Repository navigation
feat(google): support caller-defined CAB rules (#901) #832
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Licensed to the Apache Software Foundation (ASF) under one | |
| # or more contributor license agreements. See the NOTICE file | |
| # distributed with this work for additional information | |
| # regarding copyright ownership. The ASF licenses this file | |
| # to you under the Apache License, Version 2.0 (the | |
| # "License"); you may not use this file except in compliance | |
| # with the License. You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, | |
| # software distributed under the License is distributed on an | |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | |
| # KIND, either express or implied. See the License for the | |
| # specific language governing permissions and limitations | |
| # under the License. | |
| name: Azure Storage Test | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| env: | |
| RUST_BACKTRACE: "1" | |
| AZURE_STORAGE_ACCOUNT: opendalci | |
| AZURE_STORAGE_CONTAINER: reqsign-live-test | |
| AZURE_SUBSCRIPTION_ID: 9e6b5234-646f-4f48-b5cf-9761a56f0917 | |
| permissions: {} | |
| jobs: | |
| unit_test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Test Azure live-test lifecycle scripts | |
| run: python3 .github/azure-live-tests/test_scripts.py | |
| - name: Run unit tests | |
| run: | | |
| cargo test -p reqsign-azure-storage --lib --no-fail-fast | |
| cargo test -p reqsign-azure-storage --doc --no-fail-fast | |
| check_secrets: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| trusted: ${{ steps.check.outputs.trusted }} | |
| steps: | |
| - name: Check whether live tests are trusted | |
| id: check | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| IS_FORK: ${{ github.event.pull_request.head.repo.fork }} | |
| ACTOR: ${{ github.actor }} | |
| run: | | |
| if [[ "$EVENT_NAME" == "push" || ( "$EVENT_NAME" == "pull_request" && "$IS_FORK" == "false" && "$ACTOR" != "dependabot[bot]" ) ]]; then | |
| echo "trusted=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "trusted=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| test_static_provider: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure test configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| REQSIGN_AZURE_STORAGE_ACCOUNT_NAME: op://reqsign/azure-storage/account_name | |
| REQSIGN_AZURE_STORAGE_ACCOUNT_KEY: op://reqsign/azure-storage/account_key | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Load bearer credential | |
| run: | | |
| bearer_token=$(az account get-access-token \ | |
| --resource https://storage.azure.com/ \ | |
| --query accessToken \ | |
| --output tsv) | |
| test -n "$bearer_token" | |
| echo "::add-mask::$bearer_token" | |
| echo "REQSIGN_AZURE_STORAGE_BEARER_TOKEN=$bearer_token" >> "$GITHUB_ENV" | |
| - name: Test StaticCredentialProvider against Azure Blob Storage | |
| env: | |
| AZURE_STORAGE_AUTH_MODE: key | |
| REQSIGN_AZURE_STORAGE_TEST: "on" | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main credential_providers::static_provider:: -- --no-capture | |
| test_env_provider: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure test configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| REQSIGN_AZURE_STORAGE_ACCOUNT_NAME: op://reqsign/azure-storage/account_name | |
| REQSIGN_AZURE_STORAGE_ACCOUNT_KEY: op://reqsign/azure-storage/account_key | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Load bearer credential | |
| run: | | |
| bearer_token=$(az account get-access-token \ | |
| --resource https://storage.azure.com/ \ | |
| --query accessToken \ | |
| --output tsv) | |
| test -n "$bearer_token" | |
| echo "::add-mask::$bearer_token" | |
| echo "REQSIGN_AZURE_STORAGE_BEARER_TOKEN=$bearer_token" >> "$GITHUB_ENV" | |
| - name: Test EnvCredentialProvider against Azure Blob Storage | |
| env: | |
| AZURE_STORAGE_AUTH_MODE: key | |
| REQSIGN_AZURE_STORAGE_TEST_ENV: "on" | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main credential_providers::env:: -- --no-capture | |
