Save cache
|
||||||
|
uses: ./
|
||||||
|
with:
|
||||||
|
key: test-${{ runner.os }}-${{ github.run_id }}
|
||||||
|
path: |
|
||||||
|
test-cache
|
||||||
|
~/test-cache
|
||||||
|
|
||||||
|
test-restore:
|
||||||
|
needs: test-save
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
os: [ubuntu-latest, windows-latest, macOS-latest]
|
||||||
|
fail-fast: false
|
||||||
|
runs-on: ${{ matrix.os }}
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v5
|
||||||
|
- name: Restore cache
|
||||||
|
uses: ./
|
||||||
|
with:
|
||||||
|
key: test-${{ runner.os }}-${{ github.run_id }}
|
||||||
|
path: |
|
||||||
|
test-cache
|
||||||
|
~/test-cache
|
||||||
|
- name: Verify cache files in working directory
|
||||||
|
shell: bash
|
||||||
|
run: __tests__/verify-cache-files.sh ${{ runner.os }} test-cache
|
||||||
|
- name: Verify cache files outside working directory
|
||||||
|
shell: bash
|
||||||
|
run: __tests__/verify-cache-files.sh ${{ runner.os }} ~/test-cache
|
||||||
|
|
||||||
|
# End to end with proxy
|
||||||
|
test-proxy-save:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: ubuntu:latest
|
||||||
|
options: --cap-add=NET_ADMIN
|
||||||
|
services:
|
||||||
|
squid-proxy:
|
||||||
|
image: ubuntu/squid:latest
|
||||||
|
ports:
|
||||||
|
- 3128:3128
|
||||||
|
env:
|
||||||
|
http_proxy: http://squid-proxy:3128
|
||||||
|
https_proxy: http://squid-proxy:3128
|
||||||
|
steps:
|
||||||
|
- name: Wait for proxy to be ready
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
echo "Waiting for squid proxy to be ready..."
|
||||||
|
echo "Resolving squid-proxy hostname:"
|
||||||
|
getent hosts squid-proxy || echo "DNS resolution failed"
|
||||||
|
for i in $(seq 1 30); do
|
||||||
|
if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then
|
||||||
|
echo "Proxy is ready!"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
echo "Attempt $i: Proxy not ready, waiting..."
|
||||||
|
sleep 2
|
||||||
|
done
|
||||||
|
echo "Proxy failed to become ready"
|
||||||
|
exit 1
|
||||||
|
env:
|
||||||
|
http_proxy: ""
|
||||||
|
https_proxy: ""
|
||||||
|
- name: Install dependencies
|
||||||
|
run: |
|
||||||
|
apt-get update
|
||||||
|
apt-get install -y iptables curl
|
||||||
|
- name: Verify proxy is working
|
||||||
|
run: |
|
||||||
|
echo "Testing proxy connectivity..."
|
||||||
|
curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true
|
||||||
|
echo "Proxy verification complete"
|
||||||
|
- name: Block direct traffic (enforce proxy usage)
|
||||||
|
run: |
|
||||||
|
# Get the squid-proxy container IP
|
||||||
|
PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
|
||||||
|
echo "Proxy IP: $PROXY_IP"
|
||||||
|
|
||||||
|
# Allow loopback traffic
|
||||||
|
iptables -A OUTPUT -o lo -j ACCEPT
|
||||||
|
|
||||||
|
# Allow traffic to the proxy container
|
||||||
|
iptables -A OUTPUT -d $PROXY_IP -j ACCEPT
|
||||||
|
|
||||||
|
# Allow established connections
|
||||||
|
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
|
||||||
|
# Allow DNS (needed for initial resolution)
|
||||||
|
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
|
||||||
|
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
|
||||||
|
|
||||||
|
# Block all other outbound traffic (HTTP/HTTPS)
|
||||||
|
iptables -A OUTPUT -p tcp --dport 80 -j REJECT
|
||||||
|
iptables -A OUTPUT -p tcp --dport 443 -j REJECT
|
||||||
|
|
||||||
|
# Log the iptables rules for debugging
|
||||||
|
iptables -L -v -n
|
||||||
|
- name: Verify direct HTTPS is blocked
|
||||||
|
run: |
|
||||||
|
echo "Testing that direct HTTPS requests fail..."
