Skip to content

Commit 0da496f

Browse files
antonioaversaantonioaversa
committed
Add QA tests
1 parent f5bbdad commit 0da496f

File tree

4 files changed

+249
-1
lines changed

4 files changed

+249
-1
lines changed

‎.github/qa-sq-behind-ngix/compose.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
services:
2+
sonarqube:
3+
image: sonarqube:lts-community
4+
ports:
5+
- 9000:9000
6+
healthcheck:
7+
test: 'grep -Fq "SonarQube is operational" /opt/sonarqube/logs/sonar.log'
8+
interval: 10s
9+
timeout: 5s
10+
retries: 20
11+
start_period: 2m
12+
13+
https-proxy:
14+
image: nginx
15+
ports:
16+
- 4443:4443
17+
volumes:
18+
- $GITHUB_WORKSPACE/.github/qa-sq-behind-ngix/nginx.conf:/etc/nginx/nginx.conf:ro
19+
- $GITHUB_WORKSPACE/.github/qa-sq-behind-ngix/ca.crt:/etc/nginx/client_certs/ca.crt:ro
20+
- $GITHUB_WORKSPACE/.github/qa-sq-behind-ngix/server.crt:/etc/nginx/server.crt:ro
21+
- $GITHUB_WORKSPACE/.github/qa-sq-behind-ngix/server.key:/etc/nginx/server.key:ro
22+
healthcheck:
23+
test: ["CMD", "curl", "--fail", "localhost:8080/health"]
24+
interval: 10s
25+
timeout: 5s
26+
retries: 20
27+
start_period: 2m

‎.github/qa-sq-behind-ngix/generate-certificates.sh

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/sh
2+
3+
set -eux
4+
5+
echo Generating server certificate...
6+
7+
openssl req \
8+
-newkey rsa:4096 \
9+
-x509 \
10+
-sha256 \
11+
-addext "subjectAltName = DNS:localhost" \
12+
-days 3650 \
13+
-nodes \
14+
-out server.crt \
15+
-subj "/C=CH/ST=Geneva/L=Geneva/O=Server/OU=Dept" \
16+
-keyout server.key
17+
18+
echo Generating client certificate...
19+
20+
# Generate Certificate Authority key
21+
openssl genrsa \
22+
-passout pass:test42 \
23+
-des3 \
24+
-out ca.key 4096 \
25+
26+
# Generate Certificate Authority certificate
27+
openssl req \
28+
-passin pass:test42 \
29+
-new \
30+
-x509 \
31+
-days 365 \
32+
-key ca.key \
33+
-out ca.crt \
34+
-subj "/C=CH/ST=Geneva/L=Geneva/O=CertificateAuthority/OU=ExpertDepartment"
35+
36+
# Generating Client certificate key
37+
openssl genrsa \
38+
-passout pass:test42 \
39+
-des3 \
40+
-out user.key 4096
41+
42+
# Generating Client certificate certificate
43+
openssl req \
44+
-passin pass:test42 \
45+
-new \
46+
-key user.key \
47+
-out user.csr \
48+
-subj "/C=CH/ST=Geneva/L=Geneva/O=UserOrg/OU=UserDepartment"
49+
50+
# Sign the certificate
51+
openssl x509 \
52+
-passin pass:test42 \
53+
-req \
54+
-days 365 \
55+
-in user.csr \
56+
-CA ca.crt \
57+
-CAkey ca.key \
58+
-set_serial 01 \
59+
-out user.crt
60+
61+
# Generate a PKCS12 format certificate
62+
openssl pkcs12 \
63+
-passin pass:test42 \
64+
-passout pass:test42 \
65+
-export \
66+
-out user.p12 \
67+
-inkey user.key \
68+
-in user.crt \
69+
-certfile ca.crt

