Skip to content

Commit 403fc4d

Browse files
shubham-stepsecurityshubham-stepsecurity
authored
Merge pull request step-security#2587 from vamshi-stepsecurity/refactor/harden-runner-config
add test cases
2 parents e7c09de + 244f197 commit 403fc4d

9 files changed

Lines changed: 176 additions & 5 deletions

‎remediation/workflow/hardenrunner/addaction_test.go‎

Lines changed: 37 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -61,33 +61,65 @@ func TestUpdateHardenRunnerConfig(t *testing.T) {
6161

6262
blockConfig := "- name: Harden the runner (Audit all outbound calls)\n uses: step-security/harden-runner@v2\n with:\n egress-policy: block\n allowed-endpoints: >\n github.com:443\n api.github.com:443"
6363

64+
blockConfigWithComments := "# Harden Runner step added by StepSecurity\n- name: Harden the runner (Audit all outbound calls)\n uses: step-security/harden-runner@v2\n with:\n egress-policy: block\n # Approved endpoints for CI\n allowed-endpoints: >\n github.com:443\n api.github.com:443\n # npm registry\n registry.npmjs.org:443"
65+
6466
tests := []struct {
6567
name string
68+
inputFile string
6669
config HardenRunnerConfig
6770
wantUpdated bool
6871
outputFile string
6972
}{
7073
{
7174
name: "subtractive true replaces existing config",
75+
inputFile: "updateConfig.yml",
7276
config: HardenRunnerConfig{Config: blockConfig, Subtractive: true},
7377
wantUpdated: true,
7478
outputFile: "updateConfig.yml",
7579
},
7680
{
7781
name: "subtractive false does not change existing config",
82+
inputFile: "updateConfig.yml",
7883
config: HardenRunnerConfig{Config: blockConfig, Subtractive: false},
7984
wantUpdated: false,
8085
outputFile: "updateConfigNotSubtractive.yml",
8186
},
82-
}
83-
84-
input, err := ioutil.ReadFile(path.Join(inputDirectory, "updateConfig.yml"))
85-
if err != nil {
86-
t.Fatalf("error reading input file: %v", err)
87+
{
88+
name: "subtractive replaces existing allowed-endpoints",
89+
inputFile: "updateConfigReplaceEndpoints.yml",
90+
config: HardenRunnerConfig{Config: blockConfig, Subtractive: true},
91+
wantUpdated: true,
92+
outputFile: "updateConfigReplaceEndpoints.yml",
93+
},
94+
{
95+
name: "subtractive replaces config with comments",
96+
inputFile: "updateConfigWithComments.yml",
97+
config: HardenRunnerConfig{Config: blockConfig, Subtractive: true},
98+
wantUpdated: true,
99+
outputFile: "updateConfigWithComments.yml",
100+
},
101+
{
102+
name: "subtractive replaces single-line allowed-endpoints",
103+
inputFile: "updateConfigSingleLine.yml",
104+
config: HardenRunnerConfig{Config: blockConfig, Subtractive: true},
105+
wantUpdated: true,
106+
outputFile: "updateConfigSingleLine.yml",
107+
},
108+
{
109+
name: "subtractive with comments in config",
110+
inputFile: "updateConfigWithConfigComments.yml",
111+
config: HardenRunnerConfig{Config: blockConfigWithComments, Subtractive: true},
112+
wantUpdated: true,
113+
outputFile: "updateConfigWithConfigComments.yml",
114+
},
87115
}
88116

89117
for _, tt := range tests {
90118
t.Run(tt.name, func(t *testing.T) {
119+
input, err := ioutil.ReadFile(path.Join(inputDirectory, tt.inputFile))
120+
if err != nil {
121+
t.Fatalf("error reading input file: %v", err)
122+
}
91123
got, gotUpdated, err := AddAction(string(input), tt.config, false, false, false)
92124
if err != nil {
93125
t.Errorf("AddAction() error = %v", err)

‎testfiles/addaction/input/updateConfigReplaceEndpoints.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: test-replace-endpoints
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
- name: Harden the runner (Audit all outbound calls)
9+
uses: step-security/harden-runner@v2
10+
with:
11+
egress-policy: block
12+
allowed-endpoints: >
13+
xyz.com:443
14+
old-api.example.com:443
15+
internal.corp.net:8080
16+
17+
- uses: actions/checkout@v3
18+
- run: echo "build"

‎testfiles/addaction/input/updateConfigSingleLine.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: test-single-line-endpoints
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
- name: Harden the runner (Audit all outbound calls)
9+
uses: step-security/harden-runner@v2
10+
with:
11+
egress-policy: block
12+
allowed-endpoints: xyz.com:443 old-api.example.com:443
13+
14+
- uses: actions/checkout@v3
15+
- run: echo "build"

‎testfiles/addaction/input/updateConfigWithComments.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: test-replace-with-comments
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
# This step hardens the runner
9+
- name: Harden the runner (Audit all outbound calls)
10+
uses: step-security/harden-runner@v2
11+
with:
12+
egress-policy: block
13+
# These endpoints were approved by the security team
14+
allowed-endpoints: >
15+
xyz.com:443
16+
old-api.example.com:443
17+
18+
- uses: actions/checkout@v3
19+
- run: echo "build"

‎testfiles/addaction/input/updateConfigWithConfigComments.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: test-config-with-comments
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
- name: Harden the runner (Audit all outbound calls)
9+
uses: step-security/harden-runner@v2
10+
with:
11+
egress-policy: audit
12+
13+
- uses: actions/checkout@v3
14+
- run: echo "build"

‎testfiles/addaction/output/updateConfigReplaceEndpoints.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: test-replace-endpoints
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
- name: Harden the runner (Audit all outbound calls)
9+
uses: step-security/harden-runner@v2
10+
with:
11+
egress-policy: block
12+
allowed-endpoints: >
13+
github.com:443
14+
api.github.com:443
15+
16+
- uses: actions/checkout@v3
17+
- run: echo "build"

‎testfiles/addaction/output/updateConfigSingleLine.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: test-single-line-endpoints
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
- name: Harden the runner (Audit all outbound calls)
9+
uses: step-security/harden-runner@v2
10+
with:
11+
egress-policy: block
12+
allowed-endpoints: >
13+
github.com:443
14+
api.github.com:443
15+
16+
- uses: actions/checkout@v3
17+
- run: echo "build"

‎testfiles/addaction/output/updateConfigWithComments.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: test-replace-with-comments
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
# This step hardens the runner
9+
- name: Harden the runner (Audit all outbound calls)
10+
uses: step-security/harden-runner@v2
11+
with:
12+
egress-policy: block
13+
allowed-endpoints: >
14+
github.com:443
15+
api.github.com:443
16+
17+
- uses: actions/checkout@v3
18+
- run: echo "build"

‎testfiles/addaction/output/updateConfigWithConfigComments.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: test-config-with-comments
2+
on:
3+
push:
4+
jobs:
5+
build:
6+
runs-on: ubuntu-latest
7+
steps:
8+
# Harden Runner step added by StepSecurity
9+
- name: Harden the runner (Audit all outbound calls)
10+
uses: step-security/harden-runner@v2
11+
with:
12+
egress-policy: block
13+
# Approved endpoints for CI
14+
allowed-endpoints: >
15+
github.com:443
16+
api.github.com:443
17+
# npm registry
18+
registry.npmjs.org:443
19+
20+
- uses: actions/checkout@v3
21+
- run: echo "build"

0 commit comments

Comments
 (0)