diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index 3105fb6..0e7772d 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -30,6 +30,7 @@ jobs: runs-on: ${{ matrix.os }} strategy: fail-fast: true + max-parallel: 4 matrix: os: [ubuntu-latest, macos-latest, windows-latest] version: [latest, 2.30.0] @@ -59,6 +60,9 @@ jobs: echo "FILE_SECRET=op://${{ secrets.VAULT }}/test-secret/password" > tests/.env.tpl echo "FILE_SECRET_IN_SECTION=op://${{ secrets.VAULT }}/test-secret/test-section/password" >> tests/.env.tpl echo "FILE_MULTILINE_SECRET=op://${{ secrets.VAULT }}/multiline-secret/notesPlain" >> tests/.env.tpl + echo "FILE_WEBSITE=op://${{ secrets.VAULT }}/test-secret/website" >> tests/.env.tpl + echo "FILE_TEST_SSH_KEY=op://${{ secrets.VAULT }}/test-ssh-key/private key" >> tests/.env.tpl + echo "FILE_TEST_SSH_KEY_OPENSSH=op://${{ secrets.VAULT }}/test-ssh-key/private key?ssh-format=openssh" >> tests/.env.tpl - name: Configure Service account uses: ./configure @@ -75,25 +79,52 @@ jobs: SECRET: op://${{ secrets.VAULT }}/test-secret/password SECRET_IN_SECTION: op://${{ secrets.VAULT }}/test-secret/test-section/password MULTILINE_SECRET: op://${{ secrets.VAULT }}/multiline-secret/notesPlain + WEBSITE: op://${{ secrets.VAULT }}/test-secret/website + TEST_SSH_KEY: op://${{ secrets.VAULT }}/test-ssh-key/private key + TEST_SSH_KEY_OPENSSH: "op://${{ secrets.VAULT }}/test-ssh-key/private key?ssh-format=openssh" OP_ENV_FILE: ./tests/.env.tpl - name: Assert test secret values [step output] if: ${{ !matrix.export-env }} shell: bash env: + ASSERT_WEBSITE: "true" SECRET: ${{ steps.load_secrets.outputs.SECRET }} SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }} MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }} FILE_SECRET: ${{ steps.load_secrets.outputs.FILE_SECRET }} FILE_SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.FILE_SECRET_IN_SECTION }} FILE_MULTILINE_SECRET: ${{ steps.load_secrets.outputs.FILE_MULTILINE_SECRET }} + WEBSITE: ${{ steps.load_secrets.outputs.WEBSITE }} + FILE_WEBSITE: ${{ steps.load_secrets.outputs.FILE_WEBSITE }} + TEST_SSH_KEY: ${{ steps.load_secrets.outputs.TEST_SSH_KEY }} + FILE_TEST_SSH_KEY: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY }} + TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.TEST_SSH_KEY_OPENSSH }} + FILE_TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY_OPENSSH }} run: ./tests/assert-env-set.sh + - name: Assert SSH key env vars [step output] + if: ${{ !matrix.export-env }} + shell: bash + env: + TEST_SSH_KEY: ${{ steps.load_secrets.outputs.TEST_SSH_KEY }} + FILE_TEST_SSH_KEY: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY }} + TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.TEST_SSH_KEY_OPENSSH }} + FILE_TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY_OPENSSH }} + run: ./tests/assert-ssh-keys-set.sh + - name: Assert test secret values [exported env] if: ${{ matrix.export-env }} shell: bash + env: + ASSERT_WEBSITE: "true" run: ./tests/assert-env-set.sh + - name: Assert SSH key env vars [exported env] + if: ${{ matrix.export-env }} + shell: bash + run: ./tests/assert-ssh-keys-set.sh + - name: Remove secrets [exported env] if: ${{ matrix.export-env }} uses: ./ @@ -111,7 +142,6 @@ jobs: strategy: fail-fast: true matrix: - os: [ubuntu-latest, macos-latest, windows-latest] version: [latest, 2.30.0] export-env: [true, false] steps: @@ -139,13 +169,16 @@ jobs: echo "FILE_SECRET=op://${{ secrets.VAULT }}/test-secret/password" > tests/.env.tpl echo "FILE_SECRET_IN_SECTION=op://${{ secrets.VAULT }}/test-secret/test-section/password" >> tests/.env.tpl echo "FILE_MULTILINE_SECRET=op://${{ secrets.VAULT }}/multiline-secret/notesPlain" >> tests/.env.tpl + echo "FILE_TEST_SSH_KEY=op://${{ secrets.VAULT }}/test-ssh-key/private key" >> tests/.env.tpl + echo "FILE_TEST_SSH_KEY_OPENSSH=op://${{ secrets.VAULT }}/test-ssh-key/private key?ssh-format=openssh" >> tests/.env.tpl - name: Launch 1Password Connect instance env: OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }} run: | echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json - docker compose -f tests/fixtures/docker-compose.yml up -d && sleep 10 + docker compose -f tests/fixtures/docker-compose.yml up -d + timeout 60 bash -c 'until curl -sf http://localhost:8080/health >/dev/null 2>&1; do sleep 2; done' - name: Configure 1Password Connect uses: ./configure @@ -163,23 +196,45 @@ jobs: SECRET: op://${{ secrets.VAULT }}/test-secret/password SECRET_IN_SECTION: op://${{ secrets.VAULT }}/test-secret/test-section/password MULTILINE_SECRET: op://${{ secrets.VAULT }}/multiline-secret/notesPlain + TEST_SSH_KEY: op://${{ secrets.VAULT }}/test-ssh-key/private key + TEST_SSH_KEY_OPENSSH: "op://${{ secrets.VAULT }}/test-ssh-key/private key?ssh-format=openssh" OP_ENV_FILE: ./tests/.env.tpl - name: Assert test secret values [step output] if: ${{ !matrix.export-env }} env: + ASSERT_WEBSITE: "false" SECRET: ${{ steps.load_secrets.outputs.SECRET }} SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }} MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }} FILE_SECRET: ${{ steps.load_secrets.outputs.FILE_SECRET }} FILE_SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.FILE_SECRET_IN_SECTION }} FILE_MULTILINE_SECRET: ${{ steps.load_secrets.outputs.FILE_MULTILINE_SECRET }} + TEST_SSH_KEY: ${{ steps.load_secrets.outputs.TEST_SSH_KEY }} + FILE_TEST_SSH_KEY: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY }} + TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.TEST_SSH_KEY_OPENSSH }} + FILE_TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY_OPENSSH }} run: ./tests/assert-env-set.sh + - name: Assert SSH key env vars [step output] + if: ${{ !matrix.export-env }} + env: + TEST_SSH_KEY: ${{ steps.load_secrets.outputs.TEST_SSH_KEY }} + FILE_TEST_SSH_KEY: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY }} + TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.TEST_SSH_KEY_OPENSSH }} + FILE_TEST_SSH_KEY_OPENSSH: ${{ steps.load_secrets.outputs.FILE_TEST_SSH_KEY_OPENSSH }} + run: ./tests/assert-ssh-keys-set.sh + - name: Assert test secret values [exported env] if: ${{ matrix.export-env }} + env: + ASSERT_WEBSITE: "false" run: ./tests/assert-env-set.sh + - name: Assert SSH key env vars [exported env] + if: ${{ matrix.export-env }} + run: ./tests/assert-ssh-keys-set.sh + - name: Remove secrets [exported env] if: ${{ matrix.export-env }} uses: ./ diff --git a/tests/assert-env-set.sh b/tests/assert-env-set.sh index 7f98855..7e4c877 100755 --- a/tests/assert-env-set.sh +++ b/tests/assert-env-set.sh @@ -26,6 +26,7 @@ IApTbyBwbGVhc2UgZG9uJ3QgcmVwb3J0IGl0IQo= EOF )" readonly MULTILINE_SECRET +readonly WEBSITE="www.test.com" assert_env_equals "SECRET" "${SECRET}" assert_env_equals "FILE_SECRET" "${SECRET}" @@ -34,4 +35,10 @@ assert_env_equals "SECRET_IN_SECTION" "${SECRET}" assert_env_equals "FILE_SECRET_IN_SECTION" "${SECRET}" assert_env_equals "MULTILINE_SECRET" "${MULTILINE_SECRET}" -assert_env_equals "FILE_MULTILINE_SECRET" "${MULTILINE_SECRET}" \ No newline at end of file +assert_env_equals "FILE_MULTILINE_SECRET" "${MULTILINE_SECRET}" + +# WEBSITE/FILE_WEBSITE: required when ASSERT_WEBSITE=true (Service Account), skipped when false (Connect) +if [ "${ASSERT_WEBSITE:-false}" = "true" ]; then + assert_env_equals "WEBSITE" "${WEBSITE}" + assert_env_equals "FILE_WEBSITE" "${WEBSITE}" +fi diff --git a/tests/assert-env-unset.sh b/tests/assert-env-unset.sh index 0565d14..027cead 100755 --- a/tests/assert-env-unset.sh +++ b/tests/assert-env-unset.sh @@ -17,3 +17,11 @@ assert_env_unset "FILE_SECRET_IN_SECTION" assert_env_unset "MULTILINE_SECRET" assert_env_unset "FILE_MULTILINE_SECRET" + +assert_env_unset "WEBSITE" +assert_env_unset "FILE_WEBSITE" + +assert_env_unset "TEST_SSH_KEY" +assert_env_unset "FILE_TEST_SSH_KEY" +assert_env_unset "TEST_SSH_KEY_OPENSSH" +assert_env_unset "FILE_TEST_SSH_KEY_OPENSSH" diff --git a/tests/assert-ssh-keys-set.sh b/tests/assert-ssh-keys-set.sh new file mode 100755 index 0000000..596b5f5 --- /dev/null +++ b/tests/assert-ssh-keys-set.sh @@ -0,0 +1,26 @@ +#!/bin/bash +set -e + +assert_ssh_key_set() { + local var="$1" + local val + val="$(printenv "$var" || true)" + if [ -z "$val" ]; then + echo "Expected $var to be set" + exit 1 + fi + [ "$val" = "***" ] && return 0 + local line + line="$(echo "$val" | head -1)" + if echo "$var" | grep -q "OPENSSH"; then + echo "$line" | grep -q "OPENSSH" || { echo "Expected $var to start with -----BEGIN OPENSSH PRIVATE KEY-----"; exit 1; } + else + echo "$line" | grep -q "BEGIN.*PRIVATE KEY" || { echo "Expected $var to be a private key"; exit 1; } + fi + echo "$var OK" +} + +assert_ssh_key_set "TEST_SSH_KEY" +assert_ssh_key_set "TEST_SSH_KEY_OPENSSH" +assert_ssh_key_set "FILE_TEST_SSH_KEY" +assert_ssh_key_set "FILE_TEST_SSH_KEY_OPENSSH"