mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-26 15:00:48 +01:00
Chris Lu
52d91008ac
GitHub is retiring ubuntu-22.04; move all 94 runs-on pins across 40 workflows to ubuntu-24.04. rust_binaries_release: the arm64 cross step was jammy-era — noble keeps apt sources in deb822 ubuntu.sources (the sources.list edit was a silent no-op that left amd64 repos open to arm64 and 404'd) and ports suites must say noble. Pin deb822 stanzas to amd64 and add noble ports entries.
438 lines
14 KiB
YAML
438 lines
14 KiB
YAML
name: "S3 Policy Integration Tests"
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'weed/s3api/s3_iam_middleware.go'
|
|
- 'weed/s3api/s3api_bucket_policy*.go'
|
|
- 'weed/s3api/s3_action_resolver.go'
|
|
- 'weed/s3api/policy/**'
|
|
- 'weed/iam/**'
|
|
- 'test/s3/iam/**'
|
|
- 'test/s3/policy/**'
|
|
- '.github/workflows/s3-policy-tests.yml'
|
|
push:
|
|
branches: [ master, main ]
|
|
paths:
|
|
- 'weed/s3api/s3_iam_middleware.go'
|
|
- 'weed/s3api/s3api_bucket_policy*.go'
|
|
- 'weed/s3api/s3_action_resolver.go'
|
|
- 'weed/s3api/policy/**'
|
|
- 'weed/iam/**'
|
|
- 'test/s3/iam/**'
|
|
- 'test/s3/policy/**'
|
|
- '.github/workflows/s3-policy-tests.yml'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: weed
|
|
|
|
jobs:
|
|
# Unit tests for policy components
|
|
policy-unit-tests:
|
|
name: S3 Policy Unit Tests
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v7
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
cache: ${{ runner.environment == 'github-hosted' }}
|
|
id: go
|
|
|
|
- name: Get dependencies
|
|
run: |
|
|
go mod download
|
|
|
|
- name: Run S3 Policy Unit Tests
|
|
timeout-minutes: 10
|
|
run: |
|
|
set -x
|
|
echo "=== Running S3 Action Resolver Tests ==="
|
|
go test -v -timeout 5m ./s3api/... -run ".*ActionResolver.*"
|
|
|
|
echo "=== Running S3 Bucket Policy Engine Tests ==="
|
|
go test -v -timeout 5m ./s3api/... -run ".*BucketPolicy.*|.*PolicyEngine.*"
|
|
|
|
echo "=== Running IAM Policy Tests ==="
|
|
go test -v -timeout 5m ./iam/policy/...
|
|
|
|
- name: Upload test results on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: policy-unit-test-results
|
|
path: |
|
|
weed/testdata/
|
|
weed/**/testdata/
|
|
retention-days: 3
|
|
|
|
# S3 Policy Variables Integration Tests
|
|
s3-policy-variables-tests:
|
|
name: S3 Policy Variables Integration Tests
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 25
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Clean up stale FUSE mounts
|
|
uses: ./.github/actions/cleanup-stale-fuse-mounts
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v7
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
cache: ${{ runner.environment == 'github-hosted' }}
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Policy Variables Integration Tests
|
|
timeout-minutes: 20
|
|
working-directory: test/s3/iam
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
timeout 15 df -h || true
|
|
|
|
echo "=== Starting S3 Policy Variables Integration Tests ==="
|
|
|
|
# Set WEED_BINARY to use the installed version
|
|
export WEED_BINARY=$(which weed)
|
|
export TEST_TIMEOUT=15m
|
|
|
|
# Run policy variables tests
|
|
echo "Running policy variables tests..."
|
|
|
|
# Kill any existing weed server on port 8333
|
|
if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
|
|
kill $(lsof -t -i:8333) 2>/dev/null || true
|
|
sleep 2
|
|
fi
|
|
|
|
# Start weed server with IAM configuration
|
|
echo "Starting weed server with IAM configuration..."
|
|
$WEED_BINARY server \
|
|
-s3 \
|
|
-s3.port=8333 \
|
|
-s3.iam.config="$(pwd)/test_iam_config.json" \
|
|
-filer \
|
|
-volume.max=0 \
|
|
-master.volumeSizeLimitMB=100 \
|
|
-s3.allowDeleteBucketNotEmpty=true \
|
|
> /tmp/weed_policy_test_server.log 2>&1 &
|
|
|
|
SERVER_PID=$!
