chore: bump bullfrog action to v0.11.1 (#18) #95
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*" | |
| pull_request: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-and-test: | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 10 | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Enable egress filtering | |
| uses: bullfrogsec/bullfrog@7dee337d4575320b6d8cbe9a56d48d2fb765963a # v0.11.1 | |
| with: | |
| api-token: ${{ secrets.BULLFROG_API_TOKEN }} | |
| egress-policy: block | |
| allowed-domains: | | |
| *.archive.ubuntu.com | |
| ports.ubuntu.com | |
| *.docker.io | |
| *.golang.org | |
| deb.debian.org | |
| github.com | |
| packages.microsoft.com | |
| production.cloudfront.docker.com | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| - name: Install dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libnetfilter-queue-dev | |
| - name: Build | |
| run: | | |
| docker build --tag agent-builder . | |
| docker rm --force agent || true | |
| docker run --name agent agent-builder | |
| docker cp agent:/agent/agent . | |
| - name: Test (CI) | |
| run: make test.ci | |
| - name: Upload agent binary | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: agent-${{ matrix.arch }} | |
| path: agent | |
| retention-days: 1 | |
| release: | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: | |
| [ | |
| test-integration-audit, | |
| test-integration-block, | |
| test-integration-block-dns-any, | |
| test-integration-docker-block, | |
| test-integration-docker-escalation, | |
| test-integration-dns-pipelining, | |
| ] | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Enable egress filtering | |
| uses: bullfrogsec/bullfrog@7dee337d4575320b6d8cbe9a56d48d2fb765963a # v0.11.1 | |
| with: | |
| api-token: ${{ secrets.BULLFROG_API_TOKEN }} | |
| egress-policy: block | |
| allowed-domains: | | |
| github.com | |
| api.github.com | |
| uploads.github.com | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Download amd64 binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-amd64 | |
| path: agent-amd64 | |
| - name: Download arm64 binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-arm64 | |
| path: agent-arm64 | |
| - name: Create Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| tar -czf agent-amd64.tar.gz -C agent-amd64 agent | |
| tar -czf agent-arm64.tar.gz -C agent-arm64 agent | |
| gh release create ${{ github.ref_name }} \ | |
| --title "${{ github.ref_name }}" \ | |
| --notes "See [CHANGELOG.md](https://github.com/bullfrogsec/agent/blob/main/CHANGELOG.md)" \ | |
| agent-amd64.tar.gz \ | |
| agent-arm64.tar.gz | |
| test-integration-audit: | |
| runs-on: ${{ matrix.runner }} | |
| needs: build-and-test | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| - name: Download agent binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-${{ matrix.arch }} | |
| - name: Install dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libnetfilter-queue-dev nftables | |
| - name: Make agent executable | |
| run: chmod +x agent | |
| - name: Run integration test | |
| run: make test.integration.audit | |
| test-integration-block: | |
| runs-on: ${{ matrix.runner }} | |
| needs: build-and-test | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| - name: Download agent binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-${{ matrix.arch }} | |
| - name: Install dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libnetfilter-queue-dev nftables | |
| - name: Make agent executable | |
| run: chmod +x agent | |
| - name: Run integration test | |
| run: make test.integration.block | |
| test-integration-block-dns-any: | |
| runs-on: ${{ matrix.runner }} | |
| needs: build-and-test | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| - name: Download agent binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-${{ matrix.arch }} | |
| - name: Install dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libnetfilter-queue-dev nftables | |
| - name: Make agent executable | |
| run: chmod +x agent | |
| - name: Run integration test | |
| run: make test.integration.block-dns-any | |
| test-integration-docker-block: | |
| runs-on: ${{ matrix.runner }} | |
| needs: build-and-test | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| - name: Download agent binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-${{ matrix.arch }} | |
| - name: Install dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libnetfilter-queue-dev nftables | |
| - name: Make agent executable | |
| run: chmod +x agent | |
| - name: Run integration test | |
| run: make test.integration.docker-block | |
| test-integration-dns-pipelining: | |
| runs-on: ${{ matrix.runner }} | |
| needs: build-and-test | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| - name: Download agent binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-${{ matrix.arch }} | |
| - name: Install dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libnetfilter-queue-dev nftables | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Make agent executable | |
| run: chmod +x agent | |
| - name: Run integration test | |
| run: make test.integration.dns-pipelining | |
| test-integration-docker-escalation: | |
| runs-on: ${{ matrix.runner }} | |
| needs: build-and-test | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| - name: Download agent binary | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: agent-${{ matrix.arch }} | |
| - name: Install dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libnetfilter-queue-dev nftables | |
| - name: Make agent executable | |
| run: chmod +x agent | |
| # Last step in the job: it disables sudo for everything that follows. | |
| - name: Run integration test | |
| run: make test.integration.docker-escalation |