rfc-sustainability-wellknown/.github/workflows/example-scripts.yml at main · andreibesleaga/rfc-sustainability-wellknown · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: example-scripts

on:
  push:
    paths:
      - "example-scripts/**"
      - "schemas-validators/**"
      - "server-configurations/**"
      - ".github/workflows/example-scripts.yml"
  pull_request:
    paths:
      - "example-scripts/**"
      - "schemas-validators/**"
      - "server-configurations/**"

jobs:
  security-scripts:
    # The three security.* files each implement the same array safeguards
    # (sort, cap, granularity floor, deterministic noise) independently in
    # Python, JavaScript, and PHP; run each language's own test suite.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - uses: actions/setup-node@v4
        with: { node-version: "22" }
      - uses: shivammathur/setup-php@v2
        with: { php-version: "8.3" }
      - name: Python
        working-directory: example-scripts
        run: python3 test_security.py -v
      - name: JavaScript
        working-directory: example-scripts
        run: node test_security.js
      - name: PHP
        working-directory: example-scripts
        run: php test_security.php

  request-handler-e2e:
    # End-to-end test of the reference request handler: golden paths, error
    # paths, and edge cases, over real HTTP, with responses cross-checked
    # against the repo's independent JTD and CDDL validators.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - uses: ruby/setup-ruby@v1
        with: { ruby-version: "3.2" }
      - name: Install validators
        run: |
          python3 -m pip install jtd
          gem install cddl
      - name: Run E2E tests
        working-directory: example-scripts
        run: python3 test_request_handler.py -v

  server-config-syntax:
    # Real syntax + behavior verification of the nginx/Apache snippets against
    # actual server binaries — not just visual inspection. Confirms the
    # documented 405+Allow behavior for both (see server-configurations/README.md
    # for why each needed the specific pattern it uses).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install nginx and apache2
        run: sudo apt-get update -qq && sudo apt-get install -y nginx apache2

      - name: nginx config check
        run: |
          set -e
          mkdir -p /tmp/nginx-test/logs /tmp/nginx-test/run /tmp/nginx-test/tmp
          echo '{"version":"2.0","test":true}' > /tmp/nginx-test/sustainability.json
          cat > /tmp/nginx-test/nginx.conf <<'EOF'
          worker_processes 1;
          error_log /tmp/nginx-test/logs/error.log;
          pid /tmp/nginx-test/run/nginx.pid;
          events { worker_connections 16; }
          http {
            access_log /tmp/nginx-test/logs/access.log;
            client_body_temp_path /tmp/nginx-test/tmp/body;
            proxy_temp_path /tmp/nginx-test/tmp/proxy;
            fastcgi_temp_path /tmp/nginx-test/tmp/fastcgi;
            uwsgi_temp_path /tmp/nginx-test/tmp/uwsgi;
            scgi_temp_path /tmp/nginx-test/tmp/scgi;
            server {
              listen 127.0.0.1:8099;
          EOF
          sed 's#/var/www/metadata/sustainability.json#/tmp/nginx-test/sustainability.json#' \
            server-configurations/nginx.conf | grep -v '^#' >> /tmp/nginx-test/nginx.conf
          echo '  }' >> /tmp/nginx-test/nginx.conf
          echo '}' >> /tmp/nginx-test/nginx.conf
          nginx -t -c /tmp/nginx-test/nginx.conf
          nginx -c /tmp/nginx-test/nginx.conf
          sleep 1
          status=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8099/.well-known/sustainability-data)
          [ "$status" = "200" ] || { echo "::error::expected 200, got $status"; exit 1; }
          # Draft §2 (-04): successful responses SHOULD carry CORS.
          ok=$(curl -s -D - -o /dev/null http://127.0.0.1:8099/.well-known/sustainability-data)
          echo "$ok" | grep -qi "^Access-Control-Allow-Origin: \*" || { echo "::error::expected Access-Control-Allow-Origin: * on 200"; exit 1; }
          post=$(curl -s -D - -o /dev/null -X POST http://127.0.0.1:8099/.well-known/sustainability-data)
          # nginx's 405 reason phrase is "Not Allowed" (Apache's is "Method Not
          # Allowed"); match the numeric status code to stay server-agnostic.
          echo "$post" | grep -qE "^HTTP/[0-9.]+ 405" || { echo "::error::expected 405, got:"; echo "$post" | head -1; exit 1; }
          echo "$post" | grep -qi "^Allow: GET, HEAD" || { echo "::error::expected Allow: GET, HEAD"; exit 1; }
          nginx -s stop -c /tmp/nginx-test/nginx.conf

      - name: Apache config check
        run: |
          set -e
          mkdir -p /tmp/apache-test/logs /tmp/apache-test/run /tmp/apache-test/htdocs
          echo '{"version":"2.0","test":true}' > /tmp/apache-test/htdocs/sustainability.json
          echo '{"error":"method not allowed"}' > /tmp/apache-test/htdocs/sustainability-405.json
          cat > /tmp/apache-test/httpd.conf <<EOF
          ServerRoot "/tmp/apache-test"
          Listen 127.0.0.1:8098
          PidFile "/tmp/apache-test/run/httpd.pid"
          ErrorLog "/tmp/apache-test/logs/error.log"
          LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so
          LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so
          LoadModule alias_module /usr/lib/apache2/modules/mod_alias.so
          LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so
          LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so
          LoadModule mime_module /usr/lib/apache2/modules/mod_mime.so
          User $(whoami)
          Group $(id -gn)
          ServerName localhost
          TypesConfig /etc/mime.types
          EOF
          sed "s#/var/www/metadata/sustainability-405.json#/tmp/apache-test/htdocs/sustainability-405.json#; s#/var/www/metadata/sustainability.json#/tmp/apache-test/htdocs/sustainability.json#" \
            server-configurations/apache.conf | grep -v '^#' >> /tmp/apache-test/httpd.conf
          apache2 -f /tmp/apache-test/httpd.conf -t
          apache2 -f /tmp/apache-test/httpd.conf -k start
          sleep 1
          status=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8098/.well-known/sustainability-data)
          [ "$status" = "200" ] || { echo "::error::expected 200, got $status"; exit 1; }
          # Draft §2 (-04): successful responses SHOULD carry CORS.
          ok=$(curl -s -D - -o /dev/null http://127.0.0.1:8098/.well-known/sustainability-data)
          echo "$ok" | grep -qi "^Access-Control-Allow-Origin: \*" || { echo "::error::expected Access-Control-Allow-Origin: * on 200"; exit 1; }
          post=$(curl -s -D - -o /dev/null -X POST http://127.0.0.1:8098/.well-known/sustainability-data)
          echo "$post" | grep -qE "^HTTP/[0-9.]+ 405" || { echo "::error::expected 405, got:"; echo "$post" | head -1; exit 1; }
          allow_count=$(echo "$post" | grep -ci "^Allow:")
          [ "$allow_count" = "1" ] || { echo "::error::expected exactly one Allow header, got $allow_count"; exit 1; }
          echo "$post" | grep -qi "^Allow: GET, HEAD" || { echo "::error::expected Allow: GET, HEAD"; exit 1; }
          apache2 -f /tmp/apache-test/httpd.conf -k stop