| test_client_secret_provider: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure test configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| AZURE_CLIENT_SECRET: op://reqsign/azure-storage/client_secret | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Test ClientSecretCredentialProvider against Azure Blob Storage | |
| env: | |
| REQSIGN_AZURE_STORAGE_TEST_CLIENT_SECRET: "on" | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main credential_providers::client_secret:: -- --no-capture | |
| test_client_certificate_provider: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure test configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| AZURE_CLIENT_CERTIFICATE_BASE64: op://reqsign/azure-storage/certificate_pem_base64 | |
| - name: Set up client certificate | |
| run: | | |
| certificate_path="$RUNNER_TEMP/azure-client-certificate.pem" | |
| printf '%s' "$AZURE_CLIENT_CERTIFICATE_BASE64" | base64 --decode > "$certificate_path" | |
| test -s "$certificate_path" | |
| chmod 600 "$certificate_path" | |
| echo "AZURE_CLIENT_CERTIFICATE_PATH=$certificate_path" >> "$GITHUB_ENV" | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Test ClientCertificateCredentialProvider against Azure Blob Storage | |
| env: | |
| REQSIGN_AZURE_STORAGE_TEST_CLIENT_CERTIFICATE: "on" | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main credential_providers::client_certificate:: -- --no-capture | |
| test_azure_cli_provider: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure test configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Test AzureCliCredentialProvider against Azure Blob Storage | |
| env: | |
| REQSIGN_AZURE_STORAGE_TEST_CLI: "on" | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main credential_providers::azure_cli:: -- --no-capture | |
| test_workload_identity_provider: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure test configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Get GitHub workload identity token | |
| run: | | |
| token_file="$RUNNER_TEMP/azure-federated-token" | |
| request_url="${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=api%3A%2F%2FAzureADTokenExchange" | |
| subject_token=$(curl --fail --silent --show-error \ | |
| --header "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \ | |
| "$request_url" | jq --raw-output '.value') | |
| test -n "$subject_token" | |
| echo "::add-mask::$subject_token" | |
| printf '%s' "$subject_token" > "$token_file" | |
| chmod 600 "$token_file" | |
| echo "AZURE_FEDERATED_TOKEN_FILE=$token_file" >> "$GITHUB_ENV" | |
| - name: Test WorkloadIdentityCredentialProvider against Azure Blob Storage | |
| env: | |
| REQSIGN_AZURE_STORAGE_TEST_WORKLOAD_IDENTITY: "on" | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main credential_providers::workload_identity:: -- --no-capture | |
| test_default_provider: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure test configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Test DefaultCredentialProvider against Azure Blob Storage | |
| env: | |
| REQSIGN_AZURE_STORAGE_TEST_DEFAULT: "on" | |
| run: bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main credential_providers::default::test_default_provider -- --no-capture | |
| test_imds_provider: | |
| name: ImdsCredentialProvider live test | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| env: | |
| AZURE_IMDS_CLIENT_ID: c4544d03-a76a-4908-b5c0-047b8c7e432c | |
| AZURE_IMDS_IDENTITY_ID: /subscriptions/9e6b5234-646f-4f48-b5cf-9761a56f0917/resourceGroups/opendal/providers/Microsoft.ManagedIdentity/userAssignedIdentities/reqsign-test | |
| AZURE_RUNTIME_RESOURCE_GROUP: reqsign-ci-runtime | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure control-plane configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Build IMDS live test binary | |
| id: build | |
| run: | | |
| messages="$RUNNER_TEMP/azure-imds-cargo-messages.json" | |
| cargo test -p reqsign-azure-storage --test main --no-run --message-format=json > "$messages" | |
| executable=$(jq --raw-output 'select(.profile.test == true and .target.name == "main") | .executable' "$messages" | tail -n 1) | |
