From ff9d2404ab8912b67f7cffb2ace4aa5188dc1679 Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Fri, 31 Jul 2026 06:15:56 +0200 Subject: [PATCH] Propagate CI safety settings into nested checks --- .gitea/workflows/security-audit.yml | 9 ++-- tests/test_postgres_integration_check.py | 5 ++ tests/test_security_audit_wrapper.py | 63 ++++++++++++++++++++++ tools/checks/postgres-integration-check.py | 1 + tools/checks/security-audit/run.sh | 34 ++++++++++++ 5 files changed, 108 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/security-audit.yml b/.gitea/workflows/security-audit.yml index 3b969b3..1717576 100644 --- a/.gitea/workflows/security-audit.yml +++ b/.gitea/workflows/security-audit.yml @@ -16,6 +16,11 @@ jobs: SECURITY_AUDIT_SCOPE: govoplan SECURITY_AUDIT_FAIL_ON_FINDINGS: "0" SECURITY_AUDIT_REQUIRE_TOOLS: "1" + GIT_CONFIG_COUNT: "2" + GIT_CONFIG_KEY_0: url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf + GIT_CONFIG_VALUE_0: git@git.add-ideas.de:GovOPlaN/govoplan + GIT_CONFIG_KEY_1: url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf + GIT_CONFIG_VALUE_1: ssh://git@git.add-ideas.de/GovOPlaN/govoplan steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: @@ -23,10 +28,6 @@ jobs: - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: "3.12" - - name: Use anonymous HTTPS for public GovOPlaN repositories - run: | - git config --global --add url."https://git.add-ideas.de/GovOPlaN/govoplan".insteadOf "git@git.add-ideas.de:GovOPlaN/govoplan" - git config --global --add url."https://git.add-ideas.de/GovOPlaN/govoplan".insteadOf "ssh://git@git.add-ideas.de/GovOPlaN/govoplan" - name: Bootstrap GovOPlaN repositories working-directory: govoplan run: python tools/repo/bootstrap-repositories.py --parent .. --transport public-https --exclude-repo addideas-govoplan-website diff --git a/tests/test_postgres_integration_check.py b/tests/test_postgres_integration_check.py index 633ccba..a816376 100644 --- a/tests/test_postgres_integration_check.py +++ b/tests/test_postgres_integration_check.py @@ -46,6 +46,10 @@ class PostgresIntegrationCheckTests(unittest.TestCase): env["GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS"], "false", ) + self.assertEqual( + env["GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE"], + "true", + ) def test_existing_runtime_safety_settings_are_preserved(self) -> None: module = _load_script() @@ -53,6 +57,7 @@ class PostgresIntegrationCheckTests(unittest.TestCase): "CORS_ORIGINS": "https://govoplan.example.test", "GOVOPLAN_TRUSTED_HOSTS": "govoplan.example.test", "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "true", + "GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE": "false", } with patch.dict(os.environ, configured, clear=True): diff --git a/tests/test_security_audit_wrapper.py b/tests/test_security_audit_wrapper.py index 9c7b443..5fa0dcd 100644 --- a/tests/test_security_audit_wrapper.py +++ b/tests/test_security_audit_wrapper.py @@ -491,9 +491,11 @@ class SecurityAuditContainerRunnerTests(unittest.TestCase): *, scope: str, actions_mounts: object | None = None, + **environment_overrides: str, ) -> tuple[subprocess.CompletedProcess[str], list[list[str]]]: self.docker_log.write_text("", encoding="utf-8") environment = self.environment.copy() + environment.update(environment_overrides) if actions_mounts is None: environment.pop("GITEA_ACTIONS", None) else: @@ -586,6 +588,67 @@ class SecurityAuditContainerRunnerTests(unittest.TestCase): self.assertEqual(expected_roots, repository_roots) self.assertIn("SECURITY_AUDIT_REQUIRE_TOOLS=1", run_command) + def test_gitea_job_passes_only_public_git_url_rewrites(self) -> None: + mounts = [ + { + "Type": "volume", + "Name": "govoplan-actions-workspace", + "Destination": str(META_ROOT.parent), + "RW": True, + } + ] + git_config = { + "GIT_CONFIG_COUNT": "2", + "GIT_CONFIG_KEY_0": ( + "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf" + ), + "GIT_CONFIG_VALUE_0": "git@git.add-ideas.de:GovOPlaN/govoplan", + "GIT_CONFIG_KEY_1": ( + "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf" + ), + "GIT_CONFIG_VALUE_1": ( + "ssh://git@git.add-ideas.de/GovOPlaN/govoplan" + ), + } + + result, commands = self._run( + scope="govoplan", + actions_mounts=mounts, + **git_config, + ) + + self.assertEqual(0, result.returncode, result.stderr) + run_command = next(command for command in commands if command[0] == "run") + for key, value in git_config.items(): + self.assertIn(f"{key}={value}", run_command) + + def test_container_runner_rejects_non_url_git_configuration(self) -> None: + result, _commands = self._run( + scope="current", + GIT_CONFIG_COUNT="1", + GIT_CONFIG_KEY_0="credential.helper", + GIT_CONFIG_VALUE_0="!print-secret", + ) + + self.assertEqual(1, result.returncode) + self.assertIn( + "Only credential-free HTTPS Git insteadOf rewrites", + result.stderr, + ) + + def test_security_workflow_configures_nested_public_git_resolution( + self, + ) -> None: + workflow = ( + META_ROOT / ".gitea" / "workflows" / "security-audit.yml" + ).read_text(encoding="utf-8") + + self.assertIn('GIT_CONFIG_COUNT: "2"', workflow) + self.assertIn( + "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf", + workflow, + ) + def test_non_actions_runner_keeps_the_scoped_bind_mount(self) -> None: result, commands = self._run(scope="govoplan") diff --git a/tools/checks/postgres-integration-check.py b/tools/checks/postgres-integration-check.py index b3c5258..e0d42dd 100644 --- a/tools/checks/postgres-integration-check.py +++ b/tools/checks/postgres-integration-check.py @@ -119,6 +119,7 @@ def _check_env(*, database_url: str, modules: str, app_env: str) -> dict[str, st env.setdefault("CORS_ORIGINS", "http://127.0.0.1:5173,http://localhost:5173") env.setdefault("GOVOPLAN_TRUSTED_HOSTS", "127.0.0.1,localhost,testserver") env.setdefault("GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS", "false") + env.setdefault("GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE", "true") env["PYTHONPATH"] = os.pathsep.join(part for part in (str(SRC), env.get("PYTHONPATH", "")) if part) return env diff --git a/tools/checks/security-audit/run.sh b/tools/checks/security-audit/run.sh index 41ff0c5..86346bf 100755 --- a/tools/checks/security-audit/run.sh +++ b/tools/checks/security-audit/run.sh @@ -193,6 +193,39 @@ else EXTRA_ENV=() fi +declare -a GIT_CONFIG_ENV=() +GIT_CONFIG_COUNT_VALUE="${GIT_CONFIG_COUNT:-0}" +if ! [[ "$GIT_CONFIG_COUNT_VALUE" =~ ^[0-9]+$ ]] || (( GIT_CONFIG_COUNT_VALUE > 8 )); then + echo "GIT_CONFIG_COUNT must be an integer between 0 and 8." >&2 + exit 1 +fi +for ((index = 0; index < GIT_CONFIG_COUNT_VALUE; index++)); do + key_name="GIT_CONFIG_KEY_$index" + value_name="GIT_CONFIG_VALUE_$index" + if ! [[ -v "$key_name" && -v "$value_name" ]]; then + echo "Both $key_name and $value_name are required." >&2 + exit 1 + fi + key_value="${!key_name}" + rewrite_value="${!value_name}" + target_url="${key_value#url.}" + target_url="${target_url%.insteadOf}" + if [[ "$key_value" != url.https://*.insteadOf ]] \ + || [[ "${target_url#https://}" == *"@"* ]] \ + || [[ "$rewrite_value" != git@* && "$rewrite_value" != ssh://git@* ]] \ + || [[ "$key_value" == *$'\n'* || "$rewrite_value" == *$'\n'* ]]; then + echo "Only credential-free HTTPS Git insteadOf rewrites may enter the audit container." >&2 + exit 1 + fi + GIT_CONFIG_ENV+=( + -e "$key_name=$key_value" + -e "$value_name=$rewrite_value" + ) +done +if (( GIT_CONFIG_COUNT_VALUE > 0 )); then + GIT_CONFIG_ENV+=(-e "GIT_CONFIG_COUNT=$GIT_CONFIG_COUNT_VALUE") +fi + "${DOCKER_CLI[@]}" run --rm \ --user "$(id -u):$(id -g)" \ -e HOME=/tmp/security-audit-home \ @@ -203,6 +236,7 @@ fi -e SECURITY_AUDIT_REQUIRE_TOOLS="$REQUIRE_TOOLS" \ -e SECURITY_AUDIT_TOOLBOX_FINGERPRINT="$IMAGE_FINGERPRINT" \ "${EXTRA_ENV[@]}" \ + "${GIT_CONFIG_ENV[@]}" \ "${WORKSPACE_MOUNT[@]}" \ -w "$WORKDIR" \ "$FINGERPRINT_IMAGE" \