‎.github/qa-sq-behind-ngix/nginx.conf

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
user nginx;
2+
worker_processes auto;
3+
4+
error_log /var/log/nginx/error.log notice;
5+
pid /var/run/nginx.pid;
6+
7+
events {
8+
worker_connections 1024;
9+
}
10+
11+
http {
12+
include /etc/nginx/mime.types;
13+
default_type application/octet-stream;
14+
15+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
16+
'$status $body_bytes_sent "$http_referer" '
17+
'"$http_user_agent" "$http_x_forwarded_for"';
18+
19+
access_log /var/log/nginx/access.log main;
20+
21+
sendfile on;
22+
23+
keepalive_timeout 65;
24+
25+
include /etc/nginx/conf.d/*.conf;
26+
27+
server {
28+
listen 8080;
29+
30+
location /health {
31+
access_log off;
32+
add_header 'Content-Type' 'text/plain';
33+
return 200 "healthy\n";
34+
}
35+
}
36+
37+
server {
38+
listen 4443 ssl;
39+
40+
ssl_protocols TLSv1.1 TLSv1.2;
41+
ssl_certificate /etc/nginx/server.crt;
42+
ssl_certificate_key /etc/nginx/server.key;
43+
44+
access_log /var/log/nginx/localhost;
45+
error_log /var/log/nginx/localhost.error debug;
46+
47+
location / {
48+
proxy_pass http://sonarqube:9000;
49+
proxy_set_header Host $host;
50+
proxy_set_header X-Forwarded-For $remote_addr;
51+
proxy_set_header X-Forwarded-Proto https;
52+
}
53+
}
54+
}

