Skip to content
Test

feat: add sfw input to wrap vp install with Socket Firewall Free #244

Sign in to view logs

feat: add sfw input to wrap vp install with Socket Firewall Free

feat: add sfw input to wrap vp install with Socket Firewall Free #244

Workflow file for this run

.github/workflows/test.yml at c4df421
name: Test
on:
push:
branches: [main]
pull_request:
branches: [main]
merge_group:
jobs:
test:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
version: [latest, alpha]
runs-on: ${{ matrix.os }}
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Setup Vite+ (${{ matrix.version }})
uses: ./
with:
version: ${{ matrix.version }}
run-install: false
cache: false
- name: Verify installation
run: vp --version
test-node-version:
strategy:
fail-fast: false
matrix:
node-version: ["lts", "22", "24"]
version: [latest, alpha]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Setup Vite+ (${{ matrix.version }}) with Node.js ${{ matrix.node-version }}
uses: ./
with:
version: ${{ matrix.version }}
node-version: ${{ matrix.node-version }}
run-install: false
cache: false
- name: Verify installation
run: vp --version
- name: Verify Node.js version
shell: bash
run: |
ACTUAL=$(node --version)
echo "Node.js version: $ACTUAL"
if [ "${{ matrix.node-version }}" != "lts" ]; then
echo "$ACTUAL" | grep -q "^v${{ matrix.node-version }}\." || (echo "Expected Node.js v${{ matrix.node-version }}.x but got $ACTUAL" && exit 1)
fi
test-cache-pnpm:
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project with pnpm-lock.yaml
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true}' > package.json
touch pnpm-lock.yaml
- name: Setup Vite+ (${{ matrix.version }}) with pnpm cache
uses: ./
id: setup
with:
version: ${{ matrix.version }}
run-install: false
cache: true
cache-dependency-path: test-project/pnpm-lock.yaml
- name: Verify installation
run: |
vp --version
echo "Installed version: ${{ steps.setup.outputs.version }}"
echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"
test-cache-npm:
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project with package-lock.json
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true}' > package.json
echo '{"name":"test-project","lockfileVersion":3}' > package-lock.json
- name: Setup Vite+ (${{ matrix.version }}) with npm cache
uses: ./
id: setup
with:
version: ${{ matrix.version }}
run-install: false
cache: true
cache-dependency-path: test-project/package-lock.json
- name: Verify installation
run: |
vp --version
echo "Installed version: ${{ steps.setup.outputs.version }}"
echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"
test-cache-yarn:
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project with yarn.lock
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true}' > package.json
touch yarn.lock
- name: Setup Vite+ (${{ matrix.version }}) with yarn cache
uses: ./
id: setup
with:
version: ${{ matrix.version }}
run-install: false
cache: true
cache-dependency-path: test-project/yarn.lock
- name: Verify installation
run: |
vp --version
echo "Installed version: ${{ steps.setup.outputs.version }}"
echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"
test-cache-bun:
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
lockfile: [bun.lock, bun.lockb]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project with ${{ matrix.lockfile }}
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true}' > package.json
touch ${{ matrix.lockfile }}
- name: Setup Vite+ (${{ matrix.version }}) with bun cache (${{ matrix.lockfile }})
uses: ./
id: setup
with:
version: ${{ matrix.version }}
run-install: false
cache: true
cache-dependency-path: test-project/${{ matrix.lockfile }}
- name: Verify installation
run: |
vp --version
echo "Installed version: ${{ steps.setup.outputs.version }}"
echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"
test-vp-exec:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
version: [latest, alpha]
runs-on: ${{ matrix.os }}
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Setup Vite+ (${{ matrix.version }})
uses: ./
with:
version: ${{ matrix.version }}
run-install: false
cache: false
- name: Verify vp exec works
run: vp exec node -e "console.log('vp exec works')"
test-vp-install-and-exec:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
version: [latest, alpha]
runs-on: ${{ matrix.os }}
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project
shell: bash
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true,"scripts":{"hello":"node -e \"console.log(1+1)\""}}' > package.json
- name: Setup Vite+ (${{ matrix.version }}) with install
uses: ./
with:
version: ${{ matrix.version }}
run-install: |
- cwd: test-project
cache: false
- name: Verify vp exec in project
working-directory: test-project