|
||||||
|
if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then
|
||||||
|
echo "ERROR: Direct HTTPS request succeeded - blocking is not working!"
|
||||||
|
exit 1
|
||||||
|
else
|
||||||
|
echo "SUCCESS: Direct HTTPS request was blocked as expected"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Testing that HTTPS through proxy succeeds..."
|
||||||
|
if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then
|
||||||
|
echo "SUCCESS: HTTPS request through proxy succeeded"
|
||||||
|
else
|
||||||
|
echo "ERROR: HTTPS request through proxy failed!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v5
|
||||||
|
- name: Generate files
|
||||||
|
run: __tests__/create-cache-files.sh proxy test-cache
|
||||||
|
- name: Save cache
|
||||||
|
uses: ./
|
||||||
|
with:
|
||||||
|
key: test-proxy-${{ github.run_id }}
|
||||||
|
path: test-cache
|
||||||
|
|
||||||
|
test-proxy-restore:
|
||||||
|
needs: test-proxy-save
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: ubuntu:latest
|
||||||
|
options: --cap-add=NET_ADMIN
|
||||||
|
services:
|
||||||
|
squid-proxy:
|
||||||
|
image: ubuntu/squid:latest
|
||||||
|
ports:
|
||||||
|
- 3128:3128
|
||||||
|
env:
|
||||||
|
http_proxy: http://squid-proxy:3128
|
||||||
|
https_proxy: http://squid-proxy:3128
|
||||||
|
steps:
|
||||||
|
- name: Wait for proxy to be ready
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
echo "Waiting for squid proxy to be ready..."
|
||||||
|
echo "Resolving squid-proxy hostname:"
|
||||||
|
getent hosts squid-proxy || echo "DNS resolution failed"
|
||||||
|
for i in $(seq 1 30); do
|
||||||
|
if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then
|
||||||
|
echo "Proxy is ready!"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
echo "Attempt $i: Proxy not ready, waiting..."
|
||||||
|
sleep 2
|
||||||
|
done
|
||||||
|
echo "Proxy failed to become ready"
|
||||||
|
exit 1
|
||||||
|
env:
|
||||||
|
http_proxy: ""
|
||||||
|
https_proxy: ""
|
||||||
|
- name: Install dependencies
|
||||||
|
run: |
|
||||||
|
apt-get update
|
||||||
|
apt-get install -y iptables curl
|
||||||
|
- name: Verify proxy is working
|
||||||
|
run: |
|
||||||
|
echo "Testing proxy connectivity..."
|
||||||
|
curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true
|
||||||
|
echo "Proxy verification complete"
|
||||||
|
- name: Block direct traffic (enforce proxy usage)
|
||||||
|
run: |
|
||||||
|
# Get the squid-proxy container IP
|
||||||
|
PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
|
||||||
|
echo "Proxy IP: $PROXY_IP"
|
||||||
|
|
||||||
|
# Allow loopback traffic
|
||||||
|
iptables -A OUTPUT -o lo -j ACCEPT
|
||||||
|
|
||||||
|
# Allow traffic to the proxy container
|
||||||
|
iptables -A OUTPUT -d $PROXY_IP -j ACCEPT
|
||||||
|
|
||||||
|
# Allow established connections
|
||||||
|
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
|
||||||
|
# Allow DNS (needed for initial resolution)
|
||||||
|
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
|
||||||
|
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
|
||||||
|
|
||||||
|
# Block all other outbound traffic (HTTP/HTTPS)
|
||||||
|
iptables -A OUTPUT -p tcp --dport 80 -j REJECT
|
||||||
|
iptables -A OUTPUT -p tcp --dport 443 -j REJECT
|
||||||
|
|
||||||
|
# Log the iptables rules for debugging
|
||||||
|
iptables -L -v -n
|
||||||
|
- name: Verify direct HTTPS is blocked
|
||||||
|
run: |
|
||||||
|
echo "Testing that direct HTTPS requests fail..."
