gha-command-proof 1.0.0

Verifier for GitHub Actions workflow commands and environment files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

use assert_cmd::Command;
use predicates::prelude::*;
use tempfile::tempdir;

#[test]
fn log_mode_accepts_valid_command_stream_and_writes_redacted_log() {
    let dir = tempdir().expect("tempdir");
    let log = dir.path().join("step.log");
    let redacted = dir.path().join("redacted.log");
    std::fs::write(
        &log,
        "::add-mask::s3cr3t\nplain s3cr3t\n::warning::s3cr3t\n",
    )
    .expect("write log");

    Command::cargo_bin("gha-command-proof")
        .expect("binary")
        .args([
            "log",
            log.to_str().unwrap(),
            "--redacted-log-output",
            redacted.to_str().unwrap(),
        ])
        .assert()
        .success()
        .stdout(predicate::str::contains("summary:"));

    let redacted = std::fs::read_to_string(redacted).expect("read redacted");
    assert!(redacted.contains("plain ***"));
    assert!(!redacted.contains("s3cr3t"));
}

#[test]
fn log_mode_fails_disabled_stdout_commands() {
    let dir = tempdir().expect("tempdir");
    let log = dir.path().join("bad.log");
    std::fs::write(&log, "::set-env name=FOO::bar\n").expect("write log");

    Command::cargo_bin("gha-command-proof")
        .expect("binary")
        .args(["log", log.to_str().unwrap()])
        .assert()
        .failure()
        .stdout(predicate::str::contains("commands.unsupported"));
}

#[test]
fn env_file_mode_fails_node_options() {
    let dir = tempdir().expect("tempdir");
    let env = dir.path().join("GITHUB_ENV");
    std::fs::write(&env, "NODE_OPTIONS=--inspect\n").expect("write env");

    Command::cargo_bin("gha-command-proof")
        .expect("binary")
        .args(["env-file", "--kind", "env", env.to_str().unwrap()])
        .assert()
        .failure()
        .stdout(predicate::str::contains("env_file.env.node_options"));
}

#[test]
fn step_mode_detects_masked_output_value() {
    let dir = tempdir().expect("tempdir");
    let log = dir.path().join("step.log");
    let output = dir.path().join("GITHUB_OUTPUT");
    std::fs::write(&log, "::add-mask::s3cr3t\n").expect("write log");
    std::fs::write(&output, "token=s3cr3t\n").expect("write output");

    Command::cargo_bin("gha-command-proof")
        .expect("binary")
        .args([
            "step",
            "--log",
            log.to_str().unwrap(),
            "--github-output",
            output.to_str().unwrap(),
            "--format",
            "json",
        ])
        .assert()
        .failure()
        .stdout(predicate::str::contains("env_file.output.masked_value"))
        .stdout(predicate::str::contains("\"value\": \"***\""))
        .stdout(predicate::str::contains("s3cr3t").not());
}

#[test]
fn strict_mode_treats_warnings_as_failures() {
    let dir = tempdir().expect("tempdir");
    let log = dir.path().join("warn.log");
    std::fs::write(&log, "::set-output name=result::ok\n").expect("write log");

    Command::cargo_bin("gha-command-proof")
        .expect("binary")
        .args(["log", log.to_str().unwrap(), "--strict"])
        .assert()
        .failure()
        .stdout(predicate::str::contains("0 warned, 1 failed"));
}