Skip to content

Commit c6703e7

Browse files
jdaltonjdalton
committed
feat(ci): add sfw-enterprise support when SOCKET_API_KEY is provided
When SOCKET_API_KEY secret is set, downloads sfw-enterprise from SocketDev/firewall-release instead of sfw-free. The SSL workaround (GIT_SSL_NO_VERIFY) is only applied for sfw-free.
1 parent 6b8d507 commit c6703e7

1 file changed

Lines changed: 44 additions & 16 deletions

File tree

‎.github/workflows/setup-and-install.yml‎

Lines changed: 44 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
required: false
1313
type: string
1414
default: '.'
15+
secrets:
16+
SOCKET_API_KEY:
17+
description: 'Socket API key — when provided, uses sfw-enterprise instead of sfw-free'
18+
required: false
1519
jobs:
1620
setup-and-install:
1721
runs-on: ubuntu-latest
@@ -62,25 +66,43 @@ jobs:
6266
with:
6367
node-version: ${{ inputs.node-version }}
6468

65-
- name: Download sfw-free
69+
- name: Download sfw
6670
shell: bash
6771
env:
6872
GH_TOKEN: ${{ github.token }}
73+
SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env]
6974
run: | # zizmor: ignore[github-env]
7075
SFW_DIR="${RUNNER_TEMP:-/tmp}/sfw-bin"
7176
KERNEL="$(uname -s | cut -d- -f1)"
7277
ARCH="$(uname -m)"
73-
case "${KERNEL}-${ARCH}" in
74-
Linux-x86_64) ASSET="sfw-free-linux-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff" ;;
75-
Linux-aarch64) ASSET="sfw-free-linux-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1" ;;
76-
Darwin-x86_64) ASSET="sfw-free-macos-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566" ;;
77-
Darwin-arm64) ASSET="sfw-free-macos-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555" ;;
78-
MINGW64_NT-x86_64|MSYS_NT-x86_64) ASSET="sfw-free-windows-x86_64.exe" ; SFW_BIN="$SFW_DIR/sfw.exe" ; EXPECTED_SHA256="c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af" ;;
79-
*) echo "Unsupported platform: ${KERNEL}-${ARCH}" >&2; exit 1 ;;
80-
esac
78+
USE_ENTERPRISE=false
79+
if [ -n "$SOCKET_API_KEY" ]; then
80+
USE_ENTERPRISE=true
81+
fi
82+
if $USE_ENTERPRISE; then
83+
REPO="SocketDev/firewall-release"
84+
case "${KERNEL}-${ARCH}" in
85+
Linux-x86_64) ASSET="sfw-linux-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="9115b4ca8021eb173eb9e9c3627deb7f1066f8debd48c5c9d9f3caabb2a26a4b" ;;
86+
Linux-aarch64) ASSET="sfw-linux-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="671270231617142404a1564e52672f79b806f9df3f232fcc7606329c0246da55" ;;
87+
Darwin-x86_64) ASSET="sfw-macos-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="01d64d40effda35c31f8d8ee1fed1388aac0a11aba40d47fba8a36024b77500c" ;;
88+
Darwin-arm64) ASSET="sfw-macos-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="acad0b517601bb7408e2e611c9226f47dcccbd83333d7fc5157f1d32ed2b953d" ;;
89+
MINGW64_NT-x86_64|MSYS_NT-x86_64) ASSET="sfw-windows-x86_64.exe" ; SFW_BIN="$SFW_DIR/sfw.exe" ; EXPECTED_SHA256="9a50e1ddaf038138c3f85418dc5df0113bbe6fc884f5abe158beaa9aea18d70a" ;;
90+
*) echo "Unsupported platform: ${KERNEL}-${ARCH}" >&2; exit 1 ;;
91+
esac
92+
else
93+