|
||||||
|
if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then
|
||||||
|
echo "ERROR: Direct HTTPS request succeeded - blocking is not working!"
|
||||||
|
exit 1
|
||||||
|
else
|
||||||
|
echo "SUCCESS: Direct HTTPS request was blocked as expected"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Testing that HTTPS through proxy succeeds..."
|
||||||
|
if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then
|
||||||
|
echo "SUCCESS: HTTPS request through proxy succeeded"
|
||||||
|
else
|
||||||
|
echo "ERROR: HTTPS request through proxy failed!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v5
|
||||||
|
- name: Restore cache
|
||||||
|
uses: ./
|
||||||
|
with:
|
||||||
|
key: test-proxy-${{ github.run_id }}
|
||||||
|
path: test-cache
|
||||||
|
- name: Verify cache
|
||||||
|
run: __tests__/verify-cache-files.sh proxy test-cache
|
||||||
31
.licensed.yml
Normal file
31
.licensed.yml
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
sources:
|
||||||
|
npm: true
|
||||||
|
|
||||||
|
# Force UTF-8 encoding
|
||||||
|
encoding: 'utf-8'
|
||||||
|
|
||||||
|
# Ignore problematic packages with encoding issues
|
||||||
|
ignored:
|
||||||
|
npm:
|
||||||
|
- form-data
|
||||||
|
|
||||||
|
allowed:
|
||||||
|
- apache-2.0
|
||||||
|
- bsd-2-clause
|
||||||
|
- bsd-3-clause
|
||||||
|
- isc
|
||||||
|
- mit
|
||||||
|
- cc0-1.0
|
||||||
|
- unlicense
|
||||||
|
- 0bsd
|
||||||
|
|
||||||
|
reviewed:
|
||||||
|
npm:
|
||||||
|
- sax
|
||||||
|
- "@protobuf-ts/plugin-framework" # Apache-2.0
|
||||||
|
- "@protobuf-ts/runtime" # Apache-2.0
|
||||||
|
- fs.realpath # ISC
|
||||||
|
- glob # ISC
|
||||||
|
- prettier # MIT
|
||||||
|
- lodash # MIT
|
||||||
|
- "@actions/http-client" # MIT
|
||||||
@ -1,6 +1,6 @@
|
|||||||
name: 'Cache with GCS Support'
|
name: 'Cache'
|
||||||
description: 'Cache artifacts to Google Cloud Storage or GitHub with automatic fallback'
|
description: 'Cache artifacts like dependencies and build outputs to improve workflow execution time'
|
||||||
author: 'danySam'
|
author: 'GitHub'
|
||||||
inputs:
|
inputs:
|
||||||
path:
|
path:
|
||||||
description: 'A list of files, directories, and wildcard patterns to cache and restore'
|
description: 'A list of files, directories, and wildcard patterns to cache and restore'
|
||||||
|
|||||||
@ -1,57 +0,0 @@
|
|||||||
name: 'Checkout (GCS-cached)'
|
|
||||||
description: "Restore the repo working tree from GCS keyed on commit SHA, falling back to actions/checkout on miss. Always populates with full history + blob:none so every downstream job in the same run gets the same tarball regardless of its stated depth/filter needs."
|
|
||||||
inputs:
|
|
||||||
ref:
|
|
||||||
description: 'Branch, tag or SHA to check out on cache miss. Defaults to the workflow ref.'
|
|
||||||
required: false
|
|
||||||
default: ''
|
|
||||||
gcs-bucket:
|
|
||||||
description: 'GCS bucket holding the cached working trees. When empty, cache is bypassed and this step is a plain actions/checkout.'
