neil/cache
1
0
Fork 0
mirror of https://github.com/actions/cache.git synced 2026-01-30 07:54:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Use shared volume between job container and squid service for log access

Browse Source
This commit is contained in:
Bassem Dghaidi 2026-01-29 09:04:33 -08:00 committed by GitHub
parent ef4c2110b5
commit 56cc052f4d
1 changed files with 46 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
.github/workflows/workflow.yml vendored
View File

@ -91,14 +91,15 @@ jobs:
container: container:
image: ubuntu:latest image: ubuntu:latest
options: --privileged options: --privileged
volumes:
- /tmp/squid-logs:/shared-logs
services: services:
squid-proxy: squid-proxy:
image: ubuntu/squid:latest image: ubuntu/squid:latest
ports: ports:
- 3128:3128 - 3128:3128
env: volumes:
http_proxy: http://squid-proxy:3128 - /tmp/squid-logs:/var/log/squid
https_proxy: http://squid-proxy:3128
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@v5
@ -107,6 +108,9 @@ jobs:
apt-get update apt-get update
apt-get install -y iptables dnsutils curl jq ipset apt-get install -y iptables dnsutils curl jq ipset
- name: Fetch GitHub meta and configure firewall - name: Fetch GitHub meta and configure firewall
env:
http_proxy: http://squid-proxy:3128
https_proxy: http://squid-proxy:3128
run: | run: |
# Fetch GitHub meta API to get all IP ranges # Fetch GitHub meta API to get all IP ranges
echo "Fetching GitHub meta API..." echo "Fetching GitHub meta API..."
@ -173,6 +177,9 @@ jobs:
echo "" echo ""
echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries" echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries"
- name: Verify proxy enforcement - name: Verify proxy enforcement
env:
http_proxy: http://squid-proxy:3128
https_proxy: http://squid-proxy:3128
run: | run: |
echo "=== Testing proxy enforcement ===" echo "=== Testing proxy enforcement ==="
@ -205,6 +212,9 @@ jobs:
- name: Generate files - name: Generate files
run: __tests__/create-cache-files.sh proxy test-cache run: __tests__/create-cache-files.sh proxy test-cache
- name: Save cache - name: Save cache
env:
http_proxy: http://squid-proxy:3128
https_proxy: http://squid-proxy:3128
uses: ./ uses: ./
with: with:
key: test-proxy-${{ github.run_id }} key: test-proxy-${{ github.run_id }}
@ -213,22 +223,18 @@ jobs:
run: | run: |
echo "=== Verifying cache traffic went through proxy ===" echo "=== Verifying cache traffic went through proxy ==="
# Get the squid container ID # Read from shared volume where squid logs are mounted
SQUID_CONTAINER=$(docker ps --filter "ancestor=ubuntu/squid:latest" --format "{{.ID}}" | head -1) SQUID_LOG="/shared-logs/access.log"
if [ -z "$SQUID_CONTAINER" ]; then
SQUID_CONTAINER=$(docker ps --format "{{.ID}}\t{{.Image}}" | grep squid | cut -f1)
fi
# Initialize summary # Initialize summary
echo "## 🔒 Proxy Traffic Verification - Cache Save" >> $GITHUB_STEP_SUMMARY echo "## 🔒 Proxy Traffic Verification - Cache Save" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY
if [ -n "$SQUID_CONTAINER" ]; then if [ -f "$SQUID_LOG" ]; then
echo "Found Squid container: $SQUID_CONTAINER" echo "Found Squid access log at $SQUID_LOG"
# Get the full access log # Get the full access log
ACCESS_LOG=$(docker exec "$SQUID_CONTAINER" cat /var/log/squid/access.log 2>/dev/null || echo "") ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "")
# Extract traffic details # Extract traffic details
RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true) RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true)
@ -315,10 +321,12 @@ jobs:
echo "Blob storage requests: $BLOB_COUNT" echo "Blob storage requests: $BLOB_COUNT"
echo "Verification status: $VERIFY_STATUS" echo "Verification status: $VERIFY_STATUS"
else else
echo "⚠️ **WARNING**: Could not access Squid proxy container logs" >> $GITHUB_STEP_SUMMARY echo "⚠️ **WARNING**: Could not access Squid proxy logs" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY
echo "This may occur when service containers are isolated from the job container." >> $GITHUB_STEP_SUMMARY echo "The shared log volume may not be accessible at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY
echo "Could not access squid container logs" echo "Checking what's in /shared-logs/:"
ls -la /shared-logs/ || echo "Directory not accessible"
echo "Could not access squid access log at $SQUID_LOG"
fi fi
test-proxy-restore: test-proxy-restore:
@ -327,14 +335,15 @@ jobs:
container: container:
image: ubuntu:latest image: ubuntu:latest
options: --privileged options: --privileged
volumes:
- /tmp/squid-logs:/shared-logs
services: services:
squid-proxy: squid-proxy:
image: ubuntu/squid:latest image: ubuntu/squid:latest
ports: ports:
- 3128:3128 - 3128:3128
env: volumes:
http_proxy: http://squid-proxy:3128 - /tmp/squid-logs:/var/log/squid
https_proxy: http://squid-proxy:3128
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@v5
@ -343,6 +352,9 @@ jobs:
apt-get update apt-get update
apt-get install -y iptables dnsutils curl jq ipset apt-get install -y iptables dnsutils curl jq ipset
- name: Fetch GitHub meta and configure firewall - name: Fetch GitHub meta and configure firewall
env:
http_proxy: http://squid-proxy:3128
https_proxy: http://squid-proxy:3128
run: | run: |
# Fetch GitHub meta API to get all IP ranges # Fetch GitHub meta API to get all IP ranges
echo "Fetching GitHub meta API..." echo "Fetching GitHub meta API..."
