gomodjail v2: move the focus to static analysis #335
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - 'release/**' | |
| pull_request: | |
| jobs: | |
| main: | |
| env: | |
| GOTOOLCHAIN: local | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| runner: [ubuntu-24.04, macos-15-intel, macos-26] | |
| # libgomodjail_hook_darwin is sensitive to Go version | |
| go: [1.26.x, 1.27.x] | |
| build_mode: ["", "strip"] | |
| exclude: | |
| - runner: macos-15-intel | |
| build_mode: "strip" | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version: ${{ matrix.go }} | |
| - name: Install | |
| run: | | |
| set -eux | |
| make | |
| sudo make install | |
| - name: Unit tests | |
| run: go test -v ./... | |
| - name: "Unit tests: race detector (concurrent static analysis)" | |
| run: go test -race ./pkg/static/capslock/ | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v9 | |
| if: ${{ !contains(matrix.go, 'rc') }} | |
| - name: "Smoke test: static mode" | |
| timeout-minutes: 5 | |
| run: | | |
| set -eux | |
| # The confined poisoned module execs vi: the gate must FAIL with an | |
| # EXEC violation, from any working directory (--go-mod sets the | |
| # load root). | |
| rc=0 | |
| gomodjail analyze --go-mod=examples/victim/go.mod ./... >analyze.log || rc=$? | |
| cat analyze.log | |
| [ "$rc" -ne 0 ] | |
| grep -F "FAIL github.com/AkihiroSuda/gomodjail/examples/poisoned" analyze.log | |
| grep -F "os/exec.Command" analyze.log | |
| rm -f analyze.log | |
| cd examples/victim | |
| # Machine-readable reports | |
| gomodjail analyze --format=json ./... >report.json || true | |
| jq -e '.modules[] | select(.module == "github.com/AkihiroSuda/gomodjail/examples/poisoned") | .violations[0].capability == "EXEC"' report.json | |
| gomodjail analyze --format=sarif ./... >report.sarif || true | |
| jq -e '.version == "2.1.0" and (.runs[0].results | length > 0)' report.sarif | |
| # poisoned is the only confined module here, so gomodjail fix must | |
| # refuse to unconfine it (the gate would afterwards hard-error with | |
| # "no confined modules") and leave go.mod untouched. | |
| rc=0 | |
| gomodjail fix --from-report=report.json >fix.log 2>&1 || rc=$? | |
| cat fix.log | |
| [ "$rc" -ne 0 ] | |
| grep -F "refusing to unconfine all 1 confined module(s)" fix.log | |
| grep -F "gomodjail:confined" go.mod | |
| git diff --exit-code go.mod | |
| rm -f report.json report.sarif fix.log | |
| - name: "Smoke test: dynamic mode" | |
| timeout-minutes: 5 | |
| env: | |
| BUILD_MODE: ${{ matrix.build_mode }} | |
| run: | | |
| set -eux | |
| cd examples/victim | |
| if [ "${BUILD_MODE}" = "strip" ]; then | |
| go build -ldflags="-s -w" | |
| else | |
| go build | |
| fi | |
| # Unpacked mode | |
| gomodjail run --go-mod=go.mod -- ./victim | |
| # Packed mode | |
| gomodjail pack --go-mod=go.mod ./victim | |
| ./victim.gomodjail | |
| if [ "$(find /tmp -maxdepth 1 -type d -name 'gomodjail*' | awk 'END{print NR}')" != "0" ]; then | |
| echo >&2 "tmp files are leaked" | |
| exit 1 | |
| fi | |
| - name: "Smoke test: docker (not dockerd)" | |
| if: runner.os == 'Linux' | |
| timeout-minutes: 5 | |
| run: | | |
| set -eux | |
| DOCKER="gomodjail run --go-mod=./examples/profiles/docker.mod -- docker" | |
| $DOCKER buildx create --name foo --use | |
| cat <<EOF | $DOCKER buildx build -t foo --load - | |
| FROM alpine | |
| RUN apk add bash | |
| EOF | |
| $DOCKER run --rm foo /bin/bash -c "echo hi" |