fix(docker): Anonymous image pulls now work. --enable=docker no longe… #367
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests (macOS) | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "VERSION" | |
| - "bin/**" | |
| - "profiles/**" | |
| - "scripts/**" | |
| - "docs/docs/**" | |
| - "docs/public/**" | |
| - "docs/.vitepress/config.ts" | |
| - "tests/policy/**" | |
| - "tests/surface/**" | |
| - "tests/run.sh" | |
| - "tests/setup_suite.bash" | |
| - "tests/test_helper.bash" | |
| - "dist/safehouse.sh" | |
| - ".github/workflows/tests-macos.yml" | |
| - ".github/workflows/regenerate-dist.yml" | |
| pull_request: | |
| paths: | |
| - "VERSION" | |
| - "bin/**" | |
| - "profiles/**" | |
| - "scripts/**" | |
| - "docs/docs/**" | |
| - "docs/public/**" | |
| - "docs/.vitepress/config.ts" | |
| - "tests/policy/**" | |
| - "tests/surface/**" | |
| - "tests/run.sh" | |
| - "tests/setup_suite.bash" | |
| - "tests/test_helper.bash" | |
| - "dist/safehouse.sh" | |
| - ".github/workflows/tests-macos.yml" | |
| - ".github/workflows/regenerate-dist.yml" | |
| workflow_dispatch: | |
| # Disallow all GITHUB_TOKEN permissions by default | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| test-macos: | |
| name: Tests (macOS) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # "latest" and "latest - 1" macOS coverage. | |
| # NOTE: The "macos-latest" runner can resolve to different major versions of macOS | |
| # when rerun only minutes apart, so it is not safe for deterministic use. | |
| runner: | |
| - macos-26 | |
| - macos-15 | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - name: Checkout branch | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| persist-credentials: false | |
| # Refuse to run dist/safehouse.sh if it is inconsistent with a | |
| # fresh regeneration, so a PR can't smuggle in arbitrary code, | |
| # past a maintainer's lightweight review of whether it is safe | |
| # to run CI workflows on a PR. | |
| - name: Verify dist/safehouse.sh matches source | |
| run: ./scripts/generate-dist.sh --check | |
| - name: Install test and browser dependencies | |
| env: | |
| HOMEBREW_NO_AUTO_UPDATE: "1" | |
| # NOTE: ignore[adhoc-packages]: --min-release-age=N mitigates the ad-hoc | |
| # unlocked npm installs below | |
| run: | # zizmor: ignore[adhoc-packages] | |
| # 1. Install Safehouse's own dependencies. (TODO: Consider pinning.) | |
| # 2. Install latest unpinned versions of tools explicitly supported | |
| # as running inside a Safehouse sandbox | |
| # NOTE: Does NOT use any kind of --min-release-age=N option | |
| # to reduce exposure to freshly-published supply chain | |
| # compromises because these formulae are all from homebrew-core | |
| # and thus are reviewed manually by a Homebrew maintainer | |
| # (not just the formula author) before publish. | |
| brew install \ | |
| bats-core parallel \ | |
| fnm gnupg node | |
| # NOTE: --cask marks vendor-built items (not built by Homebrew). | |
| # Integrity checking varies: temurin is currently pinned; | |
| # google-chrome is currently unpinned. | |
| brew install --cask google-chrome temurin | |
| # NOTE: Uses --min-release-age=N to reduce exposure to | |
| # freshly-published supply chain compromises. | |
| npm install --global --no-fund --no-audit --min-release-age=4 \ | |
| agent-browser playwright | |
| # Configure temurin | |
| shopt -s nullglob | |
| temurin_homes=(/Library/Java/JavaVirtualMachines/temurin*.jdk/Contents/Home) | |
| shopt -u nullglob | |
| if [[ "${#temurin_homes[@]}" -eq 0 ]]; then | |
| echo "temurin install did not create a JDK under /Library/Java/JavaVirtualMachines" >&2 | |
| exit 1 | |
| fi | |
| printf 'JAVA_HOME=%s\n' "${temurin_homes[0]}" >> "${GITHUB_ENV}" | |
| printf '%s\n' "${temurin_homes[0]}/bin" >> "${GITHUB_PATH}" | |
| agent-browser install | |
| playwright install chromium-headless-shell | |
| - name: Install Rust toolchain | |
| env: | |
| HOMEBREW_NO_AUTO_UPDATE: "1" | |
| run: | | |
| brew install rustup | |
| printf '%s\n' "$(brew --prefix rustup)/bin" >> "${GITHUB_PATH}" | |
| "$(brew --prefix rustup)/bin/rustup" toolchain install stable --profile minimal --no-self-update | |
| printf '%s\n' "${HOME}/.cargo/bin" >> "${GITHUB_PATH}" | |
| - name: Run test suite | |
| run: | | |
| ./tests/run.sh | |
| - name: Run fnm-backed node PATH regression | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| eval "$(fnm env --shell bash)" | |
| fnm install 24 | |
| fnm use 24 | |
| echo "node => $(command -v node)" | |
| echo "npm => $(command -v npm)" | |
| case "$(command -v npm)" in | |
| "$HOME"/.local/state/fnm_multishells/*/bin/npm) | |
| ;; | |
| *) | |
| echo "npm is not resolving through an fnm multishell path" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| bats --filter 'real fnm multishell PATH entry' tests/policy/runtime/toolchains.bats |