mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
1a929e3e24
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
# Gateway unit tests and lint. Split from ci.yaml so this job can use native
|
|
# on.pull_request.paths filtering and skip PRs that do not touch the gateway.
|
|
# The job name is `python`; because it is path-filtered it is an on-demand check,
|
|
# not a required branch-protection check (see docs/gitflow.md).
|
|
name: CI (python)
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- examples/dsh-agents-as-a-service/gateway/**
|
|
- .github/workflows/ci-python.yaml
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-python-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
python:
|
|
name: python
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
defaults:
|
|
run:
|
|
working-directory: examples/dsh-agents-as-a-service/gateway
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up Python
|
|
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
|
with:
|
|
python-version: "3.12"
|
|
cache: pip
|
|
cache-dependency-path: |
|
|
examples/dsh-agents-as-a-service/gateway/requirements.txt
|
|
examples/dsh-agents-as-a-service/gateway/requirements-dev.txt
|
|
- name: Install dependencies
|
|
run: |
|
|
set -euo pipefail
|
|
python -m pip install --upgrade pip
|
|
# Both files are fully hash-pinned (uv pip compile --generate-hashes);
|
|
# pip refuses to install anything not listed with a matching hash.
|
|
pip install --require-hashes -r requirements.txt -r requirements-dev.txt
|
|
- name: Lint
|
|
run: |
|
|
set -euo pipefail
|
|
python -m ruff check .
|
|
python -m ruff format --check .
|
|
- name: Unit tests with coverage
|
|
run: >-
|
|
python -m pytest -q
|
|
--cov=. --cov-report=xml:coverage.xml --cov-report=term
|
|
--junitxml=junit.xml
|
|
- name: Coverage summary
|
|
run: |
|
|
set -euo pipefail
|
|
{
|
|
echo "### Gateway test coverage"
|
|
python -m coverage report
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
- name: Upload test artefacts
|
|
if: always()
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: gateway-test-results
|
|
path: |
|
|
examples/dsh-agents-as-a-service/gateway/junit.xml
|
|
examples/dsh-agents-as-a-service/gateway/coverage.xml
|
|
if-no-files-found: warn
|
|
retention-days: 7
|