mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
2f959e6afb
Security audit of .github/workflows found a script-injection vector in the release workflow, over-broad token grants on non-publishing jobs, and downloaded tooling/manifests executed without integrity checks. - release: pass the tag/dispatch input through env instead of interpolating it into the validation script; default workflow permissions to contents:read - build-main/build-gateway: grant write scopes only to the build job - _build-image/codeql: stop persisting checkout credentials - ci/release: verify actionlint, hadolint and git-cliff against pinned SHA-256s - ci-manifests/e2e: verify upstream CRD manifests against versions.env pins - e2e: redact token material before uploading cluster diagnostics - docs: add workflow-security.md with controls, audit record and residual repository-setting recommendations Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
84 lines
3.3 KiB
YAML
84 lines
3.3 KiB
YAML
# Weekly end-to-end run of the agents-as-a-service example against a real kind
|
|
# cluster with agent-sandbox installed. Scheduled (not PR-blocking) so upstream
|
|
# controller churn does not block merges; also available on demand.
|
|
name: E2E (kind)
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 6 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: e2e-kind
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
e2e:
|
|
name: Example walkthrough on kind
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Create kind cluster
|
|
uses: helm/kind-action@1544676c07bb3570fcb70166beaa07c4528fd4aa # v1.15.1
|
|
with:
|
|
version: v0.33.0
|
|
cluster_name: dsh-e2e
|
|
- name: Read versions.env
|
|
run: |
|
|
set -euo pipefail
|
|
while IFS= read -r line; do
|
|
case "$line" in ''|'#'*) continue ;; esac
|
|
echo "$line" >> "$GITHUB_ENV"
|
|
done < versions.env
|
|
- name: Install agent-sandbox
|
|
run: |
|
|
set -euo pipefail
|
|
curl -fsSL --proto '=https' -o /tmp/agent-sandbox.yaml \
|
|
"https://github.com/kubernetes-sigs/agent-sandbox/releases/download/$AGENT_SANDBOX_VERSION/sandbox-with-extensions.yaml"
|
|
printf '%s %s\n' "$AGENT_SANDBOX_MANIFEST_SHA256" /tmp/agent-sandbox.yaml | sha256sum -c -
|
|
kubectl apply -f /tmp/agent-sandbox.yaml
|
|
kubectl -n agent-sandbox-system rollout status deployment --timeout=180s
|
|
kubectl wait --for=condition=Established crd/sandboxtemplates.extensions.agents.x-k8s.io --timeout=180s
|
|
kubectl wait --for=condition=Established crd/sandboxwarmpools.extensions.agents.x-k8s.io --timeout=180s
|
|
kubectl wait --for=condition=Established crd/sandboxclaims.extensions.agents.x-k8s.io --timeout=180s
|
|
kubectl wait --for=condition=Established crd/sandboxes.agents.x-k8s.io --timeout=180s
|
|
- name: Set up Python (WebSocket checks)
|
|
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install WebSocket client
|
|
run: pip install "websockets==17.3"
|
|
- name: Run the example walkthrough
|
|
env:
|
|
KIND_CLUSTER: dsh-e2e
|
|
run: examples/dsh-agents-as-a-service/scripts/e2e-kind.sh
|
|
- name: Collect cluster state
|
|
if: always()
|
|
run: |
|
|
set -euo pipefail
|
|
{
|
|
echo "== resources =="
|
|
kubectl get all,pvc -n dsh-demo -o wide 2>&1 || true
|
|
echo "== events =="
|
|
kubectl get events -n dsh-demo --sort-by=.lastTimestamp 2>&1 || true
|
|
echo "== gateway logs =="
|
|
# Redact any token material before this file becomes an artifact.
|
|
kubectl -n dsh-demo logs deploy/dsh-gateway --tail=200 2>&1 \
|
|
| sed -E 's/(token=)[^&"[:space:]]+/\1[REDACTED]/g' || true
|
|
} > /tmp/e2e-cluster.txt
|
|
- name: Upload cluster state
|
|
if: always()
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: e2e-cluster-state
|
|
path: /tmp/e2e-cluster.txt
|
|
if-no-files-found: warn
|
|
retention-days: 7
|