| test -n "$executable" | |
| test -x "$executable" | |
| echo "executable=$executable" >> "$GITHUB_OUTPUT" | |
| - name: Upload IMDS live test binary | |
| id: artifact | |
| env: | |
| TEST_EXECUTABLE: ${{ steps.build.outputs.executable }} | |
| run: | | |
| artifact_name="ci-artifact-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-azure-imds-live-test" | |
| az storage blob upload \ | |
| --auth-mode login \ | |
| --account-name "$AZURE_STORAGE_ACCOUNT" \ | |
| --container-name "$AZURE_STORAGE_CONTAINER" \ | |
| --name "$artifact_name" \ | |
| --file "$TEST_EXECUTABLE" \ | |
| --overwrite \ | |
| --only-show-errors | |
| echo "name=$artifact_name" >> "$GITHUB_OUTPUT" | |
| - name: Create private Azure VM | |
| id: vm | |
| run: bash .github/azure-live-tests/imds-vm.sh create | |
| - name: Test ImdsCredentialProvider on the Azure VM | |
| env: | |
| ARTIFACT_NAME: ${{ steps.artifact.outputs.name }} | |
| VM_NAME: ${{ steps.vm.outputs.name }} | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh bash -euo pipefail <<'SCRIPT' | |
| artifact_url="https://${AZURE_STORAGE_ACCOUNT}.blob.core.windows.net/${AZURE_STORAGE_CONTAINER}/${ARTIFACT_NAME}" | |
| # shellcheck disable=SC2016 | |
| remote_script='set -eu | |
| imds_response=$(curl --connect-timeout 15 --fail --silent --show-error --header "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fstorage.azure.com%2F&client_id='"$AZURE_IMDS_CLIENT_ID"'") | |
| storage_token=$(python3 -c '\''import json,sys; print(json.loads(sys.argv[1])["access_token"])'\'' "$imds_response") | |
| curl --connect-timeout 15 --fail --silent --show-error --header "Authorization: Bearer $storage_token" --header "x-ms-version: 2023-11-03" "'"$artifact_url"'" --output /tmp/reqsign-azure-imds-live-test | |
| chmod 700 /tmp/reqsign-azure-imds-live-test | |
| REQSIGN_AZURE_STORAGE_TEST_IMDS=on REQSIGN_AZURE_STORAGE_PROBE_URL='"$REQSIGN_AZURE_STORAGE_PROBE_URL"' AZURE_CLIENT_ID='"$AZURE_IMDS_CLIENT_ID"' /tmp/reqsign-azure-imds-live-test credential_providers::imds::test_imds_provider --exact | |
| echo REQSIGN_IMDS_TEST_SUCCEEDED' | |
| result=$(az vm run-command invoke \ | |
| --resource-group "$AZURE_RUNTIME_RESOURCE_GROUP" \ | |
| --name "$VM_NAME" \ | |
| --command-id RunShellScript \ | |
| --scripts "$remote_script" \ | |
| --output json) | |
| if ! jq --exit-status '.value[0].message | contains("REQSIGN_IMDS_TEST_SUCCEEDED")' <<< "$result" >/dev/null; then | |
| jq --raw-output '.value[0].message' <<< "$result" | |
| exit 1 | |
| fi | |
| SCRIPT | |
| - name: Delete ephemeral Azure VMs | |
| if: always() | |
| run: bash .github/azure-live-tests/imds-vm.sh cleanup | |
| - name: Delete IMDS live test binary | |
| if: always() && steps.artifact.outputs.name != '' | |
| env: | |
| ARTIFACT_NAME: ${{ steps.artifact.outputs.name }} | |
| run: | | |
| az storage blob delete \ | |
| --auth-mode login \ | |
| --account-name "$AZURE_STORAGE_ACCOUNT" \ | |
| --container-name "$AZURE_STORAGE_CONTAINER" \ | |
| --name "$ARTIFACT_NAME" \ | |
| --only-show-errors | |
| test_azure_pipelines_provider: | |
| name: AzurePipelinesCredentialProvider live test | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| env: | |
| AZURE_DEVOPS_ORGANIZATION: opendal | |
| AZURE_DEVOPS_PROJECT: reqsign | |
| AZURE_DEVOPS_PIPELINE_ID: "1" | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure control-plane configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| AZURE_TENANT_ID: op://reqsign/azure-storage/tenant_id | |
| AZURE_CLIENT_ID: op://reqsign/azure-storage/client_id | |
| - name: Log in to Azure with GitHub OIDC | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Test AzurePipelinesCredentialProvider with an ephemeral probe | |
| run: bash .github/azure-live-tests/with-probe.sh bash .github/azure-live-tests/azure-pipelines.sh | |
| signing_test: | |
| needs: check_secrets | |
| if: needs.check_secrets.outputs.trusted == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Configure 1Password Connect | |
| uses: 1Password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 | |
| with: | |
| connect-host: ${{ secrets.OP_CONNECT_HOST }} | |
