Skip to content

Commit a197a47

Browse files
EnricoMiEnricoMi
authored
Add option to verify SSL/TLS connection (#638)
Fixes #637.
1 parent e2824a5 commit a197a47

13 files changed

Lines changed: 61 additions & 1 deletion

File tree

‎.github/workflows/publish.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,7 @@ jobs:
109109
-e "INPUT_GITHUB_TOKEN" \
110110
-e "INPUT_GITHUB_TOKEN_ACTOR" \
111111
-e "INPUT_GITHUB_RETRIES" \
112+
-e "INPUT_SSL_VERIFY" \
112113
-e "INPUT_COMMIT" \
113114
-e "INPUT_COMMENT_TITLE" \
114115
-e "INPUT_COMMENT_MODE" \

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,7 @@ The list of most notable options:
311311
|`github_token`|`${{github.token}}`|An alternative GitHub token, other than the default provided by GitHub Actions runner.|
312312
|`github_token_actor`|`github-actions`|The name of the GitHub app that owns the GitHub API Access Token (see github_token). Used to identify pull request comments created by this action during earlier runs. Has to be set when `github_token` is set to a GitHub app installation token (other than GitHub actions). Otherwise, existing comments will not be updated, but new comments created. Note: this does not change the bot name of the pull request comments.|
313313
|`github_retries`|`10`|Requests to the GitHub API are retried this number of times. The value must be a positive integer or zero.|
314+
|`ssl_verify`|`true`|Either `true` or `false`, in which case it controls whether to verify the Github server’s TLS certificate, or a string, in which case it must be a path to a CA bundle to use. Default is `true`.|
314315
|`seconds_between_github_reads`|`0.25`|Sets the number of seconds the action waits between concurrent read requests to the GitHub API.|
315316
|`seconds_between_github_writes`|`2.0`|Sets the number of seconds the action waits between concurrent write requests to the GitHub API.|
316317
|`secondary_rate_limit_wait_seconds`|`60.0`|Sets the number of seconds to wait before retrying secondary rate limit errors. If not set, the default defined in the PyGithub library is used (currently 60 seconds).|

‎action.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ inputs:
1515
description: 'Requests to the GitHub API are retried this number of times. The value must be a positive integer or zero.'
1616
default: '10'
1717
required: false
18+
ssl_verify:
19+
description: 'Either "true" or "false", in which case it controls whether to verify the Github server’s TLS certificate, or a string, in which case it must be a path to a CA bundle to use. Default is "true".'
20+
default: true
21+
required: false
1822
commit:
1923
description: 'Commit SHA to which test results are published. Only needed if the value of GITHUB_SHA does not work for you.'
2024
required: false

‎composite/action.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ inputs:
1515
description: 'Requests to the GitHub API are retried this number of times. The value must be a positive integer or zero.'
1616
default: '10'
1717
required: false
18+
ssl_verify:
19+
description: 'Either "true" or "false", in which case it controls whether to verify the Github server’s TLS certificate, or a string, in which case it must be a path to a CA bundle to use. Default is "true".'
20+
default: true
21+
required: false
1822
commit:
1923
description: 'Commit SHA to which test results are published. Only needed if the value of GITHUB_SHA does not work for you.'
2024
required: false
@@ -286,6 +290,7 @@ runs:
286290
GITHUB_TOKEN: ${{ inputs.github_token }}
287291
GITHUB_TOKEN_ACTOR: ${{ inputs.github_token_actor }}
288292
GITHUB_RETRIES: ${{ inputs.github_retries }}
293+
SSL_VERIFY: ${{ inputs.ssl_verify }}
289294
COMMIT: ${{ inputs.commit }}
290295
CHECK_NAME: ${{ inputs.check_name }}
291296
COMMENT_TITLE: ${{ inputs.comment_title }}