‎.github/workflows/qa.yml

Lines changed: 99 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -274,4 +274,102 @@ jobs:
274274
SONAR_HOST_URL: http://not_actually_used
275275
- name: Assert
276276
run: |
277-
./test/assertFileExists ~/.sonar/ssl/truststore.p12
277+
./test/assertFileExists ~/.sonar/ssl/truststore.p12
278+
analysisWithSslCertificate:
279+
name: >
280+
Analysis takes into account 'SONAR_ROOT_CERT'
281+
runs-on: ubuntu-latest
282+
steps:
283+
- uses: actions/checkout@v4
284+
with:
285+
token: ${{ secrets.GITHUB_TOKEN }}
286+
- name: Generate certificates
287+
run: ./generate-certificates.sh
288+
working-directory: .github/qa-sq-behind-ngix
289+
- name: Start nginx and SonarQube via Docker Compose
290+
run: docker compose up -d --wait
291+
working-directory: .github/qa-sq-behind-ngix
292+
- name: Read correct client certificate from
293+
run: |
294+
# read server.crt from .github/qa-sq-behind-ngix/ and store into the SONAR_ROOT_CERT_VALID
295+
# environment variable, to be able to read it in the next step
296+
{
297+
echo 'SONAR_ROOT_CERT_VALID<<=========='
298+
cat .github/qa-sq-behind-ngix/server.crt
299+
echo ==========
300+
} >> $GITHUB_ENV
301+
- name: Run action with the correct SSL certificate
302+
uses: ./
303+
env:
304+
SONAR_ROOT_CERT: ${{ env.SONAR_ROOT_CERT_VALID }}
305+
SONAR_HOST_URL: https://localhost:4443
306+
with:
307+
args: -Dsonar.login=admin -Dsonar.password=admin
308+
projectBaseDir: ./test/example-project
309+
- name: Clear imported certificates
310+
run: |
311+
rm -f ~/.sonar/ssl/truststore.p12
312+
- name: Run action with an invalid SSL certificate
313+
id: invalid_ssl_certificate
314+
continue-on-error: true
315+
uses: ./
316+
env:
317+
SONAR_ROOT_CERT: |
318+
-----BEGIN CERTIFICATE-----
319+
INVALID
320+
-----END CERTIFICATE-----
321+
SONAR_HOST_URL: https://localhost:4443
322+
with:
323+
args: -Dsonar.login=admin -Dsonar.password=admin
324+
projectBaseDir: ./test/example-project
325+
- name: Assert failure of previous step
326+
if: steps.invalid_ssl_certificate.outcome == 'success'
327+
run: exit 1
328+
- name: Clear imported certificates
329+
run: |
330+
rm -f ~/.sonar/ssl/truststore.p12
331+
- name: Run action with the wrong SSL certificate
332+
id: wrong_ssl_certificate
333+
continue-on-error: true
334+
uses: ./
335+
env:
336+
SONAR_ROOT_CERT: |
337+
-----BEGIN CERTIFICATE-----
338+
MIIFlTCCA32gAwIBAgIUXK4LyGUFe4ZVL93StPXCoJzmnLMwDQYJKoZIhvcNAQEL
339+
BQAwTzELMAkGA1UEBhMCQ0gxDzANBgNVBAgMBkdlbmV2YTEPMA0GA1UEBwwGR2Vu
340+
ZXZhMQ8wDQYDVQQKDAZTZXJ2ZXIxDTALBgNVBAsMBERlcHQwHhcNMjQxMTAxMDgx
341+
MzM3WhcNMzQxMDMwMDgxMzM3WjBPMQswCQYDVQQGEwJDSDEPMA0GA1UECAwGR2Vu
342+
ZXZhMQ8wDQYDVQQHDAZHZW5ldmExDzANBgNVBAoMBlNlcnZlcjENMAsGA1UECwwE
343+
RGVwdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK5m0V6IFFykib77
344+
nmlN7weS9q3D6YGEj+8hRNQViL9KduUoLjoKpONIihU5kfIg+5SkGygjHRkBvIp3
345+
b0HQqhkwtGln3/FxxaSfGEguLHgzXR8JDQSyJ8UKIGOPCH93n1rUip5Ok1iExVup
346+
HtkiVDRoCC9cRjZXbGOKrO6VBT4RvakpkaqCdXYikV244B5ElM7kdFdz8fso78Aq
347+
xekb9dM0f21uUaDBKCIhRcxWeafp0CJIoejTq0+PF7qA2qIY5UHqWElWO5NsvQ8+
348+
MqKkIdsOa1pYNuH/5eQ59k9KSE92ps1xTKweW000GfPqxx8IQ/e4aAd2SaMTKvN6
349+
aac6piWBeJ7AssgWwkg/3rnZB5seQIrWjIUePmxJ4c0g0eL9cnVpYF0K/Dldle/G
350+
wg0zi1g709rBI1TYj9xwrivxSwEQupz8OdKqOmgqrKHJJ/CCLl+JdFYjgwl3NWLH
351+
wsU639H1bMXIJoQujg9U47e9fXbwiqdkMQzt7rPGkOBBaAkSctAReiXnWy+CbVEM
352+
QFHDrnD5YUJRd5t/DUuWuqhR2QhfUvRClPUKoVqB/iOu2IumlgDEDA8jb1dxEW+W
353+
iaYokQCS94OpxOJ8aeReSt9bghT0vc9ifCLWvuE1iBjujdK32ekKSY9DCZyBHXsG
354+
J9N1nt1qd/k7QqWOkuPjr1JrTIMbAgMBAAGjaTBnMB0GA1UdDgQWBBQw4ESReEk+
355+
AIxwjHRqPkESzMv1bTAfBgNVHSMEGDAWgBQw4ESReEk+AIxwjHRqPkESzMv1bTAP
356+
BgNVHRMBAf8EBTADAQH/MBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0B
357+
AQsFAAOCAgEAE8WefoZN23aOSe79ZN7zRBWP8DdPgFAqg5XUhfc9bCIVfJ4XMpEe
358+
3lzRhgjwDm4naEs35QWOhPZH2vx8XrEKnZNI6vKO8JzaCsivgngk8bsWnvhwSXy5
359+
eFdc99K+FOmOHevDmeiimoQnikffnSULRhQYzE2Qwyo9iky8703/+D3IKEC/8exC
360+
rlyGMUV/Nqj+4M+57DiZ6OXeFuunfoFB7vmcDZygqDhKoHhVRyu8qN6PeK2fvUFK
361+
EjeRtvA0GkdlOtLIF2g5yBTK2ykkt/oLUoAolfYUTKcoV2/FS0gVR5ovmEpKyBcP
362+
H9hzr16a8dtrEqOf/oKHQSLwxn8afmS354HJ75sq9SujOtIWpHfyH5IgqtUpiBN/
363+
bzvKs/QZjtGlqvquOTkdh9L4oxTXqG7zEStZyo/v9g5jf1Tq195b2DNFwVUZIcbb
364+
u2d4CvAZ1yNr+8ax/kTwBSY8WU+mCtmvowFstdvsJXVXJKnUO6EZOdbg0GxTBVyE
365+
zMsnPcnkOwV5TJIKKhonrgrwmPmQ9IOV9BrThVxujjjEbAdA6jM9PMiXzuDukldm
366+
QBRwNbczGbdsHkMKHmQnrTqOyQyI4KCXF08kcOm4C1P+Whrvi0DXkqHnyKvBE0td
367+
dciInBoeHwUs2eclz7gP7pMBJUlFUkKfQxwxGLIqZSXnlAFBfW6hHLI=
368+
-----END CERTIFICATE-----
369+
SONAR_HOST_URL: https://localhost:4443
370+
with:
371+
args: -Dsonar.login=admin -Dsonar.password=admin
372+
projectBaseDir: ./test/example-project
373+
- name: Assert failure of previous step
374+
if: steps.wrong_ssl_certificate.outcome == 'success'
375+
run: exit 1

0 commit comments

Comments
 (0)