Skip to content

Commit 6abc308

Browse files
jan-cernyjan-cerny
authored
Merge pull request #14885 from rrskris/add-automatus-debian13
Add Automatus CI workflow for Debian 13
2 parents 8843d29 + 54bc56d commit 6abc308

1 file changed

Lines changed: 319 additions & 0 deletions

File tree

‎.github/workflows/automatus-debian13.yaml‎

Lines changed: 319 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,319 @@
1+
name: Automatus Debian 13
2+
on:
3+
pull_request:
4+
branches: [master, 'stabilization*']
5+
permissions:
6+
contents: read
7+
concurrency:
8+
group: >-
9+
${{ github.workflow }}-${{
10+
github.event.number || github.run_id }}
11+
cancel-in-progress: true
12+
env:
13+
DATASTREAM: ssg-debian13-ds.xml
14+
jobs:
15+
build-content:
16+
name: Build Content
17+
runs-on: ubuntu-22.04
18+
steps:
19+
- name: Install Deps
20+
run: |
21+
sudo apt-get update && sudo apt-get install -y \
22+
cmake ninja-build python3-yaml \
23+
python3-jinja2 git python3-deepdiff \
24+
python3-requests jq python3-pip \
25+
libxml2-utils xsltproc ansible-lint wget \
26+
libdbus-1-dev libdbus-glib-1-dev \
27+
libcurl4-openssl-dev libgcrypt20-dev \
28+
libselinux1-dev libxslt1-dev \
29+
libgconf2-dev libacl1-dev libblkid-dev \
30+
libcap-dev libxml2-dev libldap2-dev \
31+
libpcre3-dev python3 swig \
32+
libxml-parser-perl libxml-xpath-perl \
33+
libperl-dev libbz2-dev librpm-dev g++ \
34+
libyaml-dev libxmlsec1-dev \
35+
libxmlsec1-openssl
36+
- name: Install deps python
37+
run: pip3 install gitpython xmldiff lxml lxml-stubs requests
38+
- name: Checkout
39+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
40+
with:
41+
fetch-depth: 0
42+
- name: Checkout (CTF)
43+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
44+
with:
45+
repository: ComplianceAsCode/content-test-filtering
46+
path: ctf
47+
# https://github.com/actions/checkout/issues/766
48+
- name: Set git safe directory
49+
run: >-
50+
git config --global --add safe.directory
51+
"$GITHUB_WORKSPACE"
52+
- name: Find forking point
53+
env:
54+
BASE_BRANCH: ${{ github.base_ref }}
55+
run: |
56+
FORK_POINT=$(git merge-base \
57+
origin/$BASE_BRANCH \
58+
${{ github.event.pull_request.head.sha }})
59+
echo "FORK_POINT=$FORK_POINT" >> $GITHUB_OUTPUT
60+
id: fork_point
61+
- name: Detect content changes in the PR
62+
run: |
63+
python3 ./ctf/content_test_filtering.py pr \
64+
--base ${{ steps.fork_point.outputs.FORK_POINT }} \
65+
--remote_repo \
66+
${{ github.server_url }}/${{ github.repository }} \
67+
--verbose --rule --output json \
68+
${{ github.event.pull_request.number }} \
69+
> output.json
70+
- name: Test if there are no content changes
71+
run: >-
72+
echo "CTF_OUTPUT_SIZE=$(stat --printf="%s"
73+
output.json)" >> $GITHUB_OUTPUT
74+
id: ctf
75+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
76+
if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
77+
with:
78+
name: output.json
79+
path: output.json
80+
- name: Print changes to content detected if any
81+
if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
82+
run: cat output.json
83+
- name: Get product attribute
84+
if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
85+
id: product
86+
# yamllint disable-line rule:line-length
87+
uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0
88+
with:
89+
path: 'output.json'
90+
prop_path: 'product'
91+
- name: Download OpenSCAP
92+
run: |
93+
wget \
94+
https://github.com/OpenSCAP/openscap/releases/download/1.3.10/openscap-1.3.10.tar.gz
95+
- name: Extract OpenSCAP
96+
run: tar xf openscap-1.3.10.tar.gz
97+
- name: Build OpenSCAP
98+
run: |
99+
cd openscap-1.3.10
100+
cmake -Bbuild -DCMAKE_INSTALL_PREFIX=/usr .
101+
sudo cmake --build build --target install
102+
- name: Build product
103+
if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
104+