@ -409,6 +421,9 @@ jobs:
echo "" echo ""
echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries" echo "ipset github-ips contains $(ipset list github-ips | grep -c '^[0-9]') entries"
- name: Verify proxy enforcement - name: Verify proxy enforcement
env:
http_proxy: http://squid-proxy:3128
https_proxy: http://squid-proxy:3128
run: | run: |
echo "=== Testing proxy enforcement ===" echo "=== Testing proxy enforcement ==="
@ -439,6 +454,9 @@ jobs:
echo "Note: Proxy connection may have failed, but that's OK if it's not a network block" echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
fi fi
- name: Restore cache - name: Restore cache
env:
http_proxy: http://squid-proxy:3128
https_proxy: http://squid-proxy:3128
uses: ./ uses: ./
with: with:
key: test-proxy-${{ github.run_id }} key: test-proxy-${{ github.run_id }}
@ -447,22 +465,18 @@ jobs:
run: | run: |
echo "=== Verifying cache restore traffic went through proxy ===" echo "=== Verifying cache restore traffic went through proxy ==="
# Get the squid container ID # Read from shared volume where squid logs are mounted
SQUID_CONTAINER=$(docker ps --filter "ancestor=ubuntu/squid:latest" --format "{{.ID}}" | head -1) SQUID_LOG="/shared-logs/access.log"
if [ -z "$SQUID_CONTAINER" ]; then
SQUID_CONTAINER=$(docker ps --format "{{.ID}}\t{{.Image}}" | grep squid | cut -f1)
fi
# Initialize summary # Initialize summary
echo "## 🔒 Proxy Traffic Verification - Cache Restore" >> $GITHUB_STEP_SUMMARY echo "## 🔒 Proxy Traffic Verification - Cache Restore" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY
if [ -n "$SQUID_CONTAINER" ]; then if [ -f "$SQUID_LOG" ]; then
echo "Found Squid container: $SQUID_CONTAINER" echo "Found Squid access log at $SQUID_LOG"
# Get the full access log # Get the full access log
ACCESS_LOG=$(docker exec "$SQUID_CONTAINER" cat /var/log/squid/access.log 2>/dev/null || echo "") ACCESS_LOG=$(cat "$SQUID_LOG" 2>/dev/null || echo "")
# Extract traffic details # Extract traffic details
RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true) RESULTS_RECEIVER_LINES=$(echo "$ACCESS_LOG" | grep -i "results-receiver" || true)
@ -548,10 +562,12 @@ jobs:
echo "Blob storage requests: $BLOB_COUNT" echo "Blob storage requests: $BLOB_COUNT"
echo "Verification status: $VERIFY_STATUS" echo "Verification status: $VERIFY_STATUS"
else else
echo "⚠️ **WARNING**: Could not access Squid proxy container logs" >> $GITHUB_STEP_SUMMARY echo "⚠️ **WARNING**: Could not access Squid proxy logs" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY
echo "This may occur when service containers are isolated from the job container." >> $GITHUB_STEP_SUMMARY echo "The shared log volume may not be accessible at $SQUID_LOG" >> $GITHUB_STEP_SUMMARY
echo "Could not access squid container logs" echo "Checking what's in /shared-logs/:"
ls -la /shared-logs/ || echo "Directory not accessible"
echo "Could not access squid access log at $SQUID_LOG"
fi fi
- name: Verify cache - name: Verify cache
run: __tests__/verify-cache-files.sh proxy test-cache run: __tests__/verify-cache-files.sh proxy test-cache