|
| 1 | +name: container-ci |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + branches: [main] |
| 6 | + paths: |
| 7 | + - .dockerignore |
| 8 | + - .github/workflows/container-ci.yml |
| 9 | + - Dockerfile |
| 10 | + - Dockerfile.dockerignore |
| 11 | + - compose.yaml |
| 12 | + - docker/** |
| 13 | + - sdk/typescript/** |
| 14 | + pull_request: |
| 15 | + paths: |
| 16 | + - .dockerignore |
| 17 | + - .github/workflows/container-ci.yml |
| 18 | + - Dockerfile |
| 19 | + - Dockerfile.dockerignore |
| 20 | + - compose.yaml |
| 21 | + - docker/** |
| 22 | + - sdk/typescript/** |
| 23 | + workflow_dispatch: |
| 24 | + |
| 25 | +permissions: |
| 26 | + contents: read |
| 27 | + |
| 28 | +jobs: |
| 29 | + container: |
| 30 | + name: linux-amd64 |
| 31 | + runs-on: ubuntu-latest |
| 32 | + timeout-minutes: 30 |
| 33 | + |
| 34 | + steps: |
| 35 | + - name: Checkout repository |
| 36 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 37 | + with: |
| 38 | + persist-credentials: false |
| 39 | + |
| 40 | + - name: Verify customer build excludes secrets and scan data |
| 41 | + shell: bash |
| 42 | + run: | |
| 43 | + set -euo pipefail |
| 44 | + ignore_file=.dockerignore |
| 45 | + if [[ -f Dockerfile.dockerignore ]]; then |
| 46 | + ignore_file=Dockerfile.dockerignore |
| 47 | + if ! cmp -s .dockerignore "$ignore_file"; then |
| 48 | + echo "Dockerfile-specific ignore rules must match the approved customer baseline." >&2 |
| 49 | + exit 1 |
| 50 | + fi |
| 51 | + fi |
| 52 | +
|
| 53 | + if grep -Fq '!' "$ignore_file"; then |
| 54 | + echo "Customer Docker ignore rules must not re-include excluded files: $ignore_file" >&2 |
| 55 | + exit 1 |
| 56 | + fi |
| 57 | +
|
| 58 | + for pattern in \ |
| 59 | + '**/.env' \ |
| 60 | + '**/.env.*' \ |
| 61 | + '**/.npmrc' \ |
| 62 | + '**/node_modules' \ |
| 63 | + '**/*.csv' \ |
| 64 | + '**/repositories.csv' \ |
| 65 | + '**/results' \ |
| 66 | + '**/security-scans' \ |
| 67 | + '**/state'; do |
| 68 | + if ! grep -Fxq -- "$pattern" "$ignore_file"; then |
| 69 | + echo "Missing customer Docker build exclusion in $ignore_file: $pattern" >&2 |
| 70 | + exit 1 |
| 71 | + fi |
| 72 | + done |
| 73 | +
|
| 74 | + - name: Set up Docker Buildx |
| 75 | + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 |
| 76 | + |
| 77 | + - name: Build customer container |
| 78 | + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 |
| 79 | + with: |
| 80 | + context: . |
| 81 | + load: true |
| 82 | + platforms: linux/amd64 |
| 83 | + push: false |
| 84 | + tags: codex-security:ci |
| 85 | + |
| 86 | + - name: Verify bundled scanner |
| 87 | + run: | |
| 88 | + docker run --rm codex-security:ci --version |
| 89 | + docker run --rm codex-security:ci bulk-scan --help |
| 90 | + docker run --rm codex-security:ci info --json |
| 91 | +
|
| 92 | + - name: Validate hardened customer Compose configuration |
| 93 | + env: |
| 94 | + CODEX_SECURITY_IMAGE: codex-security:ci |
| 95 | + run: | |
| 96 | + mkdir -p results state |
| 97 | + chmod 700 results state |
| 98 | + printf 'id,repository,revision\n' > repositories.csv |
| 99 | + export CODEX_SECURITY_USER="$(id -u):$(id -g)" |
| 100 | + docker compose config --quiet |
| 101 | + docker compose run --rm codex-security --version |
| 102 | +
|
| 103 | + - name: Verify hardened Codex command sandbox |
| 104 | + shell: bash |
| 105 | + run: | |
| 106 | + set -euo pipefail |
| 107 | + command=( |
| 108 | + docker run --rm |
| 109 | + --cap-drop ALL |
| 110 | + --security-opt no-new-privileges |
| 111 | + --security-opt "seccomp=$GITHUB_WORKSPACE/docker/codex-security-seccomp.json" |
| 112 | + --entrypoint node |
| 113 | + codex-security:ci |
| 114 | + /usr/local/lib/node_modules/@openai/codex-security/node_modules/@openai/codex/bin/codex.js |
| 115 | + ) |
| 116 | +
|
| 117 | + if output="$("${command[@]}" sandbox /usr/bin/true 2>&1)"; then |
| 118 | + printf '%s\n' "$output" |
| 119 | + elif grep -Eq 'bwrap: (Failed to make / slave: Permission denied|loopback: Failed RTM_NEW(ADDR|LINK): Operation not permitted|setting up uid map: Permission denied|No permissions to create a new namespace)' <<< "$output"; then |
| 120 | + echo '::warning::This Docker host blocks nested Bubblewrap namespaces; verifying the supported Landlock fallback.' |
| 121 | + "${command[@]}" sandbox --enable use_legacy_landlock /usr/bin/true |
| 122 | + else |
| 123 | + printf 'The hardened Codex sandbox failed unexpectedly:\n%s\n' "$output" >&2 |
| 124 | + exit 1 |
| 125 | + fi |
| 126 | +
|
| 127 | + - name: Reject interactive repository discovery |
| 128 | + shell: bash |
| 129 | + run: | |
| 130 | + set -euo pipefail |
| 131 | + if output="$(docker run --rm -t codex-security:ci bulk-scan 2>&1)"; then |
| 132 | + echo "The customer container must require a repository CSV." >&2 |
| 133 | + exit 1 |
| 134 | + else |
| 135 | + status=$? |
| 136 | + fi |
| 137 | + if [[ "$status" -ne 2 ]]; then |
| 138 | + printf 'The customer container returned unexpected exit status %s:\n%s\n' "$status" "$output" >&2 |
| 139 | + exit 1 |
| 140 | + fi |
| 141 | + expected='codex-security: bulk-scan requires a repository CSV; interactive discovery is not supported in this image.' |
| 142 | + if [[ "${output//$'\r'/}" != "$expected" ]]; then |
| 143 | + printf 'The customer container returned an unexpected repository discovery error:\n%s\n' "$output" >&2 |
| 144 | + exit 1 |
| 145 | + fi |
| 146 | +
|
| 147 | + - name: Verify host-scoped noninteractive Git credentials |
| 148 | + shell: bash |
| 149 | + run: | |
| 150 | + set -euo pipefail |
| 151 | + docker run --rm \ |
| 152 | + --entrypoint /bin/sh \ |
| 153 | + --env GH_TOKEN=SYNTHETIC_GITHUB_TOKEN \ |
| 154 | + codex-security:ci \ |
| 155 | + -ec 'actual="$(printf "protocol=https\nhost=github.com\n\n" | /usr/local/bin/codex-security-git-credential get)"; test "$actual" = "$(printf "username=x-access-token\npassword=SYNTHETIC_GITHUB_TOKEN")"; test -z "$(printf "protocol=https\nhost=untrusted.example\n\n" | /usr/local/bin/codex-security-git-credential get)"' |
0 commit comments