Add a script to verify the open security PRs against a deployment

.github/workflows/pr-verification-tests.yml

@@ -0,0 +1,22 @@
+name: pr verification script
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  self-test:
+    name: The PR verification script still discriminates
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+
+    # Runs the real script against a mock deployment in both a fixed and a
+    # vulnerable configuration, so it cannot rot into one that passes anywhere.
+    - name: Run the script against both configurations
+      run: python -m unittest tests.test_pr_verification_script --verbose

.gitignore

@@ -5,4 +5,7 @@
 .vscode/
 
 # Codebase (backend and frontend)
-codebase/
+codebase/
+# Python bytecode
+__pycache__/
+*.py[cod]

scripts/README.md

@@ -17,4 +17,6 @@ Folder structure:
     - `logs.sh`: Run a temportal Alpine container to inspect logs created by various containers. Optionally takes the following command-line arguments:
         - a name for the container, defaults to `logs-prod`
 - clean/
-    - `unclone.sh`: Removes the `omniport/` directory from the root directory. This will remove the Omniport core, the shell, all services and any apps you might have cloned into the code base.
+    - `unclone.sh`: Removes the `omniport/` directory from the root directory. This will remove the Omniport core, the shell, all services and any apps you might have cloned into the code base.
+    - `pr_verification.sh`: Verify the open security pull requests against a running deployment, one section per PR. Takes the base URL as its first argument and an optional section name as its second; `list` prints the section names. Set `SESSION_COOKIE` to run the checks that need a logged-in caller, and `DJANGO_SERVICE` for the dependency check. Exits non-zero if any check fails.
+