9c0e2d1d95
- Secrets are never exposed in plaintext in the Cue tree. `dagger query` won't dump secrets anymore, Cue errors won't contain them either. - BuildKit-native secrets support through a new `mount` type. This ensures secrets will never be part of containerd layers, buildkit cache and generally speaking will never be saved to disk in plaintext. - Updated netlify as an example - Added tests - Changed the Cue definition of a secret to: ``` @dagger(secret) id: string } ``` This is to ensure both that setting the wrong input type on a secret (e.g. `dagger input text`) will fail, and attempting to misuse the secret (e.g. interpolating, passing as an env variable, etc) will also fail properly. Signed-off-by: Andrea Luzzardi <aluzzardi@gmail.com>
100 lines
3.0 KiB
Bash
100 lines
3.0 KiB
Bash
setup() {
|
|
load 'helpers'
|
|
|
|
common_setup
|
|
}
|
|
|
|
@test "compute: simple" {
|
|
run "$DAGGER" compute "$TESTDIR"/compute/invalid/string
|
|
assert_failure
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/invalid/bool
|
|
assert_failure
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/invalid/int
|
|
assert_failure
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/invalid/struct
|
|
assert_failure
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/success/noop
|
|
assert_success
|
|
assert_line '{"empty":{}}'
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/success/simple
|
|
assert_success
|
|
assert_line '{}'
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/success/overload/flat
|
|
assert_success
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/success/overload/wrapped
|
|
assert_success
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/success/exec-nocache
|
|
assert_success
|
|
}
|
|
|
|
@test "compute: dependencies" {
|
|
run "$DAGGER" compute "$TESTDIR"/compute/dependencies/simple
|
|
assert_success
|
|
assert_line '{"A":{"result":"from A"},"B":{"result":"dependency from A"}}'
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/dependencies/interpolation
|
|
assert_success
|
|
assert_line '{"A":{"result":"from A"},"B":{"result":"dependency from A"}}'
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/dependencies/unmarshal
|
|
assert_success
|
|
assert_line '{"A":"{\"hello\": \"world\"}\n","B":{"result":"unmarshalled.hello=world"},"unmarshalled":{"hello":"world"}}'
|
|
}
|
|
|
|
@test "compute: inputs" {
|
|
run "$DAGGER" compute "$TESTDIR"/compute/input/simple
|
|
assert_success
|
|
assert_line '{}'
|
|
|
|
run "$DAGGER" compute --input-string 'in=foobar' "$TESTDIR"/compute/input/simple
|
|
assert_success
|
|
assert_line '{"in":"foobar","test":"received: foobar"}'
|
|
|
|
run "$DAGGER" compute "$TESTDIR"/compute/input/default
|
|
assert_success
|
|
assert_line '{"in":"default input","test":"received: default input"}'
|
|
|
|
run "$DAGGER" compute --input-string 'in=foobar' "$TESTDIR"/compute/input/default
|
|
assert_success
|
|
assert_line '{"in":"foobar","test":"received: foobar"}'
|
|
}
|
|
|
|
@test "compute: secrets" {
|
|
# secrets used as environment variables must fail
|
|
run "$DAGGER" compute "$TESTDIR"/compute/secrets/invalid/env
|
|
assert_failure
|
|
assert_line --partial "conflicting values"
|
|
|
|
# strings passed as secrets must fail
|
|
run "$DAGGER" compute "$TESTDIR"/compute/secrets/invalid/string
|
|
assert_failure
|
|
|
|
# Setting a text input for a secret value should fail
|
|
run "$DAGGER" compute --input-string 'mySecret=SecretValue' "$TESTDIR"/compute/secrets/simple
|
|
assert_failure
|
|
|
|
# Now test with an actual secret and make sure it works
|
|
"$DAGGER" init
|
|
dagger_new_with_plan secrets "$TESTDIR"/compute/secrets/simple
|
|
"$DAGGER" input secret mySecret SecretValue
|
|
run "$DAGGER" up
|
|
assert_success
|
|
|
|
# Make sure the secret doesn't show in dagger query
|
|
run "$DAGGER" query mySecret.id -f text
|
|
assert_success
|
|
assert_output "secret=mySecret"
|
|
}
|
|
|
|
@test ".daggerignore" {
|
|
"$DAGGER" compute --input-dir TestData="$TESTDIR"/compute/ignore/testdata "$TESTDIR"/compute/ignore
|
|
}
|