mirror of
https://github.com/supabase/supabase.git
synced 2026-10-14 13:49:09 +03:00
Charis
da724eb8c6
## Summary - Add a zizmor config and CI job that lints `.github/workflows` on every PR touching it, downloading and attestation-verifying the pinned v1.26.1 release binary (cached across runs) - Fix the mutable-tag and excess-permission findings zizmor surfaces in `braintrust-evals.yml`, `publish_image.yml`, and `self-host-tests-smoke.yml`: pin `actions/checkout`/`actions/setup-node` to commit SHAs, and scope `pull-requests`/`packages`/`id-token` permissions down to the specific jobs that need them ## Test plan - [x] Confirm the `zizmor` job runs and passes on this PR <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automated security scanning for workflow changes on pull requests. * Added configuration to allow specific workflow trigger exceptions. * **Security** * Tightened GitHub Actions permissions at the workflow level and re-granted only where required per job. * Pinned common build action versions to specific commits for more consistent execution. * **Maintenance** * Updated workflow caching and action step annotations without changing linting or fixing behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
91 lines
2.8 KiB
YAML
91 lines
2.8 KiB
YAML
name: Self-Host Tests Smoke
|
|
|
|
on:
|
|
pull_request:
|
|
branches: ['master']
|
|
paths:
|
|
- 'docker/**/*'
|
|
|
|
# Cancel old builds on new commit for same workflow + branch/PR
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: blacksmith-4vcpu-ubuntu-2404
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
config: [default, logs, envoy, rustfs, envoy-rustfs]
|
|
|
|
steps:
|
|
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
|
|
with:
|
|
persist-credentials: false
|
|
sparse-checkout: |
|
|
docker/
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: '22'
|
|
|
|
- name: Generate keys
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cd docker
|
|
cp .env.example .env
|
|
sh utils/generate-keys.sh --update-env
|
|
sh utils/add-new-auth-keys.sh --update-env
|
|
|
|
- name: Start self-hosted Supabase
|
|
shell: bash
|
|
# Ensure all services can be started and healthy with default config
|
|
run: |
|
|
set -euo pipefail
|
|
cd docker
|
|
yq -i '.services.supavisor.environment.RLIMIT_NOFILE=1024' docker-compose.yml
|
|
if [ "${{ matrix.config }}" = "logs" ]; then
|
|
docker compose -f docker-compose.yml -f docker-compose.logs.yml up --quiet-pull --wait --wait-timeout 180
|
|
elif [ "${{ matrix.config }}" = "envoy" ]; then
|
|
docker compose -f docker-compose.yml -f docker-compose.envoy.yml up --quiet-pull --wait --wait-timeout 180
|
|
elif [ "${{ matrix.config }}" = "rustfs" ]; then
|
|
docker compose -f docker-compose.yml -f docker-compose.rustfs.yml up --quiet-pull --wait --wait-timeout 180
|
|
elif [ "${{ matrix.config }}" = "envoy-rustfs" ]; then
|
|
docker compose -f docker-compose.yml -f docker-compose.envoy.yml -f docker-compose.rustfs.yml up --quiet-pull --wait --wait-timeout 180
|
|
else
|
|
docker compose up --quiet-pull --wait --wait-timeout 180
|
|
fi
|
|
|
|
- name: Run container log tests
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cd docker
|
|
sh tests/test-container-logs.sh
|
|
|
|
- name: Run smoke tests
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cd docker
|
|
sh tests/test-self-hosted.sh
|
|
|
|
- name: Run API keys and asymmetric auth tests
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cd docker
|
|
sh tests/test-auth-keys.sh
|
|
|
|
- name: Run S3 protocol tests
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cd docker
|
|
sh tests/test-s3.sh
|