unclecode
60886d1a0c
Squash of security/docker-hardening-2026-06 (the full R1-R7 redesign) plus the three new 0.9.0 security fixes (download path traversal, streaming-path SSRF, extra_args RCE) and uniform egress pinning across all browser-fetch endpoints. Version 0.9.0. Supersedes the 0.8.8/0.8.9 non-breaking patches with their breaking-by-design variants; the 0.8.8/0.8.9 CHANGELOG and credit ledger entries are preserved. The old exec-based hook_manager.py is removed in favor of declarative hook_registry.py. Security suite: 309 passed, 1 xfailed. See deploy/docker/MIGRATION.md for the breaking-change migration guide.
66 lines
1.8 KiB
YAML
66 lines
1.8 KiB
YAML
name: Security
|
|
|
|
# Runs the offline Docker-server security suite: behavioral tests for the
|
|
# secure-by-default posture (R1-R7). No network, browser, Redis or Docker needed
|
|
# - it boots the app via TestClient and monkeypatches DNS, so it is fast
|
|
# (~seconds) and deterministic.
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop, "security/**"]
|
|
paths:
|
|
- "deploy/docker/**"
|
|
- "crawl4ai/async_configs.py"
|
|
- ".github/workflows/security.yml"
|
|
pull_request:
|
|
paths:
|
|
- "deploy/docker/**"
|
|
- "crawl4ai/async_configs.py"
|
|
- ".github/workflows/security.yml"
|
|
|
|
jobs:
|
|
security-offline:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.10"
|
|
cache: pip
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -e .
|
|
pip install -r deploy/docker/requirements.txt
|
|
pip install pytest pytest-asyncio
|
|
|
|
- name: Run security suite
|
|
run: |
|
|
pytest deploy/docker/tests/test_security_*.py -q
|
|
|
|
posture-gate:
|
|
# The headline secure-by-default acceptance gate, isolated so it can be a
|
|
# required status check. xfail-marked items (e.g. the build-gated
|
|
# --no-sandbox removal) do not fail this job.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.10"
|
|
cache: pip
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -e .
|
|
pip install -r deploy/docker/requirements.txt
|
|
pip install pytest pytest-asyncio
|
|
|
|
- name: Default-posture gate
|
|
run: |
|
|
pytest deploy/docker/tests/test_security_default_posture.py -q
|