fix(runtime): harden smoke and credential boundaries

2026-08-04 16:05:06 +00:00
parent 09d849de07
commit c49989631f
16 changed files with 517 additions and 8 deletions
@@ -0,0 +1,40 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+test('Git askpass reads HTTPS credentials from protected files instead of process env', async () => {
+  const authDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-git-auth-'));
+  try {
+    await fs.writeFile(path.join(authDir, 'https-username'), 'deploy-user', { mode: 0o600 });
+    await fs.writeFile(path.join(authDir, 'https-token'), 'deploy-token', { mode: 0o600 });
+
+    const username = await execFileAsync('./runtime/git-askpass.sh', ['Username'], {
+      env: { SAMMO_GIT_AUTH_DIR: authDir },
+    });
+    const token = await execFileAsync('./runtime/git-askpass.sh', ['Password'], {
+      env: { SAMMO_GIT_AUTH_DIR: authDir },
+    });
+
+    assert.equal(username.stdout, 'deploy-user');
+    assert.equal(token.stdout, 'deploy-token');
+  } finally {
+    await fs.rm(authDir, { recursive: true });
+  }
+});
+
+test('runtime entrypoint removes raw repository secrets before launching PM2', async () => {
+  const entrypoint = await fs.readFile(new URL('../runtime/entrypoint.sh', import.meta.url), 'utf8');
+  const pm2Start = entrypoint.indexOf('"$pm2_bin" start');
+  const httpsUnset = entrypoint.indexOf('unset CORE_REPOSITORY_USERNAME CORE_REPOSITORY_TOKEN');
+  const sshUnset = entrypoint.indexOf('unset CORE_SSH_PRIVATE_KEY_BASE64 CORE_SSH_KNOWN_HOSTS_BASE64');
+
+  assert.ok(pm2Start > 0);
+  assert.ok(httpsUnset > 0 && httpsUnset < pm2Start);
+  assert.ok(sshUnset > 0 && sshUnset < pm2Start);
+});