# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
#     pr-checks/sync.sh
# to regenerate this file.

name: PR Check - Proxy test
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GO111MODULE: auto
on:
  push:
    branches:
      - main
      - releases/v*
  pull_request: {}
  merge_group:
    types:
      - checks_requested
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
    inputs: {}
  workflow_call:
    inputs: {}
defaults:
  run:
    shell: bash
concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
  group: global-proxy-${{github.ref}}
jobs:
  global-proxy:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            version: linked
          - os: ubuntu-latest
            version: nightly-latest
    name: Proxy test
    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
    timeout-minutes: 45
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'false'
      - name: Block direct internet access to force proxy usage
        run: |
          apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1
          PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
          echo "Squid proxy IP: $PROXY_IP"
          # Allow all traffic to the proxy container
          iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT
          # Allow DNS resolution
          iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
          iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
          # Allow loopback
          iptables -A OUTPUT -o lo -j ACCEPT
          # Allow already-established connections (from checkout/prepare-test)
          iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
          # Block all other outbound HTTP and HTTPS, ensuring direct access fails
          iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
          iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
          echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy"

      - name: Set proxy environment variables
        shell: bash
        run: |
          echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
          echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
          echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
          echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV

      - uses: ./../action/init
        with:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}

      - uses: ./../action/analyze
    env:
      CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true
      CODEQL_ACTION_TEST_MODE: true
    container:
      image: ubuntu:22.04
      options: --cap-add=NET_ADMIN
    services:
      squid-proxy:
        image: ubuntu/squid:latest
        ports:
          - 3128:3128