REPO="SocketDev/sfw-free"
94+
case "${KERNEL}-${ARCH}" in
95+
Linux-x86_64) ASSET="sfw-free-linux-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff" ;;
96+
Linux-aarch64) ASSET="sfw-free-linux-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1" ;;
97+
Darwin-x86_64) ASSET="sfw-free-macos-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566" ;;
98+
Darwin-arm64) ASSET="sfw-free-macos-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555" ;;
99+
MINGW64_NT-x86_64|MSYS_NT-x86_64) ASSET="sfw-free-windows-x86_64.exe" ; SFW_BIN="$SFW_DIR/sfw.exe" ; EXPECTED_SHA256="c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af" ;;
100+
*) echo "Unsupported platform: ${KERNEL}-${ARCH}" >&2; exit 1 ;;
101+
esac
102+
fi
81103
if [ ! -x "$SFW_BIN" ]; then
82104
mkdir -p "$SFW_DIR"
83-
DOWNLOAD_URL="$(gh api repos/SocketDev/sfw-free/releases/latest \
105+
DOWNLOAD_URL="$(gh api "repos/${REPO}/releases/latest" \
84106
--jq ".assets[] | select(.name == \"$ASSET\") | .browser_download_url")"
85107
curl -fsSL -o "$SFW_BIN" "$DOWNLOAD_URL"
86108
ACTUAL_SHA256="$( (sha256sum "$SFW_BIN" 2>/dev/null || shasum -a 256 "$SFW_BIN") | cut -d' ' -f1 | tr -d '\\')"
@@ -94,6 +116,10 @@ jobs:
94116
chmod +x "$SFW_BIN"
95117
fi
96118
echo "SFW_BIN=$SFW_BIN" >> "${GITHUB_ENV:-/dev/null}"
119+
echo "SFW_IS_ENTERPRISE=$USE_ENTERPRISE" >> "${GITHUB_ENV:-/dev/null}"
120+
if $USE_ENTERPRISE; then
121+
echo "SOCKET_API_KEY=$SOCKET_API_KEY" >> "${GITHUB_ENV:-/dev/null}"
122+
fi
97123
98124
- name: Create sfw shims
99125
shell: bash
@@ -113,16 +139,18 @@ jobs:
113139
strip_shim_dir() { echo "$PATH" | tr ':' '\n' | grep -vxF "$SHIM_DIR" | paste -sd: -; }
114140
CLEAN_PATH="$(strip_shim_dir)"
115141
# https://docs.socket.dev/docs/socket-firewall-free#what-ecosystems-and-package-managers-are-supported
142+
SSL_WORKAROUND=""
143+
if [ "$SFW_IS_ENTERPRISE" != "true" ]; then
144+
SSL_WORKAROUND='export GIT_SSL_NO_VERIFY=true # Workaround: sfw-free does not yet set GIT_SSL_CAINFO.'
145+
fi
116146
for CMD in npm yarn pnpm pip uv cargo; do
117147
REAL="$(PATH="$CLEAN_PATH" command -v "$CMD" 2>/dev/null || true)"
118148
[ -z "$REAL" ] && continue
119149
REAL="$(msys_to_win_path "$REAL")"
120-
printf '%s\n' \
121-
'#!/bin/bash' \
122-
"export PATH=\"\$(echo \"\$PATH\" | tr ':' '\n' | grep -vxF '${SHIM_DIR}' | paste -sd: -)\"" \
123-
'export GIT_SSL_NO_VERIFY=true # Workaround: sfw-free does not yet set GIT_SSL_CAINFO.' \
124-
"exec \"${SFW_BIN}\" \"${REAL}\" \"\$@\"" \
125-
> "$SHIM_DIR/$CMD"
150+
SHIM_LINES=('#!/bin/bash' "export PATH=\"\$(echo \"\$PATH\" | tr ':' '\n' | grep -vxF '${SHIM_DIR}' | paste -sd: -)\"")
151+
[ -n "$SSL_WORKAROUND" ] && SHIM_LINES+=("$SSL_WORKAROUND")
152+
SHIM_LINES+=("exec \"${SFW_BIN}\" \"${REAL}\" \"\$@\"")
153+
printf '%s\n' "${SHIM_LINES[@]}" > "$SHIM_DIR/$CMD"
126154
chmod +x "$SHIM_DIR/$CMD"
127155
if $IS_WINDOWS; then
128156
printf '@echo off\r\nset "PATH=;%%PATH%%;"\r\nset "PATH=%%PATH:;%s;=;%%"\r\nset "PATH=%%PATH:~1,-1%%"\r\n"%s" "%s" %%*\r\n' \

0 commit comments

Comments
 (0)