Compare commits
2
Commits
next
..
6a753f14c4
| Author | SHA1 | Date | |
|---|---|---|---|
 sneak
|
6a753f14c4 | ||
|
sneak
|
5f88dc5cfa |
@@ -1,27 +1,21 @@
|
||||
# Workflow
|
||||
|
||||
* branch per issue from `next`
|
||||
* branch (from `main`)
|
||||
* do the work in Next Step
|
||||
* move Next Step to the top of Completed Steps
|
||||
* move the top item of Future Steps into Next Step
|
||||
* commit (`TODO.md` changes in the same commit as the work)
|
||||
* open a PR based on `next`
|
||||
* an independent reviewer who did not write the change gates it
|
||||
* the manager squash-merges the PR into `next` once review passes
|
||||
* `next` stays green and mergeable to `main` at any time; only the owner
|
||||
merges `next` into `main`, via the single milestone PR
|
||||
* merge to `main` if the branch is not protected, otherwise open a PR
|
||||
* push
|
||||
|
||||
# Status
|
||||
|
||||
pre-1.0. No git tags exist. The `1.0.0` milestone is in progress; work
|
||||
lands on `next`, and `main` receives only the milestone PR that the
|
||||
owner merges. `next` is at the canonical `golangci-lint` v2.12.2 config
|
||||
and is green. Recent work extracted the internal/magic,
|
||||
pre-1.0. No git tags exist. Recent work extracted the internal/magic,
|
||||
internal/allowlist, internal/httpfetcher, and internal/signature
|
||||
packages. The gosec findings from the 2026-07-06 survey are resolved.
|
||||
The disk cache is now size-bounded with LRU eviction
|
||||
(`cache_max_bytes`), closing the unbounded disk growth DoS vector.
|
||||
packages. The gosec findings from the 2026-07-06 survey are resolved
|
||||
and `make check` is green on main. The disk cache is now size-bounded
|
||||
with LRU eviction (`cache_max_bytes`), closing the unbounded disk
|
||||
growth DoS vector.
|
||||
|
||||
# Next Step
|
||||
|
||||
|
||||
@@ -1,421 +0,0 @@
|
||||
package httpfetcher
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"slices"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// testPublicHost is a TEST-NET-1 (RFC 5737) literal. isPrivateIP treats it as
|
||||
// public, so validateURL and the redirect check accept it with no DNS lookup,
|
||||
// while the recording dialer routes it to the local httptest server. The
|
||||
// address is reserved for documentation and is never routed on the network.
|
||||
const testPublicHost = "192.0.2.10"
|
||||
|
||||
// imagePayload is the body served by the fake upstream's image route.
|
||||
const imagePayload = "fake-jpeg-bytes"
|
||||
|
||||
// errUnexpectedDial reports a dial to any host other than testPublicHost, which
|
||||
// would mean SSRF protection let a forbidden target reach the transport.
|
||||
var errUnexpectedDial = errors.New("unexpected dial target")
|
||||
|
||||
// upstreamURL builds a fetch URL on the fake public host for the given path.
|
||||
func upstreamURL(path string) string {
|
||||
return "http://" + testPublicHost + path
|
||||
}
|
||||
|
||||
// recordingDialer records every address the transport asks it to dial and
|
||||
// routes connections for testPublicHost to a real local server, so the SSRF
|
||||
// checks run against a public-looking host while bytes go to httptest.
|
||||
type recordingDialer struct {
|
||||
target string
|
||||
|
||||
mu sync.Mutex
|
||||
dialed []string
|
||||
}
|
||||
|
||||
func (d *recordingDialer) dialContext(
|
||||
ctx context.Context,
|
||||
network, addr string,
|
||||
) (net.Conn, error) {
|
||||
d.mu.Lock()
|
||||
d.dialed = append(d.dialed, addr)
|
||||
d.mu.Unlock()
|
||||
|
||||
host, _, err := net.SplitHostPort(addr)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if host != testPublicHost {
|
||||
return nil, fmt.Errorf("%w: %s", errUnexpectedDial, addr)
|
||||
}
|
||||
|
||||
var dialer net.Dialer
|
||||
|
||||
return dialer.DialContext(ctx, network, d.target)
|
||||
}
|
||||
|
||||
// dialedAddrs returns a copy of the addresses the dialer was asked to reach.