|
|
||||||
required: false
|
|
||||||
default: 'cula-warpbuild-ci-cache-ew1'
|
|
||||||
gcs-path-prefix:
|
|
||||||
description: 'Path prefix inside the bucket.'
|
|
||||||
required: false
|
|
||||||
default: 'github-checkout'
|
|
||||||
outputs:
|
|
||||||
cache-hit:
|
|
||||||
description: 'true when the working tree was restored from GCS.'
|
|
||||||
value: ${{ steps.restore.outputs.cache-hit }}
|
|
||||||
runs:
|
|
||||||
using: composite
|
|
||||||
steps:
|
|
||||||
- name: Restore working tree from GCS
|
|
||||||
id: restore
|
|
||||||
if: inputs.gcs-bucket != ''
|
|
||||||
uses: Cula-Technologies/cache/restore@v1
|
|
||||||
with:
|
|
||||||
path: .
|
|
||||||
key: repo-${{ github.sha }}
|
|
||||||
gcs-bucket: ${{ inputs.gcs-bucket }}
|
|
||||||
gcs-path-prefix: ${{ inputs.gcs-path-prefix }}
|
|
||||||
|
|
||||||
- name: Fresh checkout (cache miss)
|
|
||||||
if: steps.restore.outputs.cache-hit != 'true'
|
|
||||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
filter: blob:none
|
|
||||||
ref: ${{ inputs.ref }}
|
|
||||||
|
|
||||||
- name: Strip credentials before caching
|
|
||||||
if: inputs.gcs-bucket != '' && steps.restore.outputs.cache-hit != 'true'
|
|
||||||
shell: sh
|
|
||||||
run: |
|
|
||||||
# actions/checkout writes a token-bearing extraheader into .git/config; remove it
|
|
||||||
# so the cached tarball doesn't carry credentials across jobs. Use sh instead of
|
|
||||||
# bash so the step works in minimal container images (e.g. jest-runtime).
|
|
||||||
git -C "${GITHUB_WORKSPACE}" config --local --unset-all http.https://github.com/.extraheader || true
|
|
||||||
|
|
||||||
- name: Save working tree to GCS
|
|
||||||
if: inputs.gcs-bucket != '' && steps.restore.outputs.cache-hit != 'true'
|
|
||||||
uses: Cula-Technologies/cache/save@v1
|
|
||||||
with:
|
|
||||||
path: .
|
|
||||||
key: repo-${{ github.sha }}
|
|
||||||
gcs-bucket: ${{ inputs.gcs-bucket }}
|
|
||||||
gcs-path-prefix: ${{ inputs.gcs-path-prefix }}
|
|
||||||
118298
dist/restore-only/index.js
vendored
118298
dist/restore-only/index.js
vendored
File diff suppressed because one or more lines are too long
118298
dist/restore/index.js
vendored
118298
dist/restore/index.js
vendored
File diff suppressed because one or more lines are too long
118298
dist/save-only/index.js
vendored
118298
dist/save-only/index.js
vendored
File diff suppressed because one or more lines are too long
118298
dist/save/index.js
vendored
118298
dist/save/index.js
vendored
File diff suppressed because one or more lines are too long
9229
package-lock.json
generated
9229
package-lock.json
generated
File diff suppressed because it is too large
Load Diff
41
package.json
41
package.json
@ -1,6 +1,6 @@
|
|||||||
{
|
{
|
||||||
"name": "cache",
|
"name": "cache",
|
||||||
"version": "4.2.3",
|
"version": "5.0.4",
|
||||||
"private": true,
|
"private": true,
|
||||||
"description": "Cache dependencies and build outputs",
|
"description": "Cache dependencies and build outputs",
|
||||||
"main": "dist/restore/index.js",
|
"main": "dist/restore/index.js",
|
||||||
@ -23,30 +23,33 @@
|
|||||||
