@@ -0,0 +1,93 @@ |
| 1 | +#!/usr/bin/env bash |
| 2 | +# SPDX-License-Identifier: AGPL-3.0-or-later |
| 3 | + |
| 4 | +set -eu |
| 5 | + |
| 6 | +ROOT="$(git rev-parse --show-toplevel)" |
| 7 | +cd "$ROOT" |
| 8 | + |
| 9 | +fail() { |
| 10 | + printf 'audit-actions-ga: %s\n' "$*" >&2 |
| 11 | + exit 1 |
| 12 | +} |
| 13 | + |
| 14 | +ok() { |
| 15 | + printf 'ok: %s\n' "$*" |
| 16 | +} |
| 17 | + |
| 18 | +require_file() { |
| 19 | + [ -f "$1" ] || fail "missing required file: $1" |
| 20 | + ok "found $1" |
| 21 | +} |
| 22 | + |
| 23 | +require_grep() { |
| 24 | + pattern="$1" |
| 25 | + file="$2" |
| 26 | + desc="$3" |
| 27 | + rg -q "$pattern" "$file" || fail "$desc not found in $file" |
| 28 | + ok "$desc" |
| 29 | +} |
| 30 | + |
| 31 | +require_file ".shithub/workflows/checkout-canary.yml" |
| 32 | +require_file "bench/fixtures/actions/checkout-canary.yml" |
| 33 | +require_file "bench/k6/actions-load.js" |
| 34 | +require_file "deploy/monitoring/grafana/dashboards/actions.json" |
| 35 | +require_file "deploy/monitoring/prometheus/rules.yml" |
| 36 | +require_file "deploy/runner-config/firewall.sh.j2" |
| 37 | +require_file "deploy/runner-config/dnsmasq.conf.j2" |
| 38 | +require_file "deploy/runner-config/seccomp.json" |
| 39 | +require_file "docs/internal/actions-ga-readiness.md" |
| 40 | +require_file "docs/internal/runbooks/actions.md" |
| 41 | +require_file "docs/internal/runbooks/runner-deploy.md" |
| 42 | +require_file "docs/public/user/actions.md" |
| 43 | +require_file "docs/public/api/actions.md" |
| 44 | + |
| 45 | +uses_hits="$(rg -n '^[[:space:]-]*uses:[[:space:]]*' .shithub/workflows -g '*.yml' -g '*.yaml' || true)" |
| 46 | +printf '%s\n' "$uses_hits" | while IFS= read -r hit; do |
| 47 | + [ -n "$hit" ] || continue |
| 48 | + ref="$(printf '%s' "$hit" | sed -E 's/.*uses:[[:space:]]*//; s/[[:space:]]+#.*$//; s/^"//; s/"$//; s/^[[:space:]]*//; s/[[:space:]]*$//')" |
| 49 | + ref="${ref#\'}" |
| 50 | + ref="${ref%\'}" |
| 51 | + case "$ref" in |
| 52 | + actions/checkout@v4|shithub/upload-artifact@v1|shithub/download-artifact@v1) |
| 53 | + ;; |
| 54 | + *) |
| 55 | + fail "unsupported .shithub workflow uses alias $ref in $hit" |
| 56 | + ;; |
| 57 | + esac |
| 58 | +done |
| 59 | +ok ".shithub workflows use only v1-supported aliases" |
| 60 | + |
| 61 | +require_grep 'actions/setup-go@v5' ".github/workflows/ci.yml" "GitHub CI still documents setup-go dependency" |
| 62 | +require_grep 'golangci/golangci-lint-action@v8' ".github/workflows/ci.yml" "GitHub CI still documents golangci action dependency" |
| 63 | +require_grep 'Do not move `.github/workflows/ci.yml`' "docs/internal/actions-ga-readiness.md" "dogfood decision" |
| 64 | + |
| 65 | +for alert in \ |
| 66 | + ActionsRunnerHeartbeatStale \ |
| 67 | + ActionsQueueDepthHigh \ |
| 68 | + ActionsRunDurationP99Regressed \ |
| 69 | + ActionsLogScrubberPossiblyMissing |
| 70 | +do |
| 71 | + require_grep "$alert" "deploy/monitoring/prometheus/rules.yml" "alert $alert" |
| 72 | +done |
| 73 | + |
| 74 | +for metric in \ |
| 75 | + shithub_actions_queue_depth \ |
| 76 | + shithub_actions_active \ |
| 77 | + shithub_actions_runner_heartbeat_age_seconds \ |
| 78 | + shithub_actions_run_duration_seconds \ |
| 79 | + shithub_actions_log_chunk_bytes_total |
| 80 | +do |
| 81 | + require_grep "$metric" "docs/internal/runbooks/observability.md" "observability doc metric $metric" |
| 82 | +done |
| 83 | + |
| 84 | +require_grep 'runner_jwt_used' "docs/internal/actions-schema.md" "runner JWT replay table documentation" |
| 85 | +require_grep 'workflow_job_secret_masks' "docs/internal/actions-schema.md" "claim-time mask table documentation" |
| 86 | +require_grep 'direct-IP' "docs/internal/runbooks/runner-deploy.md" "direct-IP egress mitigation" |
| 87 | +require_grep 'checkout token leaked into argv' "internal/runner/engine/docker_test.go" "checkout-token argv regression test" |
| 88 | +require_grep 'checkout token push unexpectedly succeeded' "internal/web/handlers/githttp/githttp_test.go" "checkout-token push denial test" |
| 89 | +require_grep 'TestEval_GithubAliasIsTainted' "internal/actions/expr/eval_test.go" "github alias taint test" |
| 90 | +require_grep 'Actions workflow API' "docs/public/SUMMARY.md" "public Actions API docs link" |
| 91 | +require_grep '\[Actions\]\(\./user/actions\.md\)' "docs/public/SUMMARY.md" "public Actions user docs link" |
| 92 | + |
| 93 | +ok "S41h Actions pre-GA static audit packet complete" |