-
Notifications
You must be signed in to change notification settings - Fork 0
103 lines (102 loc) · 3.93 KB
/
ci.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: ci_teleport
on:
workflow_dispatch:
pull_request:
jobs:
go-lint:
runs-on: ubuntu-latest
steps:
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: 1.22.x
- name: Checkout code
uses: actions/checkout@v4
- name: Run linters
uses: golangci/golangci-lint-action@v4
with:
version: latest
args: --timeout=3m
go-test:
strategy:
matrix:
go-version: [1.22.x]
platform: [ubuntu-latest]
runs-on: ${{ matrix.platform }}
steps:
- name: Install Go
if: success()
uses: actions/setup-go@v5
with:
go-version: ${{ matrix.go-version }}
- name: Checkout code
uses: actions/checkout@v4
- name: go tests
run: go test -v -covermode=count -json ./... > test.json
- name: annotate go tests
if: always()
uses: guyarb/[email protected]
with:
test-results: test.json
test:
permissions:
# The "id-token: write" permission is required or Machine ID will not be
# able to authenticate with the cluster.
id-token: write
contents: read
pages: write
runs-on: ubuntu-latest
env:
BATON_LOG_LEVEL: debug
# The following parameters are passed to grant/revoke commands
# Change these to the correct IDs for your test data
CONNECTOR_GRANT: ''
CONNECTOR_ENTITLEMENT: ''
CONNECTOR_PRINCIPAL: ''
CONNECTOR_PRINCIPAL_TYPE: ''
BATON_EMAIL: [email protected]
steps:
- name: Install Go
uses: actions/setup-go@v4
with:
go-version: 1.22.x
- name: Checkout code
uses: actions/checkout@v3
- name: Fetch Teleport binaries
uses: teleport-actions/setup@v1
with:
version: 15.1.1
- name: Fetch credentials using Machine ID
id: auth
uses: teleport-actions/auth@v2
with:
proxy: d3v-conductorone.teleport.sh:443
token: github-actions-cd
anonymous-telemetry: 1
- name: List nodes (tsh)
run: tsh ls
- name: Build baton-teleport
run: go build ./cmd/baton-teleport
- name: Check tsh status
run: tsh status
- name: Check tctl status
tctl status
# - name: Run baton-teleport
# run: ./baton-teleport --proxyAddr d3v-conductorone.teleport.sh
- name: Install baton
run: ./scripts/get-baton.sh && mv baton /usr/local/bin
- name: Check for grant before revoking
if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
run: baton grants --entitlement="${{ env.CONNECTOR_ENTITLEMENT }}" --output-format=json | jq --exit-status ".grants[].principal.id.resource == \"${{ env.CONNECTOR_PRINCIPAL }}\""
- name: Revoke grants
if: env.CONNECTOR_GRANT != ''
run: ./baton-baton-teleport --revoke-grant="${{ env.CONNECTOR_GRANT }}"
- name: Check grant was revoked
if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
run: ./baton-teleport && baton grants --entitlement="${{ env.CONNECTOR_ENTITLEMENT }}" --output-format=json | jq --exit-status "if .grants then .grants[]?.principal.id.resource != \"${{ env.CONNECTOR_PRINCIPAL }}\" else . end"
- name: Grant entitlement
if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != '' && env.CONNECTOR_PRINCIPAL_TYPE != ''
run: ./baton-teleport --grant-entitlement="${{ env.CONNECTOR_ENTITLEMENT }}" --grant-principal="${{ env.CONNECTOR_PRINCIPAL }}" --grant-principal-type="${{ env.CONNECTOR_PRINCIPAL_TYPE }}"
- name: Check grant was re-granted
if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
run: baton grants --entitlement="${{ env.CONNECTOR_ENTITLEMENT }}" --output-format=json | jq --exit-status ".grants[].principal.id.resource == \"${{ env.CONNECTOR_PRINCIPAL }}\""