Generate mock certs as a dedicated step

Author: markdlv-sf

.github/workflows/sf_cli_integration.yml

@@ -10,18 +10,23 @@ jobs:
     env:
       SF_AUTOUPDATE_DISABLE: true
       NO_COLOR: '1'
-      # Path the mock server writes its self-signed TLS cert to. The CA-trust
-      # env vars (NODE_EXTRA_CA_CERTS / REQUESTS_CA_BUNDLE) are set per-step on
-      # only the run/deploy steps — setting them job-wide would point pip/poetry
-      # at a cert file that does not exist yet during setup, breaking installs.
+      # Mock server's TLS cert/key pair.
       MOCK_SF_CERT_FILE: ${{ github.workspace }}/mock_sf_cert.pem
+      MOCK_SF_KEY_FILE: ${{ github.workspace }}/mock_sf_key.pem
 
     steps:
       # ── Setup ─────────────────────────────────────────────────────────────────
 
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Generate mock server TLS cert
+      run: |
+        openssl req -x509 -newkey rsa:2048 -nodes \
+          -keyout "$MOCK_SF_KEY_FILE" -out "$MOCK_SF_CERT_FILE" \
+          -days 1 -subj "/CN=localhost" \
+          -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
+
     - name: Set up Python 3.11
       uses: actions/setup-python@v5
       with:
@@ -61,14 +66,7 @@ jobs:
       # ── Mock Salesforce server + fake org auth ────────────────────────────────
 
     - name: Start mock Salesforce server
-      run: |
-        python scripts/mock_sf_server.py &
-        # Wait for the TLS cert the server writes at startup so clients can trust it.
-        for _ in $(seq 1 30); do
-          [ -f "$MOCK_SF_CERT_FILE" ] && break
-          sleep 0.2
-        done
-        test -f "$MOCK_SF_CERT_FILE" || { echo "::error::mock server never wrote $MOCK_SF_CERT_FILE"; exit 1; }
+      run: python scripts/mock_sf_server.py &
       env:
         MOCK_SF_PORT: '8888'
 
@@ -177,8 +175,8 @@ jobs:
 
     - name: '[script] run — sf data-code-extension script run --entrypoint testScript/payload/entrypoint.py -o dev1'
       env:
-        NODE_EXTRA_CA_CERTS: ${{ github.workspace }}/mock_sf_cert.pem
-        REQUESTS_CA_BUNDLE: ${{ github.workspace }}/mock_sf_cert.pem
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension script run \
           --entrypoint testScript/payload/entrypoint.py \
@@ -191,8 +189,8 @@ jobs:
 
     - name: '[script] deploy — sf data-code-extension script deploy'
       env:
-        NODE_EXTRA_CA_CERTS: ${{ github.workspace }}/mock_sf_cert.pem
-        REQUESTS_CA_BUNDLE: ${{ github.workspace }}/mock_sf_cert.pem
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension script deploy \
           --name test-script-deploy \
@@ -281,8 +279,8 @@ jobs:
 
     - name: '[function] run — sf data-code-extension function run --entrypoint testFunction/payload/entrypoint.py  --test-with testFunction/payload/tests/test.json -o dev1'
       env:
-        NODE_EXTRA_CA_CERTS: ${{ github.workspace }}/mock_sf_cert.pem
-        REQUESTS_CA_BUNDLE: ${{ github.workspace }}/mock_sf_cert.pem
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension function run \
           --entrypoint testFunction/payload/entrypoint.py \
@@ -295,8 +293,8 @@ jobs:
 
     - name: '[function] deploy — sf data-code-extension function deploy'
       env:
-        NODE_EXTRA_CA_CERTS: ${{ github.workspace }}/mock_sf_cert.pem
-        REQUESTS_CA_BUNDLE: ${{ github.workspace }}/mock_sf_cert.pem
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension function deploy \
           --name test-function-deploy \

scripts/mock_sf_server.py

@@ -41,9 +41,16 @@
     MOCK_SF_PORT=9000 python scripts/mock_sf_server.py
     python scripts/mock_sf_server.py 9000
 