‎linux/action.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ inputs:
1515
description: 'Requests to the GitHub API are retried this number of times. The value must be a positive integer or zero.'
1616
default: '10'
1717
required: false
18+
ssl_verify:
19+
description: 'Either "true" or "false", in which case it controls whether to verify the Github server’s TLS certificate, or a string, in which case it must be a path to a CA bundle to use. Default is "true".'
20+
default: true
21+
required: false
1822
commit:
1923
description: 'Commit SHA to which test results are published. Only needed if the value of GITHUB_SHA does not work for you.'
2024
required: false
@@ -251,6 +255,7 @@ runs:
251255
GITHUB_TOKEN: ${{ inputs.github_token }}
252256
GITHUB_TOKEN_ACTOR: ${{ inputs.github_token_actor }}
253257
GITHUB_RETRIES: ${{ inputs.github_retries }}
258+
SSL_VERIFY: ${{ inputs.ssl_verify }}
254259
COMMIT: ${{ inputs.commit }}
255260
CHECK_NAME: ${{ inputs.check_name }}
256261
COMMENT_TITLE: ${{ inputs.comment_title }}

‎macos/action.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ inputs:
1515
description: 'Requests to the GitHub API are retried this number of times. The value must be a positive integer or zero.'
1616
default: '10'
1717
required: false
18+
ssl_verify:
19+
description: 'Either "true" or "false", in which case it controls whether to verify the Github server’s TLS certificate, or a string, in which case it must be a path to a CA bundle to use. Default is "true".'
20+
default: true
21+
required: false
1822
commit:
1923
description: 'Commit SHA to which test results are published. Only needed if the value of GITHUB_SHA does not work for you.'
2024
required: false
@@ -251,6 +255,7 @@ runs:
251255
GITHUB_TOKEN: ${{ inputs.github_token }}
252256
GITHUB_TOKEN_ACTOR: ${{ inputs.github_token_actor }}
253257
GITHUB_RETRIES: ${{ inputs.github_retries }}
258+
SSL_VERIFY: ${{ inputs.ssl_verify }}
254259
COMMIT: ${{ inputs.commit }}
255260
CHECK_NAME: ${{ inputs.check_name }}
256261
COMMENT_TITLE: ${{ inputs.comment_title }}

‎python/publish/publisher.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
from __future__ import annotations
2+
13
import dataclasses
24
import json
35
import logging
@@ -34,6 +36,7 @@ class Settings:
3436
api_url: str
3537
graphql_url: str
3638
api_retries: int
39+
ssl_verify: bool | str
3740
event: dict
3841
event_file: Optional[str]
3942
event_name: str

‎python/publish_test_results.py‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
from __future__ import annotations
2+
13
import json
24
import logging
35
import os
@@ -40,6 +42,7 @@ def get_conclusion(parsed: ParsedUnitTestResults, fail_on_failures, fail_on_erro
4042

4143
def get_github(auth: github.Auth,
4244
url: str,
45+
verify: bool | str,
4346
retries: int,
4447
backoff_factor: float,
4548
seconds_between_requests: Optional[float],
@@ -51,6 +54,7 @@ def get_github(auth: github.Auth,
5154
return github.Github(auth=auth,
5255
base_url=url,
5356
per_page=100,
57+
verify=verify,
5458
retry=retry,
5559
seconds_between_requests=seconds_between_requests,
5660
seconds_between_writes=seconds_between_writes)
@@ -262,6 +266,7 @@ def main(settings: Settings, gha: GithubAction) -> None:
262266
gh = get_github(auth=github.Auth.Token(settings.token),
263267
url=settings.api_url,
264268
retries=settings.api_retries,
269+
verify=settings.ssl_verify,
265270
backoff_factor=backoff_factor,
266271
seconds_between_requests=settings.seconds_between_github_reads,
267272
seconds_between_writes=settings.seconds_between_github_writes,
@@ -409,6 +414,11 @@ def get_settings(options: dict, gha: GithubAction) -> Settings:
409414

