ci: git-crypt unlock on trusted runs (#122)

PR #83 changed many test cases, but CI can skip running them because
`tests_private/` is encrypted and we remove encrypted files on untrusted
runs.

This PR adds a trust gate so CI can unlock git-crypt (and run private
tests) only on trusted events, while still ensuring encrypted files are
removed on untrusted PRs. It also runs `pwnshop test --silent-failures`
in CI to avoid printing failing test output into the job log.

Author: ConnorNelson

.github/actions/test-challenges/action.yml

@@ -8,6 +8,10 @@ inputs:
     description: Base ref challenges have been modified since.
     required: false
     default: ""
+  gpg_private_key:
+    description: GPG private key used to unlock git-crypt.
+    required: false
+    default: ""
 runs:
   using: composite
   steps:
@@ -16,10 +20,31 @@ runs:
       with:
         fetch-depth: 0
 
-    - name: Remove encrypted directories
+    - name: Manage encrypted files
       shell: 'nix develop -c bash -euo pipefail {0}'
+      env:
+        GPG_PRIVATE_KEY: ${{ inputs.gpg_private_key }}
+        CHALLENGES_DIR: challenges/${{ inputs.challenges }}
       run: |
-        git crypt status -e | sed -e "s/ *encrypted: //" | xargs -r dirname | xargs -r rm -rf
+        encrypted_paths() {
+          git crypt status -e \
+            | sed -n 's/^[[:space:]]*encrypted:[[:space:]]*//p' \
+            | sort -u
+        }
+
+        if [ -n "$GPG_PRIVATE_KEY" ]; then
+          encrypted_paths | while IFS= read -r encrypted_path; do
+            case "$encrypted_path" in
+              "$CHALLENGES_DIR"/*) ;;
+              *) rm -f "$encrypted_path" ;;
+            esac
+          done
+
+          printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+          git crypt unlock
+        else
+          encrypted_paths | xargs -r rm -f
+        fi
 
     - name: Test challenges
       shell: 'nix develop -c bash -euo pipefail {0}'
@@ -36,6 +61,7 @@ runs:
         echo "::group::Challenges to be tested"
         ./pwnshop list "$CHALLENGES_DIR" --modified-since="$MODIFIED_SINCE"
         echo "::endgroup::"
+
         echo "::group::Testing challenges"
-        ./pwnshop test --jobs "$JOBS" --modified-since="$MODIFIED_SINCE" "$CHALLENGES_DIR"
+        ./pwnshop test --silent-failures --jobs "$JOBS" --modified-since="$MODIFIED_SINCE" "$CHALLENGES_DIR"
         echo "::endgroup::"

.github/workflows/publish-challenges.yml

@@ -46,6 +46,7 @@ jobs:
       with:
         challenges: ${{ matrix.challenges }}
         modified_since_ref: ""
+        gpg_private_key: ${{ secrets.GPG_ROOT_PRIVATE_KEY }}
 
     - name: Install rclone
       run: sudo apt-get update && sudo apt-get install -y rclone

.github/workflows/test-challenges.yml

@@ -37,10 +37,39 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+
+    - name: Determine trust
+      id: trust
+      uses: actions/github-script@v7
+      with:
+        script: |
+          // Trusted contexts:
+          // - Non-PR events (workflow_dispatch/schedule) are trusted.
+          // - PRs from the main repo (not a fork) are trusted; fork PRs are not.
+          let trusted = false;
+          if (context.eventName === "workflow_dispatch" || context.eventName === "schedule") {
+            trusted = true;
+          } else if (context.eventName === "pull_request") {
+            const pr = context.payload.pull_request;
+            const headRepo = pr?.head?.repo?.full_name;
+            const baseRepo = pr?.base?.repo?.full_name;
+            if (headRepo && baseRepo && headRepo === baseRepo) trusted = true;
+          }
+          core.setOutput("trusted", trusted ? "true" : "false");
+
     - uses: ./.github/actions/setup-nix
     - uses: ./.github/actions/setup-challenge-runtime
 
-    - name: Test challenges
+    - name: Test challenges (trusted)
+      if: ${{ steps.trust.outputs.trusted == 'true' }}
+      uses: ./.github/actions/test-challenges
+      with:
+        challenges: ${{ matrix.challenges }}
+        modified_since_ref: ${{ needs.determine-modified-challenges.outputs.modified_since_ref }}
+        gpg_private_key: ${{ secrets.GPG_ROOT_PRIVATE_KEY }}
+
+    - name: Test challenges (untrusted)
+      if: ${{ steps.trust.outputs.trusted != 'true' }}
       uses: ./.github/actions/test-challenges
       with:
         challenges: ${{ matrix.challenges }}

tools/pwnshop/src/pwnshop/commands/test.py

@@ -39,6 +39,7 @@
     type=click.Path(path_type=pathlib.Path, file_okay=False, resolve_path=True),
     help="Write failure output to DIR/challenge/test.log files.",
 )
+@click.option("--silent-failures", is_flag=True, help="Do not print failing test output to stdout/stderr.")
 @click.argument(
     "targets",
     nargs=-1,
@@ -51,13 +52,14 @@
         resolve_path=False,
     ),
 )
-def test_command(targets, modified_since, jobs, require_tests, test_timeout, log_failures):
+def test_command(targets, modified_since, jobs, require_tests, test_timeout, log_failures, silent_failures):
     """Test one or more challenges."""
     if not (challenge_paths := lib.resolve_targets(targets, modified_since=modified_since)):
         if modified_since:
             console.print(f"[yellow]No challenges found since {modified_since}[/]")
             return
         raise click.ClickException("No challenges found in provided targets.")
+
     jobs = jobs or os.cpu_count() or 1
     failed: dict[pathlib.Path, list] = {}
     passed_count = failed_count = total_tests = failed_tests = 0
@@ -145,7 +147,7 @@ def test_challenge(challenge_path):
                             log_file = log_failures / challenge / f"{test_path}.log"
                             log_file.parent.mkdir(parents=True, exist_ok=True)
                             log_file.write_text(output)
-                        else:
+                        elif not silent_failures:
                             console.print(output.rstrip("\n"), markup=False)
                 if challenge in failed:
                     failed_count += 1