|
||||
func (d *recordingDialer) dialedAddrs() []string {
|
||||
d.mu.Lock()
|
||||
defer d.mu.Unlock()
|
||||
|
||||
return slices.Clone(d.dialed)
|
||||
}
|
||||
|
||||
// startUpstream launches a fake upstream with the routes the fetch tests
|
||||
// exercise and stops it when the test finishes.
|
||||
func startUpstream(t *testing.T) *httptest.Server {
|
||||
t.Helper()
|
||||
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/image", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.Header().Set("Content-Type", contentTypeJPEG)
|
||||
_, _ = io.WriteString(w, imagePayload)
|
||||
})
|
||||
mux.HandleFunc("/status/500", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
})
|
||||
mux.HandleFunc("/html", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
_, _ = io.WriteString(w, "<html></html>")
|
||||
})
|
||||
mux.HandleFunc("/redirect/private", func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Redirect(w, r, "http://169.254.169.254/latest/meta-data/", http.StatusFound)
|
||||
})
|
||||
mux.HandleFunc("/redirect/public", func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Redirect(w, r, "/image", http.StatusFound)
|
||||
})
|
||||
mux.HandleFunc("/redirect/chain", func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Redirect(w, r, "/redirect/hop", http.StatusFound)
|
||||
})
|
||||
mux.HandleFunc("/redirect/hop", func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Redirect(w, r, "/image", http.StatusFound)
|
||||
})
|
||||
|
||||
srv := httptest.NewServer(mux)
|
||||
t.Cleanup(srv.Close)
|
||||
|
||||
return srv
|
||||
}
|
||||
|
||||
// newServerFetcher builds a fetcher whose transport routes testPublicHost to
|
||||
// srv, leaving the real SSRF validation and redirect checks in place.
|
||||
func newServerFetcher(
|
||||
t *testing.T,
|
||||
srv *httptest.Server,
|
||||
cfg *Config,
|
||||
) (*HTTPFetcher, *recordingDialer) {
|
||||
t.Helper()
|
||||
|
||||
if cfg == nil {
|
||||
cfg = DefaultConfig()
|
||||
}
|
||||
|
||||
cfg.AllowHTTP = true
|
||||
|
||||
f := New(cfg)
|
||||
|
||||
transport, ok := f.client.Transport.(*http.Transport)
|
||||
if !ok {
|
||||
t.Fatalf("transport is %T, want *http.Transport", f.client.Transport)
|
||||
}
|
||||
|
||||
dialer := &recordingDialer{target: srv.Listener.Addr().String()}
|
||||
transport.DialContext = dialer.dialContext
|
||||
|
||||
return f, dialer
|
||||
}
|
||||
|
||||
// testContext returns a context cancelled when the test ends, bounding any
|
||||
// fetch that would otherwise block on a leaked semaphore slot.
|
||||
func testContext(t *testing.T) context.Context {
|
||||
t.Helper()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
t.Cleanup(cancel)
|
||||
|
||||
return ctx
|
||||
}
|
||||
|
||||
// fetchImage fetches path from the fake upstream and fails on error.
|
||||
func fetchImage(t *testing.T, f *HTTPFetcher, path string) *FetchResult {
|
||||
t.Helper()
|
||||
|
||||
res, err := f.Fetch(testContext(t), upstreamURL(path))
|
||||
if err != nil {
|
||||
t.Fatalf("Fetch(%s) error = %v", path, err)
|
||||
}
|
||||
|
||||
return res
|
||||
}
|
||||
|
||||
// fetchExpectError fetches path and fails unless Fetch returns an error.
|
||||
func fetchExpectError(t *testing.T, f *HTTPFetcher, path string) error {
|
||||
t.Helper()
|
||||
|
||||
res, err := f.Fetch(testContext(t), upstreamURL(path))
|
||||
if err == nil {
|
||||
_ = res.Content.Close()
|
||||
|
||||
t.Fatalf("Fetch(%s) = nil error, want an error", path)
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
// fetchBody fetches path and returns the fully read, closed response body.
|
||||
func fetchBody(t *testing.T, f *HTTPFetcher, path string) string {
|
||||
t.Helper()
|
||||
|
||||
res := fetchImage(t, f, path)
|
||||
defer func() { _ = res.Content.Close() }()
|
||||
|
||||
data, err := io.ReadAll(res.Content)
|
||||
if err != nil {
|
||||
t.Fatalf("read body: %v", err)
|
||||
}
|
||||
|
||||
return string(data)
|
||||
}
|
||||
|
||||
// semLen reports how many per-host semaphore slots are currently held.