run: ./build_product debian13
105+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
106+
if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
107+
with:
108+
name: ${{ env.DATASTREAM }}
109+
path: build/${{ env.DATASTREAM }}
110+
validate-ubuntu:
111+
name: Run Tests
112+
needs: build-content
113+
runs-on: ubuntu-22.04
114+
steps:
115+
- name: Install Deps
116+
run: |
117+
sudo apt update && sudo apt install -y \
118+
cmake ninja-build libxml2-utils xsltproc \
119+
python3-jinja2 python3-yaml ansible-lint \
120+
podman wget \
121+
libdbus-1-dev libdbus-glib-1-dev \
122+
libcurl4-openssl-dev libgcrypt20-dev \
123+
libselinux1-dev libxslt1-dev \
124+
libgconf2-dev libacl1-dev libblkid-dev \
125+
libcap-dev libxml2-dev libldap2-dev \
126+
libpcre3-dev python3 swig \
127+
libxml-parser-perl libxml-xpath-perl \
128+
libperl-dev libbz2-dev librpm-dev g++ \
129+
libyaml-dev libxmlsec1-dev \
130+
libxmlsec1-openssl
131+
- name: Checkout
132+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
133+
- name: Get cached CTF output
134+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4
135+
id: get_ctf_output
136+
with:
137+
name: output.json
138+
# continue even if the file is unavailable;
139+
# that means there are no changes detected
140+
# by CTF in the previous job
141+
continue-on-error: true
142+
- name: Download OpenSCAP
143+
run: |
144+
wget \
145+
https://github.com/OpenSCAP/openscap/releases/download/1.3.10/openscap-1.3.10.tar.gz
146+
- name: Extract OpenSCAP
147+
run: tar xf openscap-1.3.10.tar.gz
148+
- name: Build OpenSCAP
149+
run: |
150+
cd openscap-1.3.10
151+
cmake -Bbuild -DCMAKE_INSTALL_PREFIX=/usr .
152+
sudo cmake --build build --target install
153+
- name: Test if there are no content changes
154+
if: >-
155+
${{ steps.get_ctf_output.outcome == 'success' }}
156+
run: >-
157+
echo "CTF_OUTPUT_SIZE=$(stat --printf="%s"
158+
output.json)" >> $GITHUB_OUTPUT
159+
id: ctf
160+
- name: Print changes to content detected if any
161+
if: >-
162+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
163+
run: cat output.json
164+
- name: Generate id_rsa key
165+
if: >-
166+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
167+
run: ssh-keygen -N '' -t rsa -f ~/.ssh/id_rsa
168+
- name: Build test suite container
169+
if: >-
170+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
171+
run: |
172+
podman build \
173+
--build-arg \
174+
"CLIENT_PUBLIC_KEY=$(cat ~/.ssh/id_rsa.pub)" \
175+
-t ssg_test_suite \
176+
-f test_suite-debian13
177+
working-directory: ./Dockerfiles
178+
- name: Get oscap-ssh
179+
if: >-
180+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
181+
run: |
182+
wget https://raw.githubusercontent.com/OpenSCAP/openscap/maint-1.3/utils/oscap-ssh
183+
sudo chmod 755 oscap-ssh
184+
sudo mv -v oscap-ssh /usr/local/bin
185+
sudo chown root:root /usr/local/bin/oscap-ssh
186+
rm -f oscap-ssh
187+
- name: Get rule ids to be tested
188+
if: >-
189+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
190+
id: rules
191+
# yamllint disable-line rule:line-length
192+
uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0
193+
with:
194+
path: 'output.json'
195+
prop_path: 'rules'
196+
- name: Get product attribute
197+
if: >-
198+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
199+
id: product
200+
# yamllint disable-line rule:line-length
201+
uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0
202+
with:
203+
path: 'output.json'
204+
prop_path: 'product'
205+
- name: Get bash attribute
206+
if: >-
207+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
208+
id: bash
209+
# yamllint disable-line rule:line-length
210+
uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0
211+
with:
212+
path: 'output.json'
213+
prop_path: 'bash'
214+
- name: Get ansible attribute
215+
if: >-