run: vp exec node -e "console.log('vp exec in project works')"
- name: Verify vp run in project
working-directory: test-project
run: vp run hello
test-registry-url:
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Setup Vite+ (${{ matrix.version }}) with registry-url
uses: ./
with:
version: ${{ matrix.version }}
run-install: false
cache: false
registry-url: "https://npm.pkg.github.com"
scope: "@voidzero-dev"
- name: Verify .npmrc was created
run: |
echo "NPM_CONFIG_USERCONFIG=$NPM_CONFIG_USERCONFIG"
cat "$NPM_CONFIG_USERCONFIG"
grep -q "@voidzero-dev:registry=https://npm.pkg.github.com/" "$NPM_CONFIG_USERCONFIG"
grep -q "_authToken=\${NODE_AUTH_TOKEN}" "$NPM_CONFIG_USERCONFIG"
- name: Verify NODE_AUTH_TOKEN is exported
run: |
echo "NODE_AUTH_TOKEN is set: ${NODE_AUTH_TOKEN:+yes}"
test-alpine-container:
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
container:
image: alpine:3.23
steps:
- name: Install Alpine dependencies
run: apk add --no-cache bash curl gcompat libstdc++
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Setup Vite+ (${{ matrix.version }})
uses: ./
with:
version: ${{ matrix.version }}
run-install: false
cache: false
- name: Verify installation
run: vp --version
- name: Verify vp exec works
run: vp exec node -e "console.log('vp exec works in Alpine')"
test-sfw:
# Linux-only: sfw's MITM proxy issues a CA cert with a present-but-empty
# EKU extension. OpenSSL accepts it, but rustls / Go's crypto/x509 reject
# it as UnknownIssuer. vp is a Rust binary (rustls), so on macOS / Windows
# any HTTPS call vp makes through sfw fails the TLS handshake before sfw
# can inspect the install. Ubuntu happens to work because pnpm is
# preinstalled on the runner and vp skips its bootstrap fetch.
# Tracking upstream:
# https://github.com/SocketDev/sfw-free/issues/30
# https://github.com/SocketDev/sfw-free/issues/43
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project with a real dependency
shell: bash
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > package.json
- name: Setup Vite+ (${{ matrix.version }}) with sfw
uses: ./
with:
version: ${{ matrix.version }}
sfw: true
run-install: |
- cwd: test-project
cache: false
- name: Verify sfw is on PATH
run: sfw --version
- name: Verify dependency installed under sfw
working-directory: test-project
run: vp exec node -e "console.log(require('is-odd')(3))"
test-sfw-alpine:
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
container:
image: alpine:3.23
steps:
- name: Install Alpine dependencies
run: apk add --no-cache bash curl gcompat libstdc++
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project with a real dependency
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > package.json
- name: Setup Vite+ (${{ matrix.version }}) with sfw (musl)
uses: ./
with:
version: ${{ matrix.version }}
sfw: true
run-install: |
- cwd: test-project
cache: false
- name: Verify sfw is on PATH (musl)
run: sfw --version
- name: Verify dependency installed under sfw (musl)
working-directory: test-project
run: vp exec node -e "console.log(require('is-odd')(3))"
test-sfw-blocks-malicious:
# Verifies sfw actually intercepts a known-malicious package, not just
# that it wraps the install. Uses `lodahs` (lodash typosquat), the same
# canary SocketDev's own workflows use:
# https://github.com/SocketDev/bun-security-scanner/blob/main/.github/workflows/test.yml
# If this job ever stops blocking, either sfw is misconfigured or the
# canary itself has been delisted — swap it for another Socket-flagged
# package from https://socket.dev/blog/category/threat-research.
strategy:
fail-fast: false
matrix:
version: [latest, alpha]
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Create test project with a benign dependency
shell: bash
run: |
mkdir -p test-project
cd test-project
echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > package.json
- name: Setup Vite+ (${{ matrix.version }}) with sfw and install benign dep
uses: ./
with:
version: ${{ matrix.version }}
sfw: true
run-install: |
- cwd: test-project
cache: false
- name: Assert sfw blocks malicious package (lodahs typosquat of lodash)
shell: bash
working-directory: test-project
run: |
if sfw vp install lodahs; then
echo "ERROR: sfw failed to block lodahs (lodash typosquat)"
exit 1
else
echo "SUCCESS: sfw blocked lodahs as expected"
fi
build:
runs-on: ubuntu-latest
steps:
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- name: Setup Vite+ with cache
uses: ./
id: setup
with:
cache: true
node-version-file: .node-version
- name: Type check
run: vp run typecheck
- name: Check
run: vp run check
- name: Unit tests
run: vp run test
- name: Build
run: vp run build
- name: Verify dist is up to date
run: |
git diff --exit-code dist/ || (echo "dist/ is out of date. Run 'vp run build' and commit." && exit 1)