|
||||
func semLen(f *HTTPFetcher, host string) int {
|
||||
return len(f.getHostSemaphore(host))
|
||||
}
|
||||
|
||||
func TestFetchRedirectToPrivateIPBlocked(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
srv := startUpstream(t)
|
||||
f, dialer := newServerFetcher(t, srv, nil)
|
||||
|
||||
_, err := f.Fetch(testContext(t), upstreamURL("/redirect/private"))
|
||||
if !errors.Is(err, ErrSSRFBlocked) {
|
||||
t.Fatalf("Fetch() error = %v, want ErrSSRFBlocked", err)
|
||||
}
|
||||
|
||||
for _, addr := range dialer.dialedAddrs() {
|
||||
if strings.Contains(addr, "169.254.169.254") {
|
||||
t.Errorf("dialer connected to the private redirect target: %s", addr)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestFetchRedirectToPublicSucceeds(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
srv := startUpstream(t)
|
||||
f, _ := newServerFetcher(t, srv, nil)
|
||||
|
||||
if body := fetchBody(t, f, "/redirect/public"); body != imagePayload {
|
||||
t.Errorf("body = %q, want %q", body, imagePayload)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFetchRedirectChainSucceeds(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
srv := startUpstream(t)
|
||||
f, _ := newServerFetcher(t, srv, nil)
|
||||
|
||||
if body := fetchBody(t, f, "/redirect/chain"); body != imagePayload {
|
||||
t.Errorf("body = %q, want %q", body, imagePayload)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFetchRejectsNon2xx(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
srv := startUpstream(t)
|
||||
f, _ := newServerFetcher(t, srv, nil)
|
||||
|
||||
err := fetchExpectError(t, f, "/status/500")
|
||||
if !errors.Is(err, ErrUpstreamError) {
|
||||
t.Fatalf("Fetch() error = %v, want ErrUpstreamError", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFetchRejectsDisallowedContentType(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
srv := startUpstream(t)
|
||||
f, _ := newServerFetcher(t, srv, nil)
|
||||
|
||||
err := fetchExpectError(t, f, "/html")
|
||||
if !errors.Is(err, ErrInvalidContentType) {
|
||||
t.Fatalf("Fetch() error = %v, want ErrInvalidContentType", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFetchMaxResponseSizeEnforced(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
srv := startUpstream(t)
|
||||
|
||||
cfg := DefaultConfig()
|
||||
cfg.MaxResponseSize = 8
|
||||
|
||||
f, _ := newServerFetcher(t, srv, cfg)
|
||||
|
||||
res := fetchImage(t, f, "/image")
|
||||
defer func() { _ = res.Content.Close() }()
|
||||
|
||||
data, err := io.ReadAll(res.Content)
|
||||
if !errors.Is(err, ErrResponseTooLarge) {
|
||||
t.Fatalf("read error = %v, want ErrResponseTooLarge", err)
|
||||
}
|
||||
|
||||
if int64(len(data)) > cfg.MaxResponseSize {
|
||||
t.Errorf("read %d bytes, exceeds limit %d", len(data), cfg.MaxResponseSize)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFetchSemaphoreReleasedOnError(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
srv := startUpstream(t)
|
||||
|
||||
cfg := DefaultConfig()
|
||||
cfg.MaxConnectionsPerHost = 1
|
||||
|
||||
f, _ := newServerFetcher(t, srv, cfg)
|
||||
|
||||
err := fetchExpectError(t, f, "/status/500")
|
||||
if !errors.Is(err, ErrUpstreamError) {
|
||||
t.Fatalf("Fetch() error = %v, want ErrUpstreamError", err)
|
||||
}
|
||||
|
||||
if held := semLen(f, testPublicHost); held != 0 {
|
||||
t.Fatalf("semaphore slot leaked after error: %d held", held)
|
||||
}
|
||||
|
||||
// One slot per host: this fetch proceeds only if the slot was released.
|
||||
res := fetchImage(t, f, "/image")
|
||||
_ = res.Content.Close()
|
||||
}
|
||||
|
||||
// assertSlotReleasedByClose fetches an image over a one-slot host, hands the
|
||||
// open result to consume, and asserts the slot is held before and freed after,
|
||||
// then that a follow-up fetch can still acquire it.
