Skip to content

Commit 3fc61f1

Browse files
dash14dash14
committed
Initial commit
0 parents  commit 3fc61f1

30 files changed

+1477
-0
lines changed

‎.github/workflows/docker-publish.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Build and Push Docker Image
2+
run-name: Build and Push Docker Image (${{ github.ref_name }})
3+
4+
on:
5+
push:
6+
tags:
7+
- "v*.*"
8+
9+
env:
10+
DOCKERHUB_IMAGE: dash14/buildcage
11+
GHCR_IMAGE: ghcr.io/dash14/buildcage
12+
13+
jobs:
14+
build-and-push:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
packages: write
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Set up QEMU
25+
uses: docker/setup-qemu-action@v3
26+
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@v3
29+
30+
- name: Extract metadata
31+
id: meta
32+
uses: docker/metadata-action@v5
33+
with:
34+
images: |
35+
${{ env.DOCKERHUB_IMAGE }}
36+
${{ env.GHCR_IMAGE }}
37+
tags: |
38+
type=semver,pattern={{version}}
39+
type=semver,pattern={{major}}.{{minor}}
40+
type=semver,pattern={{major}}
41+
type=raw,value=latest
42+
43+
- name: Login to Docker Hub
44+
uses: docker/login-action@v3
45+
with:
46+
username: ${{ secrets.DOCKERHUB_USERNAME }}
47+
password: ${{ secrets.DOCKERHUB_TOKEN }}
48+
49+
- name: Login to GHCR
50+
uses: docker/login-action@v3
51+
with:
52+
registry: ghcr.io
53+
username: ${{ github.actor }}
54+
password: ${{ secrets.GITHUB_TOKEN }}
55+
56+
- name: Build and push
57+
uses: docker/build-push-action@v6
58+
with:
59+
context: docker
60+
platforms: linux/amd64,linux/arm64
61+
push: true
62+
tags: ${{ steps.meta.outputs.tags }}
63+
labels: ${{ steps.meta.outputs.labels }}

‎.github/workflows/example-audit.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Example (audit mode)
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Start buildcage builder
12+
id: buildcage
13+
uses: dash14/buildcage/setup@v1
14+
with:
15+
proxy_mode: audit
16+
17+
- name: Set up Docker Buildx
18+
uses: docker/setup-buildx-action@v3
19+
with:
20+
driver: remote
21+
endpoint: ${{ steps.buildcage.outputs.endpoint }}
22+
23+
- name: Create test Dockerfile
24+
run: |
25+
mkdir -p /tmp/build-context
26+
cat <<'EOF' > /tmp/build-context/Dockerfile
27+
FROM node:24-alpine
28+
WORKDIR /app
29+
RUN npm init -y && npm install express
30+
EOF
31+
32+
- name: Build test image
33+
uses: docker/build-push-action@v6
34+
with:
35+
context: /tmp/build-context
36+
push: false
37+
no-cache: true
38+
39+
- name: Show proxy report
40+
if: always()
41+
uses: dash14/buildcage/report@v1

‎.github/workflows/example-restrict.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Example (restrict mode)
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Start buildcage builder
12+
id: buildcage
13+
uses: dash14/buildcage/setup@v1
14+
with:
15+
proxy_mode: restrict
16+
allowed_https_domains: registry.npmjs.org
17+
18+
- name: Set up Docker Buildx
19+
uses: docker/setup-buildx-action@v3
20+
with:
21+
driver: remote
22+
endpoint: ${{ steps.buildcage.outputs.endpoint }}
23+
24+
- name: Create test Dockerfile
25+
run: |
26+
mkdir -p /tmp/build-context
27+
cat <<'EOF' > /tmp/build-context/Dockerfile
28+
FROM node:24-alpine
29+
WORKDIR /app
30+
RUN npm init -y && npm install express
31+
RUN wget -q -O /dev/null --timeout=5 https://example.com/ || true
32+
EOF
33+
34+
- name: Build test image
35+
uses: docker/build-push-action@v6
36+
with:
37+
context: /tmp/build-context
38+
push: false
39+
no-cache: true
40+
41+
- name: Show proxy report
42+
if: always()
43+
uses: dash14/buildcage/report@v1
44+
with:
45+
fail_on_blocked: false