216+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
217+
id: ansible
218+
# yamllint disable-line rule:line-length
219+
uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0
220+
with:
221+
path: 'output.json'
222+
prop_path: 'ansible'
223+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4
224+
if: >-
225+
${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
226+
with:
227+
name: ${{ env.DATASTREAM }}
228+
- name: Run tests in a container - Bash
229+
if: >-
230+
${{steps.bash.outputs.prop == 'True'
231+
&& steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
232+
run: |
233+
tests/test_rule_in_container.sh \
234+
--no-make-applicable-in-containers \
235+
--dontclean \
236+
--logdir logs_bash \
237+
--remediate-using bash \
238+
--name ssg_test_suite \
239+
--datastream $DATASTREAM \
240+
${{join(fromJSON(steps.rules.outputs.prop))}}
241+
env:
242+
ADDITIONAL_TEST_OPTIONS: >-
243+
--duplicate-templates
244+
--remove-fips-certified
245+
- name: Check for ERROR in logs
246+
if: >-
247+
${{steps.bash.outputs.prop == 'True'
248+
&& steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
249+
run: grep -q "^ERROR" logs_bash/test_suite.log
250+
id: check_results_bash
251+
# when grep returns 1 means it didn't find the
252+
# ^ERROR string in the test_suite.log file and
253+
# this means tests finished successfully without
254+
# errors. So the job needs to keep going.
255+
# By using continue-on-error: true the
256+
# "conclusion" parameter is set to true so it's
257+
# not possible to use it to determine whether
258+
# the task has failed or succeed. The "outcome"
259+
# parameter has to be used instead.
260+
# See the step below
261+
continue-on-error: true
262+
- name: Upload logs in case of failure
263+
if: >-
264+
${{steps.bash.outputs.prop == 'True'
265+
&& steps.check_results_bash.outcome == 'success'
266+
&& steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
267+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
268+
with:
269+
name: logs_bash
270+
path: logs_bash/
271+
- name: Run tests in a container - Ansible
272+
if: >-
273+
${{ steps.ansible.outputs.prop == 'True'
274+
&& steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
275+
run: |
276+
tests/test_rule_in_container.sh \
277+
--no-make-applicable-in-containers \
278+
--dontclean \
279+
--logdir logs_ansible \
280+
--remediate-using ansible \
281+
--name ssg_test_suite \
282+
--datastream $DATASTREAM \
283+
${{join(fromJSON(steps.rules.outputs.prop))}}
284+
env:
285+
ADDITIONAL_TEST_OPTIONS: >-
286+
--duplicate-templates
287+
--remove-fips-certified
288+
--product debian13
289+
- name: Check for ERROR in logs
290+
if: >-
291+
${{steps.ansible.outputs.prop == 'True'
292+
&& steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
293+
run: grep -q "^ERROR" logs_ansible/test_suite.log
294+
id: check_results_ansible
295+
continue-on-error: true
296+
- name: Upload logs in case of failure
297+
if: >-
298+
${{ steps.ansible.outputs.prop == 'True'
299+
&& steps.check_results_ansible.outcome == 'success'
300+
&& steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
301+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
302+
with:
303+
name: logs_ansible
304+
path: logs_ansible/
305+
- name: Fail if ERROR in test logs
306+
if: >-
307+
${{ (steps.check_results_bash.outcome == 'success'
308+
|| steps.check_results_ansible.outcome == 'success')
309+
&& steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
310+
run: |
311+
[[ -f logs_bash/test_suite.log ]] \
312+
&& echo "---Bash Remediation Logs---" \
313+
&& cat logs_bash/test_suite.log \
314+
| grep -v "DEBUG - "
315+
[[ -f logs_ansible/test_suite.log ]] \
316+
&& echo "---Ansible Remediation Logs---" \
317+
&& cat logs_ansible/test_suite.log \
318+
| grep -v "DEBUG - "
319+
exit 1

0 commit comments

Comments
 (0)