|
||||
func assertSlotReleasedByClose(
|
||||
t *testing.T,
|
||||
consume func(*testing.T, *FetchResult),
|
||||
) {
|
||||
t.Helper()
|
||||
|
||||
srv := startUpstream(t)
|
||||
|
||||
cfg := DefaultConfig()
|
||||
cfg.MaxConnectionsPerHost = 1
|
||||
|
||||
f, _ := newServerFetcher(t, srv, cfg)
|
||||
|
||||
res := fetchImage(t, f, "/image")
|
||||
if held := semLen(f, testPublicHost); held != 1 {
|
||||
t.Fatalf("slot not held while body is open: %d held", held)
|
||||
}
|
||||
|
||||
consume(t, res)
|
||||
|
||||
if held := semLen(f, testPublicHost); held != 0 {
|
||||
t.Fatalf("slot not released after close: %d held", held)
|
||||
}
|
||||
|
||||
next := fetchImage(t, f, "/image")
|
||||
_ = next.Content.Close()
|
||||
}
|
||||
|
||||
func TestFetchSemaphoreReleasedOnBodyClose(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assertSlotReleasedByClose(t, func(t *testing.T, res *FetchResult) {
|
||||
t.Helper()
|
||||
|
||||
_, err := io.ReadAll(res.Content)
|
||||
if err != nil {
|
||||
t.Fatalf("read body: %v", err)
|
||||
}
|
||||
|
||||
err = res.Content.Close()
|
||||
if err != nil {
|
||||
t.Fatalf("close body: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestFetchSemaphoreReleasedOnPartialReadClose(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assertSlotReleasedByClose(t, func(t *testing.T, res *FetchResult) {
|
||||
t.Helper()
|
||||
|
||||
buf := make([]byte, 1)
|
||||
|
||||
_, err := res.Content.Read(buf)
|
||||
if err != nil {
|
||||
t.Fatalf("partial read: %v", err)
|
||||
}
|
||||
|
||||
err = res.Content.Close()
|
||||
if err != nil {
|
||||
t.Fatalf("close body: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// The dial-time re-resolution in ssrfSafeDialer is what closes the DNS
|
||||
// rebinding window: even if validateURL saw a public answer earlier, the
|
||||
// dialer independently re-checks the address it is about to connect to. A full
|
||||
// rebinding simulation (a resolver returning public, then private) would mean
|
||||
// replacing the global net.DefaultResolver with a fake DNS server, which is
|
||||
// heavyweight and unsafe to mutate under parallel -race tests. The property is
|
||||
// proven directly here instead: the dialer rejects a private target outright,
|
||||
// which is exactly the check that fires when a validated host later resolves
|
||||
// to a private address.
|
||||
func TestSSRFSafeDialerBlocksPrivateTarget(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, addr := range []string{
|
||||
"169.254.169.254:80", // link-local (cloud metadata)
|
||||
"127.0.0.1:80", // loopback
|
||||
"10.0.0.5:80", // RFC 1918 private
|
||||
} {
|
||||
t.Run(addr, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
_, err := ssrfSafeDialer(context.Background(), "tcp", addr)
|
||||
if !errors.Is(err, ErrSSRFBlocked) {
|
||||
t.Errorf("ssrfSafeDialer(%q) = %v, want ErrSSRFBlocked", addr, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSSRFSafeDialerAllowsPublicTarget(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
// A cancelled context makes the dial fail immediately without touching the
|
||||
// network; the point is only that a public literal is not SSRF-blocked.
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
cancel()
|
||||
|
||||
_, err := ssrfSafeDialer(ctx, "tcp", testPublicHost+":80")
|
||||
if err == nil {
|
||||
t.Fatal("expected a dial error for an unreachable public target")
|
||||
}
|
||||
|
||||
if errors.Is(err, ErrSSRFBlocked) {
|
||||
t.Errorf("public target was SSRF-blocked: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -21,33 +21,6 @@ import (
|
||||
// CORSMaxAgeSeconds is the max age for CORS preflight cache (24 hours).
|
||||
const CORSMaxAgeSeconds = 86400
|
||||
|
||||
// HSTSValue is the Strict-Transport-Security header value: one year with
|
||||
// includeSubDomains. Emitted unconditionally even though pixa listens plain
|
||||
// HTTP behind a TLS-terminating proxy; browsers ignore an HSTS header received
|
||||
// over plaintext (RFC 6797 section 8.1), so it never lies about the connection,
|
||||
// and emitting it here avoids trusting a forwarded-proto header.
|
||||
const HSTSValue = "max-age=31536000; includeSubDomains"
|
||||
|
||||
// ContentSecurityPolicyValue is the Content-Security-Policy header value.
