SemianiakaVY/openpencil
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity
openpencil/.github/workflows/collab-security.yml
Kayshen-X a39406c12b feat(deploy): collab-relay production configs, CN docker firewall, HSM locator 
Add production deployment configs for the collab relay and locator: region-split
compose (CN/global), direct nginx gateways and location maps, the CN docker-user
firewall install/verify/validate tooling and systemd unit, and an SoftHSM-backed
locator variant. Extend the collab security/deployment boundary checks to cover
the new artifacts.

The CN application host address is a placeholder (10.0.0.10); substitute the real
private address at deploy time.
2026-08-11 21:46:47 +08:00

176 lines
6.9 KiB
YAML
Raw Blame History

name: P2P collaboration security boundaries
on:
pull_request:
paths:
- 'Cargo.toml'
- 'Cargo.lock'
- '.dockerignore'
- '.gitignore'
- 'rust-toolchain.toml'
- 'crates/op-collab/**'
- 'crates/op-collab-smoke/**'
- 'crates/op-collab-transport/**'
- 'crates/op-collab-relay-protocol/**'
- 'crates/op-collab-relay-client/**'
- 'crates/op-collab-relay-server/**'
- 'crates/op-collab-relay-control-plane/**'
- 'crates/op-collab-policy-file/**'
- 'crates/op-collab-relay-locator-hsm/**'
- 'crates/op-collab-relay-locator-server/**'
- 'crates/op-auth-bridge/**'
- 'crates/op-util/**'
- 'crates/op-editor-core/**'
- 'crates/op-editor-host-core/**'
- 'crates/op-editor-ui/**'
- 'crates/op-host-native/**'
- 'crates/op-host-desktop/**'
- 'crates/op-host-services/**'
- 'crates/op-i18n/**'
- 'deploy/collab-relay/**'
- 'deploy/collab-relay-edge/**'
- 'deploy/collab-relay-locator/**'
- 'deploy/collab-relay-locator-hsm/**'
- 'deploy/collab-relay-locator-edge/**'
- 'docs/security/p2p-collaboration-threat-model.md'
- 'docs/testing/p2p-collaboration-platform-acceptance.md'
- 'tools/check-collab-security-boundaries.sh'
- 'tools/check-collab-security-boundaries.test.sh'
- 'tools/check-collab-security-boundaries-cases.sh'
- 'tools/check-collab-deployment-boundaries.sh'
- 'tools/check-op-auth-prebuilt.sh'
- 'tools/check-op-auth-prebuilt.test.sh'
- 'tools/package-op-auth-prebuilt.sh'
- '.github/workflows/collab-security.yml'
- '.github/workflows/collab-platform-acceptance.yml'
push:
branches: ['**']
paths:
- 'Cargo.toml'
- 'Cargo.lock'
- '.dockerignore'
- '.gitignore'
- 'rust-toolchain.toml'
- 'crates/op-collab/**'
- 'crates/op-collab-smoke/**'
- 'crates/op-collab-transport/**'
- 'crates/op-collab-relay-protocol/**'
- 'crates/op-collab-relay-client/**'
- 'crates/op-collab-relay-server/**'
- 'crates/op-collab-relay-control-plane/**'
- 'crates/op-collab-policy-file/**'
- 'crates/op-collab-relay-locator-hsm/**'
- 'crates/op-collab-relay-locator-server/**'
- 'crates/op-auth-bridge/**'
- 'crates/op-util/**'
- 'crates/op-editor-core/**'
- 'crates/op-editor-host-core/**'
- 'crates/op-editor-ui/**'
- 'crates/op-host-native/**'
- 'crates/op-host-desktop/**'
- 'crates/op-host-services/**'
- 'crates/op-i18n/**'
- 'deploy/collab-relay/**'
- 'deploy/collab-relay-edge/**'
- 'deploy/collab-relay-locator/**'
- 'deploy/collab-relay-locator-hsm/**'
- 'deploy/collab-relay-locator-edge/**'
- 'docs/security/p2p-collaboration-threat-model.md'
- 'docs/testing/p2p-collaboration-platform-acceptance.md'
- 'tools/check-collab-security-boundaries.sh'
- 'tools/check-collab-security-boundaries.test.sh'
- 'tools/check-collab-security-boundaries-cases.sh'
- 'tools/check-collab-deployment-boundaries.sh'
- 'tools/check-op-auth-prebuilt.sh'
- 'tools/check-op-auth-prebuilt.test.sh'
- 'tools/package-op-auth-prebuilt.sh'
- '.github/workflows/collab-security.yml'
- '.github/workflows/collab-platform-acceptance.yml'
workflow_dispatch:
permissions:
contents: read
jobs:
collaboration-security:
name: Static boundaries and targeted tests
runs-on: ubuntu-latest
timeout-minutes: 45
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
submodules: recursive
persist-credentials: false
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable, pinned 2026-07-28
with:
toolchain: '1.94'
targets: wasm32-unknown-unknown
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
shared-key: collab-security
- name: Check boundary-script syntax
run: |
bash -n tools/check-collab-security-boundaries.sh
bash -n tools/check-collab-security-boundaries.test.sh
bash -n tools/check-collab-security-boundaries-cases.sh
bash -n tools/check-collab-deployment-boundaries.sh
bash -n tools/check-op-auth-prebuilt.sh
bash -n tools/check-op-auth-prebuilt.test.sh
bash -n tools/package-op-auth-prebuilt.sh
- name: Mutation-test the boundary gate
run: |
bash tools/check-collab-security-boundaries.test.sh
bash tools/check-op-auth-prebuilt.test.sh
- name: Verify public/private and secret boundaries
run: |
bash tools/check-collab-security-boundaries.sh
bash tools/check-op-auth-prebuilt.sh
bash deploy/collab-relay-edge/validate.sh
bash deploy/collab-relay-locator/validate.sh
bash deploy/collab-relay-locator-edge/validate.sh
- name: Compile the public protocol core for wasm
run: |
cargo check --locked --target wasm32-unknown-unknown \
-p op-collab --no-default-features
cargo check --locked --target wasm32-unknown-unknown \
-p op-collab-relay-protocol --no-default-features
- name: Test protocol state machines, properties, and resource limits
run: |
cargo test --locked -p op-collab
cargo test --locked -p op-collab-transport
cargo test --locked -p op-collab-transport config::tests
cargo test --locked -p op-collab-transport frame::tests
cargo test --locked -p op-collab-relay-protocol --all-features
cargo test --locked -p op-collab-relay-client
cargo test --locked -p op-collab-relay-server
cargo test --locked -p op-collab-relay-control-plane
cargo test --locked -p op-collab-policy-file
cargo test --locked -p op-collab-relay-locator-hsm
cargo test --locked -p op-collab-relay-locator-server
- name: Test the locator signer against SoftHSM
run: |
docker build --target test \
-f deploy/collab-relay-locator-hsm/Dockerfile .
- name: Test production/test trust-root isolation
run: |
cargo test --locked -p op-auth-bridge --features test-issuer \
verifies_the_frozen_go_production_root_fixture
cargo test --locked -p op-auth-bridge --features test-issuer \
production_signed_policy_path_never_falls_back_to_raw_jwks
cargo test --locked -p op-auth-bridge --features test-issuer \
--test collab_verifier
- name: Verify every committed authentication archive
run: cargo test --locked -p op-auth-bridge --test prebuilt_provenance
- name: Exercise two-process authenticated collaboration
run: |
cargo run --locked -p op-collab-smoke --features test-issuer -- run
Reference in a new issue View git blame Copy permalink