65 lines
2.5 KiB
Bash
65 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
container_name="magent-ci-${GITHUB_RUN_ID:-local}-$$"
|
|
volume_name="${container_name}-data"
|
|
cleanup() {
|
|
docker rm -f "$container_name" >/dev/null 2>&1 || true
|
|
docker volume rm -f "$volume_name" >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
docker build --tag magent:ci .
|
|
docker volume create "$volume_name" >/dev/null
|
|
docker run --rm --user 0 \
|
|
--volume "$volume_name:/app/data" \
|
|
--entrypoint chown \
|
|
magent:ci -R 1000:1000 /app/data
|
|
docker run --detach --name "$container_name" \
|
|
--read-only --cap-drop ALL --security-opt no-new-privileges:true \
|
|
--tmpfs /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000 \
|
|
--tmpfs /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000 \
|
|
--volume "$volume_name:/app/data" \
|
|
--env JWT_SECRET=ci-only-secret-with-at-least-32-characters \
|
|
--env SETTINGS_ENCRYPTION_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= \
|
|
--env ADMIN_PASSWORD=ci-only-bootstrap-password-123 \
|
|
--env MAGENT_APPLICATION_URL=https://magent-ci.example.test \
|
|
magent:ci >/dev/null
|
|
|
|
deadline=$((SECONDS + 120))
|
|
until [ "$(docker inspect --format '{{.State.Health.Status}}' "$container_name")" = "healthy" ]; do
|
|
if [ "$SECONDS" -ge "$deadline" ]; then
|
|
docker logs "$container_name"
|
|
echo "Container did not become healthy within 120 seconds" >&2
|
|
exit 1
|
|
fi
|
|
sleep 2
|
|
done
|
|
|
|
docker exec "$container_name" curl --fail --silent --show-error http://127.0.0.1:8000/health >/dev/null
|
|
docker exec "$container_name" curl --fail --silent --show-error http://127.0.0.1:3000/login >/dev/null
|
|
|
|
# Exercise browser-origin requests, not only GET health checks. A configured
|
|
# public address must work even when CORS_ALLOW_ORIGIN has its localhost default.
|
|
docker exec -i "$container_name" python - <<'PY'
|
|
from urllib import error, request
|
|
|
|
for path in ("/auth/login", "/auth/jellyfin/login"):
|
|
for origin, expected in (
|
|
("https://magent-ci.example.test", 422),
|
|
("https://untrusted.example.test", 403),
|
|
):
|
|
probe = request.Request(
|
|
"http://127.0.0.1:8000" + path,
|
|
data=b"",
|
|
headers={"Origin": origin, "Content-Type": "application/x-www-form-urlencoded"},
|
|
)
|
|
try:
|
|
response = request.urlopen(probe, timeout=10)
|
|
except error.HTTPError as exc:
|
|
response = exc
|
|
with response:
|
|
assert response.status == expected, (path, origin, response.status, expected)
|
|
print(f"Browser-origin login smoke: {path} {origin} -> {expected}")
|
|
PY
|