@@ -0,0 +1,93 @@ |
| | 1 | +#!/usr/bin/env bash |
| | 2 | +# SPDX-License-Identifier: AGPL-3.0-or-later |
| | 3 | + |
| | 4 | +set -eu |
| | 5 | + |
| | 6 | +ROOT="$(git rev-parse --show-toplevel)" |
| | 7 | +cd "$ROOT" |
| | 8 | + |
| | 9 | +fail() { |
| | 10 | + printf 'audit-actions-ga: %s\n' "$*" >&2 |
| | 11 | + exit 1 |
| | 12 | +} |
| | 13 | + |
| | 14 | +ok() { |
| | 15 | + printf 'ok: %s\n' "$*" |
| | 16 | +} |
| | 17 | + |
| | 18 | +require_file() { |
| | 19 | + [ -f "$1" ] || fail "missing required file: $1" |
| | 20 | + ok "found $1" |
| | 21 | +} |
| | 22 | + |
| | 23 | +require_grep() { |
| | 24 | + pattern="$1" |
| | 25 | + file="$2" |
| | 26 | + desc="$3" |
| | 27 | + rg -q "$pattern" "$file" || fail "$desc not found in $file" |
| | 28 | + ok "$desc" |
| | 29 | +} |
| | 30 | + |
| | 31 | +require_file ".shithub/workflows/checkout-canary.yml" |
| | 32 | +require_file "bench/fixtures/actions/checkout-canary.yml" |
| | 33 | +require_file "bench/k6/actions-load.js" |
| | 34 | +require_file "deploy/monitoring/grafana/dashboards/actions.json" |
| | 35 | +require_file "deploy/monitoring/prometheus/rules.yml" |
| | 36 | +require_file "deploy/runner-config/firewall.sh.j2" |
| | 37 | +require_file "deploy/runner-config/dnsmasq.conf.j2" |
| | 38 | +require_file "deploy/runner-config/seccomp.json" |
| | 39 | +require_file "docs/internal/actions-ga-readiness.md" |
| | 40 | +require_file "docs/internal/runbooks/actions.md" |
| | 41 | +require_file "docs/internal/runbooks/runner-deploy.md" |
| | 42 | +require_file "docs/public/user/actions.md" |
| | 43 | +require_file "docs/public/api/actions.md" |
| | 44 | + |
| | 45 | +uses_hits="$(rg -n '^[[:space:]-]*uses:[[:space:]]*' .shithub/workflows -g '*.yml' -g '*.yaml' || true)" |
| | 46 | +printf '%s\n' "$uses_hits" | while IFS= read -r hit; do |
| | 47 | + [ -n "$hit" ] || continue |
| | 48 | + ref="$(printf '%s' "$hit" | sed -E 's/.*uses:[[:space:]]*//; s/[[:space:]]+#.*$//; s/^"//; s/"$//; s/^[[:space:]]*//; s/[[:space:]]*$//')" |
| | 49 | + ref="${ref#\'}" |
| | 50 | + ref="${ref%\'}" |
| | 51 | + case "$ref" in |
| | 52 | + actions/checkout@v4|shithub/upload-artifact@v1|shithub/download-artifact@v1) |
| | 53 | + ;; |
| | 54 | + *) |
| | 55 | + fail "unsupported .shithub workflow uses alias $ref in $hit" |
| | 56 | + ;; |
| | 57 | + esac |
| | 58 | +done |
| | 59 | +ok ".shithub workflows use only v1-supported aliases" |
| | 60 | + |
| | 61 | +require_grep 'actions/setup-go@v5' ".github/workflows/ci.yml" "GitHub CI still documents setup-go dependency" |
| | 62 | +require_grep 'golangci/golangci-lint-action@v8' ".github/workflows/ci.yml" "GitHub CI still documents golangci action dependency" |
| | 63 | +require_grep 'Do not move `.github/workflows/ci.yml`' "docs/internal/actions-ga-readiness.md" "dogfood decision" |
| | 64 | + |
| | 65 | +for alert in \ |
| | 66 | + ActionsRunnerHeartbeatStale \ |
| | 67 | + ActionsQueueDepthHigh \ |
| | 68 | + ActionsRunDurationP99Regressed \ |
| | 69 | + ActionsLogScrubberPossiblyMissing |
| | 70 | +do |
| | 71 | + require_grep "$alert" "deploy/monitoring/prometheus/rules.yml" "alert $alert" |
| | 72 | +done |
| | 73 | + |
| | 74 | +for metric in \ |
| | 75 | + shithub_actions_queue_depth \ |
| | 76 | + shithub_actions_active \ |
| | 77 | + shithub_actions_runner_heartbeat_age_seconds \ |
| | 78 | + shithub_actions_run_duration_seconds \ |
| | 79 | + shithub_actions_log_chunk_bytes_total |
| | 80 | +do |
| | 81 | + require_grep "$metric" "docs/internal/runbooks/observability.md" "observability doc metric $metric" |
| | 82 | +done |
| | 83 | + |
| | 84 | +require_grep 'runner_jwt_used' "docs/internal/actions-schema.md" "runner JWT replay table documentation" |
| | 85 | +require_grep 'workflow_job_secret_masks' "docs/internal/actions-schema.md" "claim-time mask table documentation" |
| | 86 | +require_grep 'direct-IP' "docs/internal/runbooks/runner-deploy.md" "direct-IP egress mitigation" |
| | 87 | +require_grep 'checkout token leaked into argv' "internal/runner/engine/docker_test.go" "checkout-token argv regression test" |
| | 88 | +require_grep 'checkout token push unexpectedly succeeded' "internal/web/handlers/githttp/githttp_test.go" "checkout-token push denial test" |
| | 89 | +require_grep 'TestEval_GithubAliasIsTainted' "internal/actions/expr/eval_test.go" "github alias taint test" |
| | 90 | +require_grep 'Actions workflow API' "docs/public/SUMMARY.md" "public Actions API docs link" |
| | 91 | +require_grep '\[Actions\]\(\./user/actions\.md\)' "docs/public/SUMMARY.md" "public Actions user docs link" |
| | 92 | + |
| | 93 | +ok "S41h Actions pre-GA static audit packet complete" |