selftest.yml

name: Self-test

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  selftest-requirements:
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - uses: ./
        id: pip-audit
        with:
          inputs: ./test/vulnerable.txt
          no-deps: true
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        shell: bash
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-environment:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: make the environment vulnerable
        run: |
          python -m pip install --no-deps --requirement ./test/vulnerable.txt
      - uses: ./
        id: pip-audit
        with:
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-virtualenv:
    strategy:
      matrix:
        local: [true, false]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: make a virtual environment vulnerable
        run: |
          python -m venv env
          ./env/bin/python -m pip install --upgrade pip wheel
          ./env/bin/python -m pip install --no-deps --requirement ./test/vulnerable.txt
      - uses: ./
        id: pip-audit
        with:
          virtual-environment: env/
          local: ${{ matrix.local }}
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-pyproject:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./
        id: pip-audit
        with:
          # should attempt to discover test/pyproject/pyproject.toml
          inputs: test/pyproject/
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-pipaudit-fail:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./
        id: pip-audit
        with:
          # we do not care about pip-audit's actual output in this test, we just need a file to pass
          # in so as to not exercise `pip list` mode.
          inputs: ./test/empty.txt
          # pass in a fake flag here to reliably trigger the failure we're looking for.
          internal-be-careful-extra-flags: --not-a-real-pip-audit-flag
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.internal-be-careful-output }}"
        run: |
          grep 'pip-audit did not return any output' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  all-selftests-pass:
    if: always()

    needs:
      - selftest-requirements
      - selftest-environment
      - selftest-virtualenv
      - selftest-pyproject
      - selftest-pipaudit-fail

    runs-on: ubuntu-latest

    steps:
      - name: check test jobs
        if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}