|
|
echo "Server started with PID: $SERVER_PID"
|
|
|
|
# Wait for server to be ready
|
|
echo "Waiting for server to be ready..."
|
|
MAX_WAIT=30
|
|
COUNTER=0
|
|
while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
|
|
sleep 1
|
|
COUNTER=$((COUNTER + 1))
|
|
if [ $COUNTER -ge $MAX_WAIT ]; then
|
|
echo "Server failed to start within ${MAX_WAIT} seconds"
|
|
echo "Server log:"
|
|
cat /tmp/weed_policy_test_server.log
|
|
kill $SERVER_PID 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "Server is ready!"
|
|
|
|
# Trap to ensure server is killed on exit
|
|
trap "kill $SERVER_PID 2>/dev/null || true" EXIT
|
|
|
|
# Run the tests
|
|
go test -v -timeout 15m -run TestS3PolicyVariables ./...
|
|
|
|
- name: Show service logs on failure
|
|
if: failure()
|
|
working-directory: test/s3/iam
|
|
run: |
|
|
echo "=== Service Logs ==="
|
|
if [ -f /tmp/weed_policy_test_server.log ]; then
|
|
echo "--- Last 100 lines of Server Log ---"
|
|
tail -100 /tmp/weed_policy_test_server.log
|
|
fi
|
|
echo ""
|
|
echo "=== Process Information ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: s3-policy-variables-test-logs
|
|
path: /tmp/weed_policy_test_server.log
|
|
retention-days: 5
|
|
|
|
# S3 Policy Enforcement Integration Tests
|
|
s3-policy-enforcement-tests:
|
|
name: S3 Policy Enforcement Integration Tests
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 30
|
|
strategy:
|
|
matrix:
|
|
test-case: ["basic-policy", "contextual-policy", "advanced-policy"]
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Clean up stale FUSE mounts
|
|
uses: ./.github/actions/cleanup-stale-fuse-mounts
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v7
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
cache: ${{ runner.environment == 'github-hosted' }}
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Policy Enforcement Tests - ${{ matrix.test-case }}
|
|
timeout-minutes: 25
|
|
working-directory: test/s3/iam
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
timeout 15 df -h || true
|
|
|
|
echo "=== Starting S3 Policy Enforcement Tests (${{ matrix.test-case }}) ==="
|
|
|
|
export WEED_BINARY=$(which weed)
|
|
export TEST_TIMEOUT=20m
|
|
|
|
# Kill any existing weed server on port 8333
|
|
if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
|
|
kill $(lsof -t -i:8333) 2>/dev/null || true
|
|
sleep 2
|
|
fi
|
|
|
|
# Start weed server with IAM configuration
|
|
echo "Starting weed server with IAM configuration..."
|
|
$WEED_BINARY server \
|
|
-s3 \
|
|
-s3.port=8333 \
|
|
-s3.iam.config="$(pwd)/test_iam_config.json" \
|
|
-filer \
|
|
-volume.max=0 \
|
|
-master.volumeSizeLimitMB=100 \
|
|
-s3.allowDeleteBucketNotEmpty=true \
|
|
> /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log 2>&1 &
|
|
|
|
SERVER_PID=$!
|
|
echo "Server started with PID: $SERVER_PID"
|
|
|
|
# Wait for server to be ready
|
|
echo "Waiting for server to be ready..."
|
|
MAX_WAIT=30
|
|
COUNTER=0
|
|
while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
|
|
sleep 1
|
|
COUNTER=$((COUNTER + 1))
|
|
if [ $COUNTER -ge $MAX_WAIT ]; then
|
|
echo "Server failed to start within ${MAX_WAIT} seconds"
|
|
cat /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
|
|
kill $SERVER_PID 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "Server is ready!"
|
|
|
|
# Trap to ensure server is killed on exit
|
|
trap "kill $SERVER_PID 2>/dev/null || true" EXIT
|
|
|
|
# Run tests based on test case
|
|
case "${{ matrix.test-case }}" in
|
|
"basic-policy")
|
|
echo "Running basic policy enforcement tests..."
|
|
go test -v -timeout 20m -run "TestS3IAMBucketPolicy|TestS3IAMPolicyEnforcement" ./...
