Files
nezha_domains/.github/workflows/test.yml
T
9ec6164f58 fix(security): harden server and service deletion lifecycle (#1220)
* test: TDD regression tests for GHSA-jx78-55p5-rwv5 stream quota enforcement

* Apply remaining changes

* fix: update action SHA allowlist and test assertions to match dependabot bump

* fix: close GHSA-jx78-55p5-rwv5 incomplete fix of GHSA-qjpp-gffx-2wm9

Finding 1 (Moderate): nil-guard reporterServer in delayCheck and notifyCheck.
ServerShared has its own lock independent of serviceResponseDataStoreLock, so
m := ServerShared.GetList() taken inside the worker can return a nil entry for
the reporter if the server was concurrently deleted. Previously this caused an
unrecovered SIGSEGV in the worker goroutine (and in the gRPC layer with no
recovery interceptor), taking down the whole instance.

Finding 2 (Low): nil-guard ss.services[id] in ServiceSentinel.Delete().
A caller-supplied id that is absent from the registry caused
ss.services[id].CronJobID to panic, aborting the Delete loop and leaving every
subsequent valid id as a zombie service (DB row deleted, in-memory entry kept,
cron probe still running).

Regression tests added for both findings following the existing
servicesentinel_lifecycle_test.go patterns.

* Apply remaining changes

* chore: replace commit hashes with version tags in test.yml

* fix(server): serialize authoritative lifecycle changes

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(service): bind reports to reporter lifecycle

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(rpc): reject results from stale task streams

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(agentcompat): allow version-tagged actions

* fix(agentcompat): allow literal checkout refs

* refactor(agentcompat): remove SHA resolver policy

* test(agentcompat): remove resolver SHA fixtures

* test(agentcompat): remove mutable ref fixtures

* test(agentcompat): use tagged actions in secure fixtures

* test(agentcompat): update credential fixtures for tags

* test(agentcompat): update reusable action fixtures

* test(agentcompat): update artifact redaction fixtures

* test(agentcompat): finish artifact fixture tag migration

* test(agentcompat): update workflow validation fixtures

* test(agentcompat): update dependency workflow fixture

* ci(agentcompat): stop pinning cross-repository revisions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: naiba <hi@nai.ba>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
2026-08-01 15:45:20 +08:00

146 lines
4.4 KiB
YAML

name: Run Tests
on:
push:
branches:
- master
pull_request:
branches:
- master
merge_group:
permissions:
contents: read
concurrency:
group: nezha-quality-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
tests:
name: Ordinary tests and build (${{ matrix.os }})
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 30
steps:
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: actions/setup-go@v7
with:
go-version: "1.26.x"
cache: false
- name: Generate Swagger docs
run: |
go install github.com/swaggo/swag/cmd/swag@v1.16.6
touch ./cmd/dashboard/user-dist/a
touch ./cmd/dashboard/admin-dist/a
swag init --pd -d cmd/dashboard -g main.go -o cmd/dashboard/docs
- name: Unit test
run: go test -mod=readonly -count=1 ./...
- name: Build dashboard
run: go build -v ./cmd/dashboard
linux-race-quality:
name: Linux race and quality
runs-on: ubuntu-24.04
timeout-minutes: 45
steps:
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: actions/setup-go@v7
with:
go-version: "1.26.x"
cache: false
- name: Generate Swagger docs
run: |
go install github.com/swaggo/swag/cmd/swag@v1.16.6
touch ./cmd/dashboard/user-dist/a
touch ./cmd/dashboard/admin-dist/a
swag init --pd -d cmd/dashboard -g main.go -o cmd/dashboard/docs
- name: Race and shuffle tests
run: go test -mod=readonly -race -shuffle=on -count=1 ./...
- name: Vet
run: go vet ./...
- name: Check formatting
shell: bash
run: test -z "$(git ls-files -co --exclude-standard '*.go' -z | xargs -0 gofmt -l)"
- name: Build dashboard
run: go build ./cmd/dashboard
- name: Run Gosec Security Scanner
shell: bash
env:
GOTOOLCHAIN: auto
run: |
go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1
gosec --exclude=G104,G115,G117,G203,G402,G703,G704 ./...
agentcompat-stress:
name: Linux agent compatibility stress
runs-on: ubuntu-24.04
timeout-minutes: 75
steps:
- name: Checkout Nezha revision
uses: actions/checkout@v7.0.1
with:
path: nezha
persist-credentials: false
- name: Checkout Agent repository
uses: actions/checkout@v7.0.1
with:
repository: nezhahq/agent
path: agent
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@v7
with:
go-version: "1.26.x"
cache: false
- name: Prepare Dashboard build inputs
working-directory: nezha
run: |
go install github.com/swaggo/swag/cmd/swag@v1.16.6
mkdir -p cmd/dashboard/user-dist cmd/dashboard/admin-dist
printf 'placeholder\n' > cmd/dashboard/user-dist/placeholder.txt
printf 'placeholder\n' > cmd/dashboard/admin-dist/placeholder.txt
swag init --pd -d cmd/dashboard -g main.go -o cmd/dashboard/docs
- name: Require named stress test
working-directory: nezha
run: go test -mod=readonly -tags=agentcompat -list '^TestStressPRFullEightAgentExactlyOnce$' ./integration/agentcompat/internal/scenario | grep -Fx 'TestStressPRFullEightAgentExactlyOnce'
- name: Run PR-full agent compatibility stress
working-directory: nezha
env:
AGENTCOMPAT_NEZHA_SOURCE: ${{ github.workspace }}/nezha
AGENTCOMPAT_AGENT_SOURCE: ${{ github.workspace }}/agent
run: go test -mod=readonly -tags=agentcompat -run '^TestStressPRFullEightAgentExactlyOnce$' -count=1 -v ./integration/agentcompat/internal/scenario
nezha-quality-required:
name: nezha-quality-required
if: ${{ always() }}
needs:
- tests
- linux-race-quality
- agentcompat-stress
runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Require all blocking jobs to pass
shell: bash
run: |
test "${{ needs.tests.result }}" = success
test "${{ needs.linux-race-quality.result }}" = success
test "${{ needs.agentcompat-stress.result }}" = success