‎.github/workflows/test.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Test
2+
run-name: Test (${{ github.ref_name }})
3+
4+
on:
5+
workflow_dispatch:
6+
7+
# push:
8+
# branches:
9+
# - main
10+
# pull_request:
11+
# branches:
12+
# - main
13+
14+
jobs:
15+
test:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
include:
24+
- mode: audit
25+
proxy_mode: audit
26+
test_dockerfile: test/Dockerfile.audit
27+
assert_script: ./test/assert-audit-mode.sh
28+
- mode: restrict
29+
proxy_mode: restrict
30+
test_dockerfile: test/Dockerfile.restrict
31+
assert_script: ./test/assert-restrict-mode.sh
32+
33+
name: test (${{ matrix.mode }})
34+
35+
env:
36+
COMPOSE_FILE: compose.yml:compose.test.yml
37+
38+
steps:
39+
- name: Checkout
40+
uses: actions/checkout@v4
41+
42+
- name: Build containers
43+
run: docker compose build
44+
45+
- name: Start containers
46+
env:
47+
PROXY_MODE: ${{ matrix.proxy_mode }}
48+
run: docker compose up -d --wait
49+
50+
- name: Set up Docker Buildx
51+
uses: docker/setup-buildx-action@v3
52+
with:
53+
driver: remote
54+
endpoint: tcp://localhost:1234
55+
56+
- name: Build test image
57+
uses: docker/build-push-action@v6
58+
with:
59+
context: test
60+
file: ${{ matrix.test_dockerfile }}
61+
push: false
62+
no-cache: true
63+
load: true
64+
tags: buildcage-test
65+
66+
- name: Show logs
67+
if: always()
68+
run: ./report/report.sh || true
69+
70+
- name: Run assertions
71+
run: ${{ matrix.assert_script }}
72+
73+
- name: Cleanup
74+
if: always()
75+
run: docker compose down -v --rmi all 2>/dev/null || true

‎.github/workflows/update-major-tag.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Update major version tag
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
permissions:
8+
contents: write
9+
10+
jobs:
11+
update-tag:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Checkout
15+
uses: actions/checkout@v4
16+
17+
- name: Extract major version
18+
id: version
19+
run: |
20+
TAG="${GITHUB_REF_NAME}" # e.g. v0.0.2
21+
MAJOR="${TAG%%.*}" # e.g. v0
22+
echo "major=$MAJOR" >> "$GITHUB_OUTPUT"
23+
24+
- name: Update major version tag
25+
run: |
26+
git tag -fa "${{ steps.version.outputs.major }}" -m "Update ${{ steps.version.outputs.major }} to ${{ github.ref_name }}"
27+
git push origin "${{ steps.version.outputs.major }}" --force

‎Makefile‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
COMPOSE_FILE ?= compose.yml
2+
3+
# Self-Documented Makefile
4+
.PHONY: help
5+
help:
6+
@grep -E '^[a-zA-Z_0-9-]+(-%)?:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
7+
8+
clean: ## Clean up all resources
9+
@echo "Stopping and removing all containers..."
10+
@docker buildx rm buildcage 2>/dev/null || true
11+
@docker compose -f compose.yml -f compose.test.yml down -v --rmi all
12+
@docker rmi buildcage-test 2>/dev/null || true
13+
14+
run_audit_mode: ## Start in audit mode
15+
@echo "Starting buildcage in AUDIT mode..."
16+
@COMPOSE_FILE=$(COMPOSE_FILE) \
17+
PROXY_MODE=audit \
18+
ALLOWED_HTTP_DOMAINS="" \
19+
ALLOWED_HTTPS_DOMAINS="" \
20+
docker compose up -d --wait --build
21+
@docker buildx rm buildcage 2>/dev/null || true
22+
@echo "Creating buildx builder..."
23+
@docker buildx create --bootstrap \
24+
--name buildcage \
25+
--driver remote tcp://localhost:1234
26+
27+
run_restrict_mode: ## Start in restrict mode
28+
@echo "Starting buildcage in RESTRICT mode..."
29+
@COMPOSE_FILE=$(COMPOSE_FILE) \
30+
PROXY_MODE=restrict \
31+
ALLOWED_HTTP_DOMAINS="$${ALLOWED_HTTP_DOMAINS:-}" \
32+
ALLOWED_HTTPS_DOMAINS="$${ALLOWED_HTTPS_DOMAINS:-github.com,registry.npmjs.org,api.github.com,objects.githubusercontent.com,httpbin.org,deb.debian.org,*.githubusercontent.com}" \
33+
docker compose up -d --wait --build
34+
@docker buildx rm buildcage 2>/dev/null || true
35+
@echo "Creating buildx builder..."
36+
@docker buildx create --bootstrap \
37+
--name buildcage \
38+
--driver remote tcp://localhost:1234
39+
40+
.PHONY: test_restrict_mode
41+
test_restrict_mode: ## Run restrict mode tests
42+
@echo "Running restrict mode tests..."
43+
@COMPOSE_FILE=compose.yml:compose.test.yml \
44+
$(MAKE) run_restrict_mode
45+
@docker buildx build --no-cache \
46+
--builder buildcage \
47+
--platform linux/arm64 \
48+
--progress=plain -f test/Dockerfile.restrict test/ \
49+
--load -t buildcage-test
50+
@./report/report.sh || true
51+
@./test/assert-restrict-mode.sh
52+
@$(MAKE) clean
53+
54+
.PHONY: test_audit_mode
55+
test_audit_mode: ## Run audit mode tests
56+
@echo "Running audit mode tests..."
57+
@COMPOSE_FILE=compose.yml:compose.test.yml \
58+
$(MAKE) run_audit_mode
59+
@docker buildx build --no-cache \
60+
--builder buildcage \
61+
--platform linux/arm64 \
62+
--progress=plain -f test/Dockerfile.audit test/ \
63+
--load -t buildcage-test
64+
@./report/report.sh || true
65+
@./test/assert-audit-mode.sh
66+
@$(MAKE) clean

0 commit comments

Comments
 (0)
⚡