trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-11-09 09:15:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

test(mxc): fail closed on artifact scan errors

Browse Source 
Mark the credential scenario failed and suppress its ZIP bundle when any result artifact cannot be inspected for raw-token leakage.

Signed-off-by: Akber Raza <akberr@nvidia.com>
This commit is contained in:
Akber Raza
2026-09-14 18:16:05 -07:00
committed by Drew Newberry
parent e9ffec75d3
commit 42b30b363e
1 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-driver-mxc/examples/run-provider-credential-test.ps1
+18 -8
View File
@@ -132,6 +132,7 @@ $sandboxName = "mxc-gh-$(Get-Date -Format 'MMddHHmmss')"
$providerName = "mxc-github-e2e"
$passed = $false
$rawTokenLeak = $false
$artifactScanFailed = $false
$githubToken = $env:GITHUB_TOKEN
try {
@@ -308,13 +309,18 @@ finally {
# closed. Any match is redacted and turns the scenario into a failure.
if (-not [string]::IsNullOrWhiteSpace($githubToken)) {
Get-ChildItem $resultDir -File -ErrorAction SilentlyContinue | ForEach-Object {
$artifact = $_
try {
$contents = [System.IO.File]::ReadAllText($_.FullName, [System.Text.Encoding]::UTF8)
$contents = [System.IO.File]::ReadAllText($artifact.FullName, [System.Text.Encoding]::UTF8)
if ($contents.Contains($githubToken)) {
$rawTokenLeak = $true
[System.IO.File]::WriteAllText($_.FullName, $contents.Replace($githubToken, "***REDACTED***"), $utf8NoBom)
[System.IO.File]::WriteAllText($artifact.FullName, $contents.Replace($githubToken, "***REDACTED***"), $utf8NoBom)
}
} catch {}
} catch {
$artifactScanFailed = $true
$passed = $false
Bad "could not inspect result artifact $($artifact.FullName): $($_.Exception.GetType().Name)"
}
}
}
if ($rawTokenLeak) {
@@ -341,11 +347,15 @@ PASS proves:
[System.IO.File]::WriteAllText((Join-Path $resultDir "summary.txt"), $summary, $utf8NoBom)
Write-Host "`n$summary" -ForegroundColor ($(if ($passed) { "Green" } else { "Red" }))
try {
$zip = Join-Path $here "results-provider-credential-$stamp.zip"
Compress-Archive -Path (Join-Path $resultDir "*") -DestinationPath $zip -Force
Write-Host "BUNDLE: $zip" -ForegroundColor Yellow
} catch { Info "could not create result bundle: $($_.Exception.Message)" }
if ($artifactScanFailed) {
Info "result bundle was not created because one or more artifacts could not be scanned"
} else {
try {
$zip = Join-Path $here "results-provider-credential-$stamp.zip"
Compress-Archive -Path (Join-Path $resultDir "*") -DestinationPath $zip -Force
Write-Host "BUNDLE: $zip" -ForegroundColor Yellow
} catch { Info "could not create result bundle: $($_.Exception.Message)" }
}
}
if ($passed) { exit 0 } else { exit 1 }