| connect-token: ${{ secrets.OP_CONNECT_TOKEN }} | |
| - name: Load Azure signing configuration | |
| uses: 1Password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1 | |
| with: | |
| export-env: true | |
| env: | |
| REQSIGN_AZURE_STORAGE_ACCOUNT_NAME: op://reqsign/azure-storage/account_name | |
| REQSIGN_AZURE_STORAGE_ACCOUNT_KEY: op://reqsign/azure-storage/account_key | |
| - name: Test Azure Storage signing | |
| env: | |
| AZURE_STORAGE_AUTH_MODE: key | |
| REQSIGN_AZURE_STORAGE_TEST: "on" | |
| run: | | |
| bash .github/azure-live-tests/with-probe.sh cargo test -p reqsign-azure-storage --test main signing:: -- --no-capture | |
| summary: | |
| name: Test Summary | |
| needs: | |
| - unit_test | |
| - check_secrets | |
| - test_static_provider | |
| - test_env_provider | |
| - test_client_secret_provider | |
| - test_client_certificate_provider | |
| - test_azure_cli_provider | |
| - test_workload_identity_provider | |
| - test_default_provider | |
| - test_imds_provider | |
| - test_azure_pipelines_provider | |
| - signing_test | |
| if: always() && !cancelled() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Summarize Azure provider coverage | |
| env: | |
| UNIT_RESULT: ${{ needs.unit_test.result }} | |
| TRUSTED: ${{ needs.check_secrets.outputs.trusted }} | |
| STATIC_RESULT: ${{ needs.test_static_provider.result }} | |
| ENV_RESULT: ${{ needs.test_env_provider.result }} | |
| CLIENT_SECRET_RESULT: ${{ needs.test_client_secret_provider.result }} | |
| CLIENT_CERTIFICATE_RESULT: ${{ needs.test_client_certificate_provider.result }} | |
| AZURE_CLI_RESULT: ${{ needs.test_azure_cli_provider.result }} | |
| WORKLOAD_IDENTITY_RESULT: ${{ needs.test_workload_identity_provider.result }} | |
| DEFAULT_RESULT: ${{ needs.test_default_provider.result }} | |
| IMDS_RESULT: ${{ needs.test_imds_provider.result }} | |
| AZURE_PIPELINES_RESULT: ${{ needs.test_azure_pipelines_provider.result }} | |
| SIGNING_RESULT: ${{ needs.signing_test.result }} | |
| run: | | |
| { | |
| echo "## Azure Storage Test Summary" | |
| echo | |
| echo "| Coverage | Real Azure acceptance | Result |" | |
| echo "|----------|-----------------------|--------|" | |
| echo "| Unit tests and redacted real-response fixtures | Local | $UNIT_RESULT |" | |
| if [[ "$TRUSTED" == "true" ]]; then | |
| echo "| StaticCredentialProvider | Azure Blob Storage | $STATIC_RESULT |" | |
| echo "| EnvCredentialProvider | Azure Blob Storage | $ENV_RESULT |" | |
| echo "| ClientSecretCredentialProvider | Microsoft Entra ID and Azure Blob Storage | $CLIENT_SECRET_RESULT |" | |
| echo "| ClientCertificateCredentialProvider | Microsoft Entra ID and Azure Blob Storage | $CLIENT_CERTIFICATE_RESULT |" | |
| echo "| AzureCliCredentialProvider | Azure CLI and Azure Blob Storage | $AZURE_CLI_RESULT |" | |
| echo "| WorkloadIdentityCredentialProvider | GitHub OIDC, Microsoft Entra ID, and Azure Blob Storage | $WORKLOAD_IDENTITY_RESULT |" | |
| echo "| DefaultCredentialProvider | Azure CLI through the default chain and Azure Blob Storage | $DEFAULT_RESULT |" | |
| echo "| ImdsCredentialProvider | Ephemeral Azure VM IMDS and Azure Blob Storage | $IMDS_RESULT |" | |
| echo "| AzurePipelinesCredentialProvider | GitHub-queued Azure Pipelines service connection and Azure Blob Storage | $AZURE_PIPELINES_RESULT |" | |
| echo "| Azure Shared Key and SAS signing | Azure Blob Storage | $SIGNING_RESULT |" | |
| else | |
| echo "| Live service integration tests | Skipped for an untrusted change | skipped |" | |
| fi | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| test "$UNIT_RESULT" = "success" | |
| if [[ "$TRUSTED" == "true" ]]; then | |
| test "$STATIC_RESULT" = "success" | |
| test "$ENV_RESULT" = "success" | |
| test "$CLIENT_SECRET_RESULT" = "success" | |
| test "$CLIENT_CERTIFICATE_RESULT" = "success" | |
| test "$AZURE_CLI_RESULT" = "success" | |
| test "$WORKLOAD_IDENTITY_RESULT" = "success" | |
| test "$DEFAULT_RESULT" = "success" | |
| test "$IMDS_RESULT" = "success" | |
| test "$AZURE_PIPELINES_RESULT" = "success" | |
| test "$SIGNING_RESULT" = "success" | |
| fi |