30 lines
1.2 KiB
TypeScript
30 lines
1.2 KiB
TypeScript
import { readFile } from "node:fs/promises";
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
describe("real Windows Ghidra workflow trust boundary", () => {
|
|
it("runs only default-branch code on the fixed self-hosted environment", async () => {
|
|
const workflow = await readFile(
|
|
new URL("../.github/workflows/real-ghidra-windows.yml", import.meta.url),
|
|
"utf8",
|
|
);
|
|
|
|
expect(workflow).toContain("types: [real-ghidra-windows]");
|
|
expect(workflow).not.toContain("workflow_dispatch:");
|
|
expect(workflow).toContain("contents: read");
|
|
expect(workflow).toContain("if: github.ref == 'refs/heads/main'");
|
|
expect(workflow).toContain("environment: real-ghidra-windows");
|
|
expect(workflow).toContain(
|
|
"runs-on: [self-hosted, Windows, x64, ghidra-12-1-2]",
|
|
);
|
|
expect(workflow).not.toMatch(
|
|
/\$\{\{\s*(?:inputs|github\.event\.(?:inputs|client_payload))\b/u,
|
|
);
|
|
expect(workflow).toContain("REA_ANALYSIS_PROVIDER: ghidra");
|
|
expect(workflow).not.toContain("cache: npm");
|
|
expect(workflow).not.toContain("npm run rebuild:native");
|
|
expect(workflow).toContain("npm run verify:ghidra:windows");
|
|
expect(workflow).toContain("windows-ghidra-proof.log");
|
|
});
|
|
});
|