fix: RBAC scope and tenant validation in transit gateway #1714
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Coverage Gate | ||
| env: | ||
| SECRETS_ENCRYPTION_KEY: abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789 | ||
| STORAGE_SECRET: ci-test-storage-secret-key | ||
| POWERDNS_API_KEY: ci-test-powerdns-api-key | ||
| on: | ||
| pull_request: | ||
| branches: [ main ] | ||
| jobs: | ||
| coverage: | ||
| name: Enforce Coverage | ||
| runs-on: ubuntu-latest | ||
| services: | ||
| postgres: | ||
| image: postgres:16-alpine | ||
| env: | ||
| POSTGRES_USER: cloud | ||
| POSTGRES_PASSWORD: cloud | ||
| POSTGRES_DB: cloud | ||
| ports: | ||
| - 5433:5432 | ||
| options: >- | ||
| --health-cmd "pg_isready -U cloud" | ||
| --health-interval 10s | ||
| --health-timeout 5s | ||
| --health-retries 5 | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - name: Setup Go | ||
| uses: actions/setup-go@v6 | ||
| with: | ||
| go-version: '1.25.0' | ||
| <<<<<<< HEAD | ||
| - name: Generate TLS test certs | ||
| run: | | ||
| mkdir -p cmd/storage-node/testdata/tls internal/api/setup/testdata/tls | ||
| openssl req -x509 -newkey rsa:2048 -keyout cmd/storage-node/testdata/tls/test-key.pem -out cmd/storage-node/testdata/tls/test-cert.pem -days 365 -nodes -subj "/CN=test" | ||
| openssl req -x509 -newkey rsa:2048 -keyout internal/api/setup/testdata/tls/ca-key.pem -out internal/api/setup/testdata/tls/ca-cert.pem -days 365 -nodes -subj "/CN=test-ca" | ||
| openssl req -x509 -newkey rsa:2048 -keyout internal/api/setup/testdata/tls/test-key.pem -out internal/api/setup/testdata/tls/test-cert.pem -days 365 -nodes -subj "/CN=test" | ||
| - name: Clear Go build cache | ||
| run: go clean -cache | ||
| - name: Wait for Database | ||
| run: | | ||
| timeout 60s bash -c 'until pg_isready -h 127.0.0.1 -p 5433 -U cloud; do | ||
| echo "Waiting for postgres..." | ||
| sleep 2 | ||
| done' | ||
| - name: Run Tests | ||
| env: | ||
| DATABASE_URL: postgres://cloud:cloud@127.0.0.1:5433/cloud?sslmode=disable | ||
| TEST_DOCKER_NETWORK: cloud-network | ||
| run: | | ||
| docker network create ${TEST_DOCKER_NETWORK} || true | ||
| go test -p 1 -v -coverprofile=coverage.out ./cmd/... ./internal/... ./pkg/... | ||
| - name: Check Coverage Threshold | ||
| run: | | ||
| COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | tr -d '%') | ||
| echo "Current total coverage: $COVERAGE%" | ||
| if (( $(echo "$COVERAGE < 55" | bc -l) )); then | ||
| echo "Error: Code coverage $COVERAGE% is below the required 55% threshold." | ||
| exit 1 | ||
| fi | ||
| echo "Coverage check passed!" | ||
