feat(egress-proxy): add operator-trusted egress allowlist #539
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| branches: | |
| - master | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| check: | |
| name: Code Quality | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: v2.x | |
| - name: Cache Deno dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cache/deno | |
| ~/.deno | |
| key: ${{ runner.os }}-deno-${{ hashFiles('deno.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-deno- | |
| - name: Verify formatting | |
| run: deno task fmt:check | |
| - name: Run linter | |
| run: deno task lint | |
| - name: Type check | |
| run: deno task check | |
| test: | |
| name: Run Tests | |
| runs-on: ubuntu-latest | |
| needs: check | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: v2.x | |
| - name: Cache Deno dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cache/deno | |
| ~/.deno | |
| key: ${{ runner.os }}-deno-${{ hashFiles('deno.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-deno- | |
| - name: Run unit tests | |
| run: deno task test:unit | |
| - name: Run integration tests | |
| run: deno task test:integration | |
| coverage: | |
| name: Test Coverage | |
| runs-on: ubuntu-latest | |
| needs: check | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: v2.x | |
| - name: Cache Deno dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cache/deno | |
| ~/.deno | |
| key: ${{ runner.os }}-deno-${{ hashFiles('deno.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-deno- | |
| - name: Run tests with coverage | |
| run: deno task test:coverage | |
| - name: Generate coverage report | |
| run: deno task coverage:report | |
| - name: Check coverage threshold | |
| run: | | |
| COVERAGE=$(deno coverage coverage --exclude='tests/' 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | grep 'All files' | awk -F'|' '{gsub(/[[:space:]]/, "", $3); print $3}') | |
| echo "Coverage: ${COVERAGE}%" | |
| if [ -z "$COVERAGE" ]; then | |
| echo "::error::Failed to extract coverage percentage" | |
| exit 1 | |
| fi | |
| if [ "$(echo "$COVERAGE < 75" | bc -l)" -eq 1 ]; then | |
| echo "::error::Test coverage ${COVERAGE}% is below the required 75% threshold" | |
| exit 1 | |
| fi | |
| - name: Generate LCOV report | |
| run: deno coverage coverage --lcov --output=coverage.lcov --exclude='tests/' | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| files: ./coverage.lcov | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| build: | |
| name: Build Check | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| # Pinned: Deno 2.9.x has a denort stack-overflow regression during | |
| # `deno compile` for this module graph. 2.8.3 is the last known-good. | |
| deno-version: v2.8.3 | |
| - name: Cache Deno dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cache/deno | |
| ~/.deno | |
| key: ${{ runner.os }}-deno-${{ hashFiles('deno.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-deno- | |
| - name: Compile check | |
| env: | |
| RUST_MIN_STACK: 16777216 | |
| run: deno compile --check --output /tmp/air-friends src/main.ts | |
| - name: Verify executable | |
| run: | | |
| chmod +x /tmp/air-friends | |
| /tmp/air-friends --help || true |