feat: Add security presets and related tests

- Implemented new security presets for access control lists, including geo-blacklist and known botnet IPs. - Added tests for security presets functionality, including validation of preset structure and category/type checks. - Created hooks for Docker and domains with comprehensive tests for fetching, creating, and deleting domains. - Removed unused HealthStatus component. - Updated ProxyHosts bulk delete tests to reflect changes in selection logic. - Introduced integration test script for automated testing of proxy host creation and validation.
2025-11-28 02:54:44 +00:00
parent 72fd121bdb
commit a4cff3c194
34 changed files with 1886 additions and 328 deletions
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -0,0 +1,52 @@
+name: Go Benchmark
+
+on:
+  push:
+    branches:
+      - main
+      - development
+    paths:
+      - 'backend/**'
+  pull_request:
+    branches:
+      - main
+      - development
+    paths:
+      - 'backend/**'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  deployments: write
+
+jobs:
+  benchmark:
+    name: Performance Regression Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.4'
+          cache-dependency-path: backend/go.sum
+
+      - name: Run Benchmark
+        working-directory: backend
+        run: go test -bench=. -benchmem ./... | tee output.txt
+
+      - name: Store Benchmark Result
+        uses: benchmark-action/github-action-benchmark@v1
+        with:
+          name: Go Benchmark
+          tool: 'go'
+          output-file-path: backend/output.txt
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          auto-push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          # Show alert with commit comment on detection of performance regression
+          alert-threshold: '150%'
+          comment-on-alert: true
+          fail-on-alert: false
+          # Enable Job Summary for PRs
+          summary-always: true
--- a/.github/workflows/docker-lint.yml
+++ b/.github/workflows/docker-lint.yml
@@ -0,0 +1,23 @@
+name: Docker Lint
+
+on:
+  push:
+    branches: [ main, development, 'feature/**' ]
+    paths:
+      - 'Dockerfile'
+  pull_request:
+    branches: [ main, development ]
+    paths:
+      - 'Dockerfile'
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Hadolint
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile
+          failure-threshold: warning
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -6,8 +6,7 @@ on:
      - main
      - development
      - feature/beta-release
-    tags:
-      - 'v*.*.*'
+    # Note: Tags are handled by release-goreleaser.yml to avoid duplicate builds
  pull_request:
    branches:
      - main
@@ -102,9 +101,6 @@ jobs:
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/development' }}
            type=raw,value=beta,enable=${{ github.ref == 'refs/heads/feature/beta-release' }}
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
            type=raw,value=pr-${{ github.ref_name }},enable=${{ github.event_name == 'pull_request' }}
            type=sha,format=short,enable=${{ github.event_name != 'pull_request' }}

@@ -212,28 +208,27 @@ jobs:
      - name: Pull Docker image
        run: docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}

-      - name: Run container
+      - name: Create Docker Network
+        run: docker network create cpmp-test-net
+
+      - name: Run Upstream Service (whoami)
+        run: |
+          docker run -d \
+            --name whoami \
+            --network cpmp-test-net \
+            traefik/whoami
+
+      - name: Run CPMP Container
        run: |
          docker run -d \
            --name test-container \
+            --network cpmp-test-net \
            -p 8080:8080 \
+            -p 80:80 \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}

-      - name: Test health endpoint (retries)
-        run: |
-          set +e
-          for i in $(seq 1 30); do
-            code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/api/v1/health || echo "000")
-            if [ "$code" = "200" ]; then
-              echo "✅ Health check passed on attempt $i"
-              exit 0
-            fi
-            echo "Attempt $i/30: health not ready (code=$code); waiting..."
-            sleep 2
-          done
-          echo "❌ Health check failed after retries"
-          docker logs test-container || true
-          exit 1
+      - name: Run Integration Test
+        run: ./scripts/integration-test.sh

      - name: Check container logs
        if: always()
@@ -241,7 +236,10 @@ jobs:

      - name: Stop container
        if: always()
-        run: docker stop test-container && docker rm test-container
+        run: |
+          docker stop test-container whoami || true
+          docker rm test-container whoami || true
+          docker network rm cpmp-test-net || true

      - name: Create test summary
        if: always()
@@ -249,4 +247,4 @@ jobs:
          echo "## 🧪 Docker Image Test Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Image**: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
-          echo "- **Health Check**: ${{ job.status == 'success' && '✅ Passed' || '❌ Failed' }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Integration Test**: ${{ job.status == 'success' && '✅ Passed' || '❌ Failed' }}" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/quality-checks.yml
+++ b/.github/workflows/quality-checks.yml
@@ -22,8 +22,10 @@ jobs:
      - name: Run Go tests
        id: go-tests
        working-directory: backend
+        env:
+          CGO_ENABLED: 1
        run: |
-          go test -v -coverprofile=coverage.out ./... 2>&1 | tee test-output.txt
+          go test -race -v -coverprofile=coverage.out ./... 2>&1 | tee test-output.txt
          exit ${PIPESTATUS[0]}

      - name: Go Test Summary
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,133 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*.*.*'
-
-permissions:
-  contents: write
-  packages: write
-
-jobs:
-  build-frontend:
-    name: Build Frontend
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
-        with:
-          node-version: '24.11.1'
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Dependencies
-        working-directory: frontend
-        run: npm ci
-
-      - name: Build
-        working-directory: frontend
-        run: npm run build
-
-      - name: Archive Frontend
-        working-directory: frontend
-        run: tar -czf ../frontend-dist.tar.gz dist/
-
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-        with:
-          name: frontend-dist
-          path: frontend-dist.tar.gz
-
-  build-backend:
-    name: Build Backend
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        goos: [linux]
-        goarch: [amd64, arm64]
-    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
-        with:
-          go-version: '1.25.4'
-
-      - name: Build
-        working-directory: backend
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-          CGO_ENABLED: 1
-        run: |
-          # Install dependencies for CGO (sqlite)
-          if [ "${{ matrix.goarch }}" = "arm64" ]; then
-            sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu
-            export CC=aarch64-linux-gnu-gcc
-          fi
-
-          go build -ldflags "-s -w -X github.com/Wikid82/CaddyProxyManagerPlus/backend/internal/version.Version=${{ github.ref_name }}" -o ../cpmp-${{ matrix.goos }}-${{ matrix.goarch }} ./cmd/api
-
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-        with:
-          name: backend-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: cpmp-${{ matrix.goos }}-${{ matrix.goarch }}
-
-  build-caddy:
-    name: Build Caddy
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        goos: [linux]
-        goarch: [amd64, arm64]
-    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
-        with:
-          go-version: '1.25.4'
-
-      - name: Install xcaddy
-        run: go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
-
-      - name: Build Caddy
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-        run: |
-          xcaddy build v2.9.1 \
-            --replace github.com/quic-go/quic-go=github.com/quic-go/quic-go@v0.49.1 \
-            --replace golang.org/x/crypto=golang.org/x/crypto@v0.35.0 \
-            --output caddy-${{ matrix.goos }}-${{ matrix.goarch }}
-
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-        with:
-          name: caddy-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: caddy-${{ matrix.goos }}-${{ matrix.goarch }}
-
-  create-release:
-    name: Create Release
-    needs: [build-frontend, build-backend, build-caddy]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-        with:
-          path: artifacts
-
-      - name: Display structure of downloaded files
-        run: ls -R artifacts
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
-        with:
-          files: |
-            artifacts/frontend-dist/frontend-dist.tar.gz
-            artifacts/backend-linux-amd64/cpmp-linux-amd64
-            artifacts/backend-linux-arm64/cpmp-linux-arm64
-            artifