X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=.github%2Fworkflows%2Fmain.yml;h=9a810590012fc60e427d17b11741181b13348abd;hb=20e0040299ede214143fe229ef8121d48c3f73b5;hp=e72c3e228beaf9cec0416e4956e12b78e4bd84d2;hpb=35f1bcd144d0393be68ac7556f3b4c0b606dcfbe;p=kconfig-hardened-check.git diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e72c3e2..9a81059 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,8 +15,8 @@ jobs: max-parallel: 4 fail-fast: false matrix: - python-version: [3.6, 3.7, 3.8] - # github runner with python 3.5 currently fails to install this package + # Current ubuntu-latest (Ubuntu 22.04) provides the following versions of Python: + python-version: ['3.7', '3.8', '3.9', '3.10', '3.11'] steps: @@ -30,13 +30,14 @@ jobs: python -m pip install --upgrade pip pip install coverage pip --verbose install git+https://github.com/a13xp0p0v/kconfig-hardened-check + echo ">>>>> first start <<<<<" kconfig-hardened-check - - name: Check all configs + - name: Check all configs with the installed tool run: | echo ">>>>> check all configs <<<<<" CONFIG_DIR=`find /opt/hostedtoolcache/Python/ -name config_files` - CONFIGS=`find $CONFIG_DIR -type f|grep "\.config"` + CONFIGS=`find $CONFIG_DIR -type f | grep "\.config"` COUNT=0 for C in $CONFIGS do @@ -46,15 +47,19 @@ jobs: done echo -e "\n>>>>> checking $COUNT configs is done <<<<<" - - name: Get source code + - name: Get source code for collecting coverage uses: actions/checkout@v2 - - name: Collect coverage + - name: Collect coverage for the basic functionality run: | + echo ">>>>> get help <<<<<" coverage run -a --branch bin/kconfig-hardened-check coverage run -a --branch bin/kconfig-hardened-check -h + + echo ">>>>> get version <<<<<" coverage run -a --branch bin/kconfig-hardened-check --version + echo ">>>>> print the security hardening preferences <<<<<" coverage run -a --branch bin/kconfig-hardened-check -p X86_64 coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m verbose coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m json @@ -71,24 +76,92 @@ jobs: coverage run -a --branch bin/kconfig-hardened-check -p ARM -m verbose coverage run -a --branch bin/kconfig-hardened-check -p ARM -m json - CONFIG_DIR=`find /opt/hostedtoolcache/Python/ -name config_files` - CONFIGS=`find $CONFIG_DIR -type f|grep "\.config"` + echo ">>>>> use local cmdline as an example <<<<<" + cat /proc/cmdline + + echo ">>>>> check the example kconfig files and cmdline <<<<<" + CONFIG_DIR=`find . -name config_files` + CONFIGS=`find $CONFIG_DIR -type f | grep "\.config"` + COUNT=0 for C in $CONFIGS do + COUNT=$(expr $COUNT + 1) + echo -e "\n>>>>> checking config number $COUNT <<<<<" coverage run -a --branch bin/kconfig-hardened-check -c $C - coverage run -a --branch bin/kconfig-hardened-check -c $C -m verbose - coverage run -a --branch bin/kconfig-hardened-check -c $C -m json - coverage run -a --branch bin/kconfig-hardened-check -c $C -m show_ok - coverage run -a --branch bin/kconfig-hardened-check -c $C -m show_fail + coverage run -a --branch bin/kconfig-hardened-check -c $C -m verbose > /dev/null + coverage run -a --branch bin/kconfig-hardened-check -c $C -l /proc/cmdline + coverage run -a --branch bin/kconfig-hardened-check -c $C -l /proc/cmdline -m verbose > /dev/null + coverage run -a --branch bin/kconfig-hardened-check -c $C -l /proc/cmdline -m json + coverage run -a --branch bin/kconfig-hardened-check -c $C -l /proc/cmdline -m show_ok + coverage run -a --branch bin/kconfig-hardened-check -c $C -l /proc/cmdline -m show_fail done + echo -e "\n>>>>> checking $COUNT configs is done <<<<<" + + - name: Collect coverage for error handling + run: | + echo ">>>>> lonely -l <<<<<" + ! coverage run -a --branch bin/kconfig-hardened-check -l /proc/cmdline + + echo ">>>>> wrong modes for -p <<<<<" + ! coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m show_ok + ! coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m show_fail + + echo ">>>>> -p and -c together <<<<<" + ! coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -c kconfig_hardened_check/config_files/distros/fedora_34.config + + cp kconfig_hardened_check/config_files/distros/fedora_34.config ./test.config + + echo ">>>>> no kernel version <<<<<" + sed '3d' test.config > error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> strange kernel version string <<<<<" + sed '3 s/5./version 5./' test.config > error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> no arch <<<<<" + sed '305d' test.config > error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> more than one arch <<<<<" + cp test.config error.config + echo 'CONFIG_ARM64=y' >> error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> invalid disabled kconfig option <<<<<" + sed '28 s/is not set/is not set yet/' test.config > error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> invalid enabled kconfig option <<<<<" + cp test.config error.config + echo 'CONFIG_FOO=is not set' >> error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> one config option multiple times <<<<<" + cp test.config error.config + echo 'CONFIG_BUG=y' >> error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> invalid compiler versions <<<<<" + cp test.config error.config + sed '8 s/CONFIG_CLANG_VERSION=0/CONFIG_CLANG_VERSION=120000/' test.config > error.config + ! coverage run -a --branch bin/kconfig-hardened-check -c error.config + + echo ">>>>> multi-line cmdline file <<<<<" + echo 'hey man 1' > cmdline + echo 'hey man 2' >> cmdline + ! coverage run -a --branch bin/kconfig-hardened-check -c test.config -l cmdline + + - name: Prepare final coverage report + run: | coverage xml -i -o coverage.xml - name: Handle coverage - uses: codecov/codecov-action@v1 + uses: codecov/codecov-action@v2 with: file: ./coverage.xml flags: functional_test name: codecov-umbrella fail_ci_if_error: true - + verbose: true