fix: reject empty interior domain labels #4184
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| unit-core: | |
| name: "Unit: core" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling-coverage-upload | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🩺 Run `go vet` | |
| run: | | |
| go vet ./... | |
| - name: 🧪 Run `go mod tidy -diff` | |
| run: | | |
| go mod tidy -diff | |
| - name: 🧪 Run `go test` | |
| run: | | |
| coverpkg="$(go list ./... | grep -v "internal/mocks" | paste -sd,)" | |
| go test -json "-coverpkg=${coverpkg}" -coverprofile=coverage.txt -race ./... | tee test-report.jsonl | |
| - name: 📦 Upload `go test -json` logs | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: go-test-json | |
| path: test-report.jsonl | |
| - name: ✂️ Drop zero-statement blocks from the coverage profile | |
| run: | | |
| awk '$2 != "0"' coverage.txt > coverage.txt.filtered | |
| mv coverage.txt.filtered coverage.txt | |
| - name: ☂️ Report coverage rates to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| fail_ci_if_error: true # default: false | |
| files: ./coverage.txt | |
| flags: unittests | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fuzz: | |
| name: "Fuzz: ${{ matrix.target.name }}" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| continue-on-error: ${{ matrix.target.experimental }} | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-fuzz-${{ matrix.target.name }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - name: "parse list" | |
| package: ./test/fuzzer | |
| fuzz: FuzzParseList | |
| fuzztime: "60s" | |
| parallel: 1 | |
| experimental: false | |
| - name: "parse expression" | |
| package: ./test/fuzzer | |
| fuzz: FuzzParseExpression | |
| fuzztime: "60s" | |
| parallel: 1 | |
| experimental: false | |
| - name: "parse entries" | |
| package: ./test/fuzzer | |
| fuzz: FuzzParseEntries | |
| fuzztime: "60s" | |
| parallel: 1 | |
| experimental: false | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🧪 Run `go mod tidy -diff` | |
| run: | | |
| go mod tidy -diff | |
| - name: 🧪 Run `go test -fuzz` | |
| run: | | |
| go test "${{ matrix.target.package }}" -fuzz "${{ matrix.target.fuzz }}" -fuzztime "${{ matrix.target.fuzztime }}" -parallel "${{ matrix.target.parallel }}" 2>&1 | tee "fuzz-${{ matrix.target.name }}.log" | |
| - name: 📦 Upload fuzz logs | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: go-fuzz-${{ matrix.target.name }} | |
| path: fuzz-${{ matrix.target.name }}.log | |
| smoke: | |
| name: Smoke | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling-coverage-upload | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🧪 Run covered `cmd/ddns` smoke tests | |
| run: | | |
| tmpdir="$(mktemp -d)" | |
| go build -cover -o "${tmpdir}/ddns" ./cmd/ddns | |
| cd scripts/github-actions/smoke-test | |
| go run . \ | |
| -binary "${tmpdir}/ddns" \ | |
| -coverprofile "${GITHUB_WORKSPACE}/integration-coverage.txt" | |
| - name: ✂️ Drop zero-statement blocks from the coverage profile | |
| run: | | |
| awk '$2 != "0"' integration-coverage.txt > integration-coverage.txt.filtered | |
| mv integration-coverage.txt.filtered integration-coverage.txt | |
| - name: ☂️ Report smoke-test coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| fail_ci_if_error: true # default: false | |
| files: ./integration-coverage.txt | |
| flags: smoketests | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| regenerate: | |
| name: Gegenerated files | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🧪 Run `go mod tidy -diff` | |
| run: | | |
| go mod tidy -diff | |
| - name: 🧪 Run `go generate` | |
| run: | | |
| rm -rf ./internal/mocks | |
| go generate ./... | |
| - name: 🔍 Check if any files are changed | |
| run: | | |
| if ! git diff --exit-code; then | |
| echo "Please run 'go gonerate ./...'" | |
| exit 1 | |
| fi | |
| go-fix-core: | |
| name: "Go Fix: core" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🩹 Run `go fix` | |
| run: | | |
| go fix ./... | |
| - name: 🔍 Check if any files are changed | |
| run: | | |
| if ! git diff --exit-code; then | |
| echo "Please run 'go fix ./...'" | |
| exit 1 | |
| fi | |
| test-scripts: | |
| name: "Unit: scripts (${{ matrix.module.name }})" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| module: | |
| - name: "doc watch" | |
| directory: scripts/github-actions/cloudflare-doc-watch | |
| - name: "auth error watch" | |
| directory: scripts/github-actions/cloudflare-auth-error-watch | |
| - name: "link check" | |
| directory: scripts/github-actions/link-check | |
| - name: "smoke test" | |
| directory: scripts/github-actions/smoke-test | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| cache-dependency-path: ${{ matrix.module.directory }}/go.mod | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🧪 Run `go mod tidy -diff` | |
| working-directory: ${{ matrix.module.directory }} | |
| run: | | |
| go mod tidy -diff | |
| - name: 🧪 Run `go test` | |
| working-directory: ${{ matrix.module.directory }} | |
| run: | | |
| go test ./... | |
| go-fix-scripts: | |
| name: "Go Fix: scripts (${{ matrix.module.name }})" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| module: | |
| - name: "doc watch" | |
| directory: scripts/github-actions/cloudflare-doc-watch | |
| - name: "auth error watch" | |
| directory: scripts/github-actions/cloudflare-auth-error-watch | |
| - name: "link check" | |
| directory: scripts/github-actions/link-check | |
| - name: "smoke test" | |
| directory: scripts/github-actions/smoke-test | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| cache-dependency-path: ${{ matrix.module.directory }}/go.mod | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🩹 Run `go fix` | |
| working-directory: ${{ matrix.module.directory }} | |
| run: | | |
| go fix ./... | |
| - name: 🔍 Check if any files are changed | |
| run: | | |
| if ! git diff --exit-code; then | |
| echo "Please run 'go fix ./...'" | |
| exit 1 | |
| fi |