|
|
;;
|
|
"contextual-policy")
|
|
echo "Running contextual policy tests..."
|
|
go test -v -timeout 20m -run "TestS3PolicyVariables|TestS3IAMContextual" ./...
|
|
;;
|
|
"advanced-policy")
|
|
echo "Running advanced policy tests..."
|
|
go test -v -timeout 20m -run "TestS3IAMMultipart|TestS3IAMPresigned" ./...
|
|
;;
|
|
*)
|
|
echo "Unknown test case: ${{ matrix.test-case }}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
- name: Show service logs on failure
|
|
if: failure()
|
|
working-directory: test/s3/iam
|
|
run: |
|
|
echo "=== Service Logs ==="
|
|
if [ -f /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log ]; then
|
|
echo "--- Last 100 lines of Server Log ---"
|
|
tail -100 /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
|
|
fi
|
|
echo ""
|
|
echo "=== Process Information ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: s3-policy-enforcement-logs-${{ matrix.test-case }}
|
|
path: /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
|
|
retention-days: 5
|
|
|
|
# Trusted Proxy Detection Tests
|
|
trusted-proxy-tests:
|
|
name: Trusted Proxy Detection Tests
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v7
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
cache: ${{ runner.environment == 'github-hosted' }}
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run Trusted Proxy Tests
|
|
timeout-minutes: 15
|
|
working-directory: test/s3/iam
|
|
run: |
|
|
set -x
|
|
echo "=== Running Trusted Proxy Detection Tests ==="
|
|
|
|
export WEED_BINARY=$(which weed)
|
|
|
|
# Kill any existing weed server on port 8333
|
|
if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
|
|
kill $(lsof -t -i:8333) 2>/dev/null || true
|
|
sleep 2
|
|
fi
|
|
|
|
# Start weed server
|
|
echo "Starting weed server..."
|
|
$WEED_BINARY server \
|
|
-s3 \
|
|
-s3.port=8333 \
|
|
-s3.iam.config="$(pwd)/test_iam_config.json" \
|
|
-filer \
|
|
-volume.max=0 \
|
|
-master.volumeSizeLimitMB=100 \
|
|
-s3.allowDeleteBucketNotEmpty=true \
|
|
> /tmp/weed_proxy_test.log 2>&1 &
|
|
|
|
SERVER_PID=$!
|
|
echo "Server started with PID: $SERVER_PID"
|
|
|
|
# Wait for server to be ready
|
|
echo "Waiting for server to be ready..."
|
|
MAX_WAIT=30
|
|
COUNTER=0
|
|
while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
|
|
sleep 1
|
|
COUNTER=$((COUNTER + 1))
|
|
if [ $COUNTER -ge $MAX_WAIT ]; then
|
|
echo "Server failed to start within ${MAX_WAIT} seconds"
|
|
kill $SERVER_PID 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
# Trap to ensure server is killed on exit
|
|
trap "kill $SERVER_PID 2>/dev/null || true" EXIT
|
|
|
|
# Run proxy tests
|
|
go test -v -timeout 10m -run "TestTrustedProxy|TestPrivateIP" ./...
|
|
|
|
- name: Show service logs on failure
|
|
if: failure()
|
|
run: |
|
|
echo "=== Service Logs ==="
|
|
if [ -f /tmp/weed_proxy_test.log ]; then
|
|
echo "--- Last 100 lines of Server Log ---"
|
|
tail -100 /tmp/weed_proxy_test.log
|
|
fi
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: trusted-proxy-test-logs
|
|
path: /tmp/weed_proxy_test.log
|
|
retention-days: 3
|
|
|
|
# S3 Policy Shell Integration Tests
|
|
s3-policy-shell-tests:
|
|
name: S3 Policy Shell Integration Tests
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v7
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
cache: ${{ runner.environment == 'github-hosted' }}
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Policy Shell Tests
|
|
timeout-minutes: 10
|
|
working-directory: test/s3/policy
|
|
run: |
|
|
set -x
|
|
echo "=== Running S3 Policy Shell Tests ==="
|
|
|
|
# Set WEED_BINARY to use the installed version (though test uses 'weed' command)
|
|
export WEED_BINARY=$(which weed)
|
|
export PATH=$PATH:$(dirname $WEED_BINARY)
|
|
|
|
go test -v -timeout 10m ./...
|