firewall-integration.yaml

name: firewall-integration

# Kernel-level regression test: a local security_rules.yaml (standalone /
# no-API-key mode) must be programmed into the XDP `banned_ips` map on the
# agent's INITIAL load. Runs the agent against an isolated `dummy` interface and
# asserts the map via bpftool — no VM/DPU emulation needed. Covers both the
# "local file must parse without API metadata" and "initial load must program
# the firewall" fixes.
#
# amd64 only: the behaviour under test is arch-independent config-loading logic,
# and arm64 build coverage already lives in build.yaml (which cross-builds in a
# container — bare apt has no binary-arm64 packages on the arm runners).

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: firewall-integration-${{ github.ref }}
  cancel-in-progress: true

jobs:
  local-rules-firewall:
    runs-on: ${{ github.event.pull_request.head.repo.full_name == github.repository && 'ubicloud-standard-2' || 'ubuntu-latest' }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: ./.github/actions/setup-private-cargo
        with:
          gen0sec-token: ${{ secrets.GEN0SEC_CARGO_TOKEN }}
          repo-access-token: ${{ secrets.REPO_ACCESS_TOKEN }}
      - uses: ./.github/actions/setup-linux-build-deps
      - uses: ./.github/actions/setup-rust-stable

      - name: Build synapse (default features incl. bpf)
        run: cargo build --release --bin synapse

      - name: Install static bpftool
        # The apt `bpftool` is only a wrapper that execs a kernel-version-
        # specific binary, which isn't published for the runner's kernel. Use
        # the upstream static build instead (kernel-independent).
        env:
          BPFTOOL_VERSION: v7.7.0
        run: |
          base="https://github.com/libbpf/bpftool/releases/download/${BPFTOOL_VERSION}"
          curl -fsSL -O "${base}/bpftool-${BPFTOOL_VERSION}-amd64.tar.gz"
          curl -fsSL -O "${base}/bpftool-${BPFTOOL_VERSION}-amd64.tar.gz.sha256sum"
          sha256sum -c "bpftool-${BPFTOOL_VERSION}-amd64.tar.gz.sha256sum"
          sudo tar -xzf "bpftool-${BPFTOOL_VERSION}-amd64.tar.gz" -C /usr/local/bin bpftool
          sudo chmod +x /usr/local/bin/bpftool
          /usr/local/bin/bpftool version

      - name: Local-rules firewall integration test
        run: sudo -E env "PATH=$PATH" SYNAPSE_BIN=target/release/synapse BPFTOOL=/usr/local/bin/bpftool ./scripts/local-rules-firewall-test.sh