generated from nhcarrigan/template
hikari
55fcab69a1
Replaces the obsolete test.sh (which referenced configs/prod.conf, a file that no longer exists) with 12 static-analysis checks: 1. No deprecated TLS versions (TLSv1 / TLSv1.1) 2. No duplicate literal server_name values 3. Every sites-available conf has a sites-enabled symlink 4. No broken symlinks in sites-enabled 5. No orphaned sites-enabled symlinks 6. No HTTP-only server blocks (port 80 without port 443) 7. ssl_certificate / ssl_certificate_key counts match per file 8. Plain-HTTP proxy_pass targets are local only 9. All SSL cert paths use /etc/letsencrypt/live/ 10. ssl_certificate uses fullchain.pem, key uses privkey.pem 11. No raw IP addresses as server_name 12. conf.d contains only expected files Adds .gitea/workflows/test.yml with two CI jobs: static-analysis (runs test.sh, no nginx required) and syntax-check (installs nginx-full, copies config, generates stub SSL certs for all referenced letsencrypt paths, then runs nginx -t).
54 lines
1.3 KiB
YAML
54 lines
1.3 KiB
YAML
name: Test nginx configuration
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
static-analysis:
|
|
name: Static Analysis
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run static analysis
|
|
run: bash test.sh
|
|
|
|
syntax-check:
|
|
name: nginx Syntax Check
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install nginx
|
|
run: |
|
|
sudo apt-get update -q
|
|
sudo apt-get install -y nginx-full
|
|
|
|
- name: Deploy config to /etc/nginx
|
|
run: sudo cp -a nginx/nginx/. /etc/nginx/
|
|
|
|
- name: Create stub SSL certificates
|
|
run: |
|
|
openssl req -x509 -newkey rsa:2048 -keyout /tmp/stub.key \
|
|
-out /tmp/stub.pem -days 1 -nodes -subj '/CN=stub'
|
|
|
|
while IFS= read -r dir; do
|
|
sudo mkdir -p "$dir"
|
|
sudo cp /tmp/stub.pem "$dir/fullchain.pem"
|
|
sudo cp /tmp/stub.key "$dir/privkey.pem"
|
|
done < <(grep -rh 'ssl_certificate ' /etc/nginx/sites-available/ \
|
|
| grep -v '#' \
|
|
| grep -oP '/etc/letsencrypt/live/[^\s/]+' \
|
|
| sort -u)
|
|
|
|
- name: Run nginx syntax check
|
|
run: sudo nginx -t
|