-Serves TLS with a throwaway self-signed cert (the deploy path requires an HTTPS
-upload URL). Set ``MOCK_SF_CERT_FILE`` to a path the clients can trust via
-``NODE_EXTRA_CA_CERTS`` (CLI) and ``REQUESTS_CA_BUNDLE`` (SDK).
+Serves TLS (the deploy path requires an HTTPS upload URL) using a pre-generated
+cert/key pair — this script does not generate one. Set ``MOCK_SF_CERT_FILE`` /
+``MOCK_SF_KEY_FILE`` to the pair's paths; generate a throwaway one with:
+
+    openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem \\
+      -days 1 -subj "/CN=localhost" \\
+      -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
+
+Point clients at the cert so they trust it: ``NODE_EXTRA_CA_CERTS`` (CLI) and
+``REQUESTS_CA_BUNDLE`` (SDK).
 """
 
 from __future__ import annotations
@@ -52,51 +59,14 @@
 import json
 import os
 import ssl
-import subprocess
 import sys
-import tempfile
 
 PORT = (
     int(sys.argv[1])
     if len(sys.argv) > 1
     else int(os.environ.get("MOCK_SF_PORT", "8888"))
 )
 
-
-def _self_signed_cert(dirpath: str) -> tuple[str, str]:
-    """Generate a throwaway self-signed cert for localhost via openssl.
-
-    The plugin's deploy path requires an HTTPS upload URL, so the server must
-    speak TLS. Set ``MOCK_SF_CERT_FILE`` to write the cert to a known path so
-    clients can trust it (``REQUESTS_CA_BUNDLE`` / ``NODE_EXTRA_CA_CERTS``).
-    """
-    cert_path = os.environ.get("MOCK_SF_CERT_FILE") or os.path.join(dirpath, "cert.pem")
-    key_path = os.path.join(dirpath, "key.pem")
-    subprocess.run(
-        [
-            "openssl",
-            "req",
-            "-x509",
-            "-newkey",
-            "rsa:2048",
-            "-nodes",
-            "-keyout",
-            key_path,
-            "-out",
-            cert_path,
-            "-days",
-            "1",
-            "-subj",
-            "/CN=localhost",
-            "-addext",
-            "subjectAltName=DNS:localhost,IP:127.0.0.1",
-        ],
-        check=True,
-        capture_output=True,
-    )
-    return cert_path, key_path
-
-
 _USERINFO = {
     "sub": "https://test.salesforce.com/id/00D000000000001AAA/005000000000001AAA",
     "user_id": "005000000000001AAA",
@@ -194,12 +164,18 @@ def do_PUT(self) -> None:
 
 
 if __name__ == "__main__":
+    cert_path = os.environ.get("MOCK_SF_CERT_FILE")
+    key_path = os.environ.get("MOCK_SF_KEY_FILE")
+    if not cert_path or not key_path:
+        sys.exit(
+            "MOCK_SF_CERT_FILE and MOCK_SF_KEY_FILE must both be set to an "
+            "existing TLS cert/key pair — see the module docstring."
+        )
+
     server = HTTPServer(("localhost", PORT), MockSFHandler)
     server.allow_reuse_address = True
-    with tempfile.TemporaryDirectory() as certdir:
-        cert_path, key_path = _self_signed_cert(certdir)
-        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        ctx.load_cert_chain(cert_path, key_path)
-        server.socket = ctx.wrap_socket(server.socket, server_side=True)
-        print(f"[MOCK SF] Listening on https://localhost:{PORT}", flush=True)
-        server.serve_forever()
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx.load_cert_chain(cert_path, key_path)
+    server.socket = ctx.wrap_socket(server.socket, server_side=True)
+    print(f"[MOCK SF] Listening on https://localhost:{PORT}", flush=True)
+    server.serve_forever()