"author": "GitHub",
|
"author": "GitHub",
|
||||||
"license": "MIT",
|
"license": "MIT",
|
||||||
"dependencies": {
|
"dependencies": {
|
||||||
"@actions/cache": "^4.0.3",
|
"@actions/cache": "^5.0.5",
|
||||||
"@actions/core": "^1.11.1",
|
"@actions/core": "^2.0.3",
|
||||||
"@actions/exec": "^1.1.1",
|
"@actions/exec": "^2.0.0",
|
||||||
"@actions/io": "^1.1.3",
|
"@actions/io": "^2.0.0",
|
||||||
"@google-cloud/storage": "^7.16.0"
|
"@google-cloud/storage": "^7.16.0"
|
||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@types/jest": "^27.5.2",
|
"@types/jest": "^29.5.14",
|
||||||
"@types/nock": "^11.1.0",
|
"@types/nock": "^11.1.0",
|
||||||
"@types/node": "^16.18.3",
|
"@types/node": "^24.1.0",
|
||||||
"@typescript-eslint/eslint-plugin": "^5.45.0",
|
"@typescript-eslint/eslint-plugin": "^7.2.0",
|
||||||
"@typescript-eslint/parser": "^5.45.0",
|
"@typescript-eslint/parser": "^7.2.0",
|
||||||
"@vercel/ncc": "^0.38.3",
|
"@vercel/ncc": "^0.38.3",
|
||||||
"eslint": "^8.28.0",
|
"eslint": "^8.28.0",
|
||||||
"eslint-config-prettier": "^8.5.0",
|
"eslint-config-prettier": "^9.1.2",
|
||||||
"eslint-plugin-import": "^2.26.0",
|
"eslint-plugin-import": "^2.32.0",
|
||||||
"eslint-plugin-jest": "^26.9.0",
|
"eslint-plugin-jest": "^27.9.0",
|
||||||
"eslint-plugin-prettier": "^4.2.1",
|
"eslint-plugin-prettier": "^5.5.3",
|
||||||
"eslint-plugin-simple-import-sort": "^7.0.0",
|
"eslint-plugin-simple-import-sort": "^12.1.1",
|
||||||
"jest": "^28.1.3",
|
"jest": "^29.7.0",
|
||||||
"jest-circus": "^27.5.1",
|
"jest-circus": "^29.7.0",
|
||||||
"nock": "^13.2.9",
|
"nock": "^13.2.9",
|
||||||
"prettier": "^2.8.0",
|
"prettier": "^3.6.2",
|
||||||
"ts-jest": "^28.0.8",
|
"ts-jest": "^29.4.0",
|
||||||
"typescript": "^5.8.3"
|
"typescript": "^5.8.3"
|
||||||
|
},
|
||||||
|
"engines": {
|
||||||
|
"node": ">=24"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -1,6 +1,6 @@
|
|||||||
name: 'Restore Cache with GCS Support'
|
name: 'Restore Cache'
|
||||||
description: 'Restore cache artifacts from Google Cloud Storage or GitHub with automatic fallback'
|
description: 'Restore Cache artifacts like dependencies and build outputs to improve workflow execution time'
|
||||||
author: 'danySam'
|
author: 'GitHub'
|
||||||
inputs:
|
inputs:
|
||||||
path:
|
path:
|
||||||
description: 'A list of files, directories, and wildcard patterns to restore'
|
description: 'A list of files, directories, and wildcard patterns to restore'
|
||||||
|
|||||||
@ -1,6 +1,6 @@
|
|||||||
name: 'Save Cache with GCS Support'
|
name: 'Save a cache'
|
||||||
description: 'Save cache artifacts to Google Cloud Storage or GitHub with automatic fallback'
|
description: 'Save Cache artifacts like dependencies and build outputs to improve workflow execution time'
|
||||||
author: 'danySam'
|
author: 'GitHub'
|
||||||
inputs:
|
inputs:
|
||||||
path:
|
path:
|
||||||
description: 'A list of files, directories, and wildcard patterns to cache'
|
description: 'A list of files, directories, and wildcard patterns to cache'
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user