wmantly
db2db5095b
Regression guard for bootstrap.js's jump-secrets.js template: its ldap block must use ldaps:// (implicit TLS, :636), not ldap:// (:389), as long as tlsOptions is set alongside it. ldapts treats a non-empty tlsOptions as "use implicit TLS" regardless of URL scheme, and jump-host's LDAP client always sets tlsOptions -- so this exact combination broke every SSH login to jump-host (any account, any password) before being root-caused against a real deployment. Static (parses bootstrap.js as text), not a require()+exec of it -- bootstrap.js is a self-running provisioning script with real side effects (LDAP writes, live API calls), not a library, so there's nothing safe to import and call in CI. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
47 lines
1.1 KiB
YAML
47 lines
1.1 KiB
YAML
name: Lint
|
|
|
|
# theta-env has no app code of its own to unit-test (it orchestrates the
|
|
# proxy/sso-manager-node submodules) -- this checks the one thing that can
|
|
# actually break silently: setup.sh and bootstrap.js, plus a static
|
|
# consistency check on the config bootstrap.js generates for jump-host
|
|
# (test/check_jump_ldap_tls.js).
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
push:
|
|
branches-ignore:
|
|
- master
|
|
|
|
jobs:
|
|
shellcheck:
|
|
name: Shellcheck setup.sh
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Syntax check
|
|
run: bash -n setup.sh
|
|
|
|
- name: Shellcheck
|
|
run: shellcheck -S warning setup.sh
|
|
|
|
bootstrap-syntax:
|
|
name: Syntax check bootstrap.js
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22.x
|
|
|
|
- name: Syntax check
|
|
run: node --check bootstrap/bootstrap.js
|
|
|
|
- name: Jump-host LDAP config consistency
|
|
run: node test/check_jump_ldap_tls.js
|