mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-07-08 21:56:08 +00:00
MHSanaei
659f0f404c
CodeQL alert 99 (actions/cache-poisoning/poisonable-step): the workflow_run job runs in the default branch's cache scope, so checking out workflow_run.head_sha and executing a script from it is a cache-poisoning surface. The if-guard (event == 'push') already kept fork PRs out, but the checkout pin was never the load-bearing part of the release verification — the version argument is, since install.sh downloads that exact release binary. Run the smoke script from the default branch instead, which also matches what real users execute.
70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
name: Deploy Smoke Tests
|
|
|
|
# Container smoke test for the unattended (cloud-init) install path.
|
|
# Runs when the install/deploy assets change on a branch push or PR, and
|
|
# again after a release-tag build finishes uploading its assets — passing the
|
|
# tag as an explicit version, so the green result verifies the release
|
|
# actually being shipped. That job deliberately runs the script from the
|
|
# default branch rather than checking out the tag: workflow_run executes in
|
|
# main's cache scope, so executing checked-out code there is a cache-poisoning
|
|
# surface (CodeQL actions/cache-poisoning/poisonable-step), and users pipe
|
|
# main's install.sh anyway.
|
|
# Tag pushes must NOT trigger the unpinned job directly: at that moment
|
|
# releases/latest still points at the previous release (#5756), and a `paths`
|
|
# filter alone cannot exclude them because a brand-new tag ref has no diff
|
|
# base, so it runs on every tag push.
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "**"
|
|
paths:
|
|
- "install.sh"
|
|
- "deploy/**"
|
|
- ".github/workflows/smoke.yml"
|
|
pull_request:
|
|
paths:
|
|
- "install.sh"
|
|
- "deploy/**"
|
|
- ".github/workflows/smoke.yml"
|
|
workflow_run:
|
|
workflows: ["Release 3X-UI"]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
noninteractive-install:
|
|
if: github.event_name != 'workflow_run'
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
runner: [ubuntu-latest, ubuntu-24.04-arm]
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- name: Non-interactive install smoke test
|
|
run: bash deploy/test/smoke-noninteractive.sh
|
|
|
|
release-tag-install:
|
|
if: >-
|
|
github.event_name == 'workflow_run' &&
|
|
github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'push' &&
|
|
startsWith(github.event.workflow_run.head_branch, 'v') &&
|
|
contains(github.event.workflow_run.head_branch, '.')
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
runner: [ubuntu-latest, ubuntu-24.04-arm]
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- name: Pinned release install smoke test
|
|
env:
|
|
XUI_SMOKE_VERSION: ${{ github.event.workflow_run.head_branch }}
|
|
run: bash deploy/test/smoke-noninteractive.sh "$XUI_SMOKE_VERSION"
|