mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-11 14:38:38 +00:00
0f7d8709d3
* feat(sandbox): add controlled egress approvals * Apply batched suggestions from code review * fix(sandbox): harden restricted network policy * fix(sandbox): harden denied egress handling * fix(sandbox): isolate network proxy sidecar * chore: retry sandbox image smoke * fix(sandbox): close remaining network policy gaps * fix(sandbox): harden relay token rejection * fix(sandbox): fence incompatible policy replacement * fix(sandbox): replace containers across network modes * fix(sandbox): close remaining lifecycle gaps --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
32 lines
1.3 KiB
Python
32 lines
1.3 KiB
Python
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
WORKFLOW = Path(__file__).resolve().parents[2] / ".github" / "workflows" / "sandbox-network-proxy-image.yaml"
|
|
|
|
|
|
def test_pull_request_proxy_build_has_read_only_permissions():
|
|
workflow = yaml.safe_load(WORKFLOW.read_text(encoding="utf-8"))
|
|
validate = workflow["jobs"]["validate"]
|
|
build = next(step for step in validate["steps"] if step["name"] == "Build image")
|
|
|
|
assert validate["if"] == "github.event_name == 'pull_request'"
|
|
assert validate["permissions"] == {"contents": "read"}
|
|
assert build["with"]["push"] is False
|
|
|
|
|
|
def test_proxy_publish_credentials_are_gated_to_upstream_main_pushes():
|
|
workflow = yaml.safe_load(WORKFLOW.read_text(encoding="utf-8"))
|
|
publish = workflow["jobs"]["publish"]
|
|
build = next(step for step in publish["steps"] if step["name"] == "Build and publish image")
|
|
|
|
assert publish["if"] == "github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'bytedance/deer-flow'"
|
|
assert publish["permissions"] == {
|
|
"contents": "read",
|
|
"packages": "write",
|
|
"attestations": "write",
|
|
"id-token": "write",
|
|
}
|
|
assert build["with"]["push"] is True
|
|
assert "workflow_dispatch" not in WORKFLOW.read_text(encoding="utf-8")
|