headerproof/.github/workflows/ci.yml at main · tayfuryldz/headerproof · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
name: HeaderProof CI

on:
  workflow_dispatch:
    inputs:
      cloudflare_fixture:
        description: Controlled Cloudflare fixture base URL
        required: false
        type: string
      fastly_fixture:
        description: Controlled Fastly fixture base URL
        required: false
        type: string
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install test dependencies
        run: python -m pip install --upgrade pip ".[test]"

      - name: Compile
        run: python -m compileall -q header_active_scan.py src/headerproof

      - name: Ruff
        run: python -m ruff check header_active_scan.py src/headerproof tests

      - name: Mypy
        run: python -m mypy

      - name: Test
        run: python -m pytest -q

      - name: Proof-gate branch coverage
        if: matrix.python-version == '3.13'
        run: >-
          python -m pytest -q
          --cov=headerproof.detectors
          --cov=headerproof.evidence
          --cov-branch
          --cov-fail-under=95

  cache-fixtures:
    name: Real cache fixtures
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: "3.13"
      - name: Install
        run: python -m pip install --upgrade pip ".[test]"
      - name: Start Varnish and nginx caches
        run: docker compose -f tests/integration/cache-fixtures/docker-compose.yml up -d --wait
      - name: Verify cache matrix
        env:
          HEADERPROOF_VARNISH_FIXTURE: http://127.0.0.1:16080
          HEADERPROOF_NGINX_FIXTURE: http://127.0.0.1:17080
          HEADERPROOF_CLOUDFLARE_FIXTURE: ${{ inputs.cloudflare_fixture }}
          HEADERPROOF_FASTLY_FIXTURE: ${{ inputs.fastly_fixture }}
        run: python -m pytest -q tests/integration/test_cache_fixtures.py
      - name: Measure precision and recall
        env:
          HEADERPROOF_VARNISH_FIXTURE: http://127.0.0.1:16080
          HEADERPROOF_NGINX_FIXTURE: http://127.0.0.1:17080
          HEADERPROOF_CLOUDFLARE_FIXTURE: ${{ inputs.cloudflare_fixture }}
          HEADERPROOF_FASTLY_FIXTURE: ${{ inputs.fastly_fixture }}
        run: python tests/integration/measure_precision.py | tee cache-metrics.json
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: cache-metrics
          path: cache-metrics.json
      - if: always()
        run: docker compose -f tests/integration/cache-fixtures/docker-compose.yml down -v

  known-vulnerable-lab:
    name: DVWA false-negative measurement
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: "3.13"
      - name: Install
        run: python -m pip install --upgrade pip ".[test]"
      - name: Start official DVWA fixture
        run: docker compose -f tests/integration/dvwa-fixture/docker-compose.yml up -d
      - name: Measure known-vulnerable recall
        env:
          HEADERPROOF_DVWA_FIXTURE: http://127.0.0.1:18080
        run: python tests/integration/measure_dvwa.py | tee dvwa-metrics.json
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dvwa-metrics
          path: dvwa-metrics.json
      - if: always()
        run: docker compose -f tests/integration/dvwa-fixture/docker-compose.yml down -v

  package:
    needs: [test, cache-fixtures, known-vulnerable-lab]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: "3.13"

      - name: Build package once
        run: |
          python -m pip install --upgrade pip build
          python -m build

      - name: Install built wheel
        run: python -m pip install dist/*.whl

      - name: Installed wheel real-scan smoke test
        run: python tests/release_smoke.py

      - name: Attest the exact built artifacts
        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
        with:
          subject-path: dist/*

      - name: Upload the attested artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: headerproof-dist-${{ github.sha }}
          path: dist/*
          if-no-files-found: error