Make the trust-store sidecar guard reachable, format-aware and testable #71
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Chainguard, Inc. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Offline Scan | |
| on: | |
| pull_request: | |
| branches: ['main'] | |
| paths: | |
| - 'tests/oscap-offline/**' | |
| - 'tests/stamps/**' | |
| - 'gpos/**' | |
| - 'Makefile' | |
| - '.github/workflows/offline-tests.yaml' | |
| push: | |
| branches: ['main'] | |
| paths: | |
| - 'tests/oscap-offline/**' | |
| - 'tests/stamps/**' | |
| - 'gpos/**' | |
| - 'Makefile' | |
| - '.github/workflows/offline-tests.yaml' | |
| permissions: {} | |
| jobs: | |
| offline-scan: | |
| name: Offline scan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| env: | |
| # Require at least one scan to execute: with this set, a prerequisite gap | |
| # (no docker, no datastream, no registry) fails the job instead of | |
| # reporting a vacuous green. make test-offline inherits this env. | |
| OSCAP_OFFLINE_REQUIRE: "1" | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| cgr.dev:443 | |
| github.com:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| proxy.golang.org:443 | |
| release-assets.githubusercontent.com:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| - name: Check out code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'tests/oscap-offline/go.mod' | |
| cache-dependency-path: 'tests/oscap-offline/go.sum' | |
| # Hermetic: `crane` is stubbed and the fixtures are built on disk, so this | |
| # needs no registry access and adds no allowed endpoints. It covers the | |
| # trust-store guard's failure paths, which the daily update-ca-cert run | |
| # never reaches because it only ever sees a healthy image. | |
| - name: Run trust-store sidecar guard self-test | |
| run: make test-stamps-selftest | |
| - name: Run offline harness | |
| run: make test-offline | |
| # Docker is preinstalled on ubuntu-latest, so the offline harness can | |
| # pull the pinned wolfi-base and openscap scanner images it needs. If | |
| # docker (or network egress) is unavailable, the harness skips cleanly. |