Skip to content

README: prep 1.1.0 (#48) #172

README: prep 1.1.0 (#48)

README: prep 1.1.0 (#48) #172

Workflow file for this run

name: Self-test
on:
push:
branches:
- main
pull_request:
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
selftest-requirements:
strategy:
matrix:
os: [ubuntu-latest, windows-latest]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v3
- uses: ./
id: pip-audit
with:
inputs: ./test/vulnerable.txt
no-deps: true
# NOTE: We intentionally allow failure here, since the self-test
# explicitly uses a vulnerable requirements file.
internal-be-careful-allow-failure: true
- name: assert expected output
shell: bash
env:
PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
run: |
grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")
selftest-environment:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: make the environment vulnerable
run: |
python -m pip install --no-deps --requirement ./test/vulnerable.txt
- uses: ./
id: pip-audit
with:
# NOTE: We intentionally allow failure here, since the self-test
# explicitly uses a vulnerable requirements file.
internal-be-careful-allow-failure: true
- name: assert expected output
env:
PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
run: |
grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")
selftest-virtualenv:
strategy:
matrix:
local: [true, false]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: make a virtual environment vulnerable
run: |
python -m venv env
./env/bin/python -m pip install --upgrade pip wheel
./env/bin/python -m pip install --no-deps --requirement ./test/vulnerable.txt
- uses: ./
id: pip-audit
with:
virtual-environment: env/
local: ${{ matrix.local }}
# NOTE: We intentionally allow failure here, since the self-test
# explicitly uses a vulnerable requirements file.
internal-be-careful-allow-failure: true
- name: assert expected output
env:
PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
run: |
grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")
selftest-pyproject:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: ./
id: pip-audit
with:
# should attempt to discover test/pyproject/pyproject.toml
inputs: test/pyproject/
# NOTE: We intentionally allow failure here, since the self-test
# explicitly uses a vulnerable requirements file.
internal-be-careful-allow-failure: true
- name: assert expected output
env:
PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
run: |
grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")
selftest-pipaudit-fail:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: ./
id: pip-audit
with:
# we do not care about pip-audit's actual output in this test, we just need a file to pass
# in so as to not exercise `pip list` mode.
inputs: ./test/empty.txt
# pass in a fake flag here to reliably trigger the failure we're looking for.
internal-be-careful-extra-flags: --not-a-real-pip-audit-flag
internal-be-careful-allow-failure: true
- name: assert expected output
env:
PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
run: |
grep 'pip-audit did not return any output' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")
all-selftests-pass:
if: always()
needs:
- selftest-requirements
- selftest-environment
- selftest-virtualenv
- selftest-pyproject
- selftest-pipaudit-fail
runs-on: ubuntu-latest
steps:
- name: check test jobs
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
with:
jobs: ${{ toJSON(needs) }}