|
||||
// default-src 'self' is the baseline and frame-ancestors 'none' is the primary
|
||||
// clickjacking control. 'unsafe-inline' is required in script-src and style-src
|
||||
// because the served templates carry inline onclick handlers (generator page)
|
||||
// and the bundled Tailwind asset injects a runtime <style> element; dropping it
|
||||
// needs template changes outside this issue's scope.
|
||||
const ContentSecurityPolicyValue = "default-src 'self'; " +
|
||||
"script-src 'self' 'unsafe-inline'; " +
|
||||
"style-src 'self' 'unsafe-inline'; " +
|
||||
"object-src 'none'; " +
|
||||
"base-uri 'self'; " +
|
||||
"form-action 'self'; " +
|
||||
"frame-ancestors 'none'"
|
||||
|
||||
// PermissionsPolicyValue is the Permissions-Policy header value. Every listed
|
||||
// feature is denied because pixa uses none of them.
|
||||
const PermissionsPolicyValue = "accelerometer=(), autoplay=(), camera=(), " +
|
||||
"display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), " +
|
||||
"microphone=(), payment=(), usb=()"
|
||||
|
||||
// Params defines dependencies for Middleware.
|
||||
type Params struct {
|
||||
fx.In
|
||||
@@ -191,16 +164,6 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
|
||||
// Disable XSS filtering (modern browsers don't need it, can cause issues)
|
||||
w.Header().Set("X-XSS-Protection", "0")
|
||||
|
||||
// Force HTTPS on future visits (ignored by browsers over plaintext)
|
||||
w.Header().Set("Strict-Transport-Security", HSTSValue)
|
||||
|
||||
// Restrict content sources; frame-ancestors is the primary
|
||||
// clickjacking control, X-Frame-Options the legacy fallback
|
||||
w.Header().Set("Content-Security-Policy", ContentSecurityPolicyValue)
|
||||
|
||||
// Deny browser features pixa does not use
|
||||
w.Header().Set("Permissions-Policy", PermissionsPolicyValue)
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
@@ -56,61 +56,6 @@ func TestSecurityHeaders(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestSecurityHeaders_PolicyHeaders(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := &config.Config{}
|
||||
mw := &Middleware{
|
||||
log: slog.Default(),
|
||||
config: cfg,
|
||||
}
|
||||
|
||||
testHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
})
|
||||
|
||||
handler := mw.SecurityHeaders()(testHandler)
|
||||
|
||||
req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/test", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
handler.ServeHTTP(rec, req)
|
||||
|
||||
tests := []struct {
|
||||
header string
|
||||
want string
|
||||
}{
|
||||
{"Strict-Transport-Security", "max-age=31536000; includeSubDomains"},
|
||||
{
|
||||
"Content-Security-Policy",
|
||||
"default-src 'self'; " +
|
||||
"script-src 'self' 'unsafe-inline'; " +
|
||||
"style-src 'self' 'unsafe-inline'; " +
|
||||
"object-src 'none'; " +
|
||||
"base-uri 'self'; " +
|
||||
"form-action 'self'; " +
|
||||
"frame-ancestors 'none'",
|
||||
},
|
||||
{
|
||||
"Permissions-Policy",
|
||||
"accelerometer=(), autoplay=(), camera=(), " +
|
||||
"display-capture=(), geolocation=(), gyroscope=(), " +
|
||||
"magnetometer=(), microphone=(), payment=(), usb=()",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.header, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
got := rec.Header().Get(tt.header)
|
||||
if got != tt.want {
|
||||
t.Errorf("%s = %q, want %q", tt.header, got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSecurityHeaders_PreservesExistingHeaders(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
|
||||
+1
-5
@@ -17,11 +17,7 @@ run_with_cgo_deps() {
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Running tests..."
|
||||
# Run without -v first for clean output on success; on failure rerun
|
||||
# with -v for full diagnostics, then exit non-zero (REPO_POLICIES.md
|
||||
# conditional-verbose-rerun pattern). The first run already proved the
|
||||
# tests broken, so the build fails even if the rerun happens to pass.
|
||||
run_with_cgo_deps "CGO_ENABLED=1 go test -timeout 30s -race -cover ./... || { echo '--- Rerunning with -v for details ---'; CGO_ENABLED=1 go test -timeout 30s -race -v ./...; exit 1; }"
|
||||
run_with_cgo_deps "CGO_ENABLED=1 go test -timeout 30s -race -v ./..."
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
Reference in New Issue
Block a user