410415
api_url = options.get('GITHUB_API_URL') or github.Consts.DEFAULT_BASE_URL
411416
graphql_url = options.get('GITHUB_GRAPHQL_URL') or f'{github.Consts.DEFAULT_BASE_URL}/graphql'
417+
ssl_verify_str = get_var('SSL_VERIFY', options) or 'True'
418+
if ssl_verify_str.lower() in ['true', 'false']:
419+
ssl_verify = ssl_verify_str.lower() == 'true'
420+
else:
421+
ssl_verify = ssl_verify_str
412422
test_changes_limit = get_var('TEST_CHANGES_LIMIT', options) or '10'
413423
check_var_condition(test_changes_limit.isnumeric(), f'TEST_CHANGES_LIMIT must be a positive integer or 0: {test_changes_limit}')
414424

@@ -451,6 +461,7 @@ def get_settings(options: dict, gha: GithubAction) -> Settings:
451461
actor=get_var('GITHUB_TOKEN_ACTOR', options) or 'github-actions',
452462
api_url=api_url,
453463
graphql_url=graphql_url,
464+
ssl_verify=ssl_verify,
454465
api_retries=int(retries),
455466
event=event,
456467
event_file=event_file,

‎python/test/test_action_script.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
from __future__ import annotations
2+
13
import io
24
import json
35
import os
@@ -164,6 +166,7 @@ def get_settings(token='token',
164166
api_url='http://github.api.url/',
165167
graphql_url='http://github.graphql.url/',
166168
retries=2,
169+
ssl_verify: bool | str=True,
167170
event={},
168171
event_file=None,
169172
event_name='event name',
@@ -210,6 +213,7 @@ def get_settings(token='token',
210213
api_url=api_url,
211214
graphql_url=graphql_url,
212215
api_retries=retries,
216+
ssl_verify=ssl_verify,
213217
event=event.copy(),
214218
event_file=event_file,
215219
event_name=event_name,
@@ -302,6 +306,16 @@ def test_get_settings_github_retries(self):
302306
self.do_test_get_settings(GITHUB_RETRIES=retries, expected=None)
303307
self.assertIn(f'GITHUB_RETRIES must be a positive integer or 0: {retries}', re.exception.args)
304308

309+
def test_get_settings_github_ssl_verify(self):
310+
self.do_test_get_settings(SSL_VERIFY='true', expected=self.get_settings(ssl_verify=True))
311+
self.do_test_get_settings(SSL_VERIFY='True', expected=self.get_settings(ssl_verify=True))
312+
self.do_test_get_settings(SSL_VERIFY='TrUe', expected=self.get_settings(ssl_verify=True))
313+
self.do_test_get_settings(SSL_VERIFY='false', expected=self.get_settings(ssl_verify=False))
314+
self.do_test_get_settings(SSL_VERIFY='False', expected=self.get_settings(ssl_verify=False))
315+
self.do_test_get_settings(SSL_VERIFY='FaLsE', expected=self.get_settings(ssl_verify=False))
316+
self.do_test_get_settings(SSL_VERIFY='/path/to/cert', expected=self.get_settings(ssl_verify='/path/to/cert'))
317+
self.do_test_get_settings(SSL_VERIFY=None, expected=self.get_settings(ssl_verify=True))
318+
305319
def test_get_settings_any_files(self):
306320
for files in [None, 'file']:
307321
for junit in [None, 'junit-file']:

‎python/test/test_github.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ class TestGitHub(unittest.TestCase):
2121

2222
base_url = f'http://localhost:12380/api'
2323
auth = github.Auth.Token('login or token')
24-
gh = get_github(auth, base_url, retries=1, backoff_factor=0.1, seconds_between_requests=None, seconds_between_writes=None, secondary_rate_wait=3)
24+
gh = get_github(auth, base_url, verify=True, retries=1, backoff_factor=0.1, seconds_between_requests=None, seconds_between_writes=None, secondary_rate_wait=3)
2525

2626
@classmethod
2727
def start_api(cls, app: Flask) -> Process:

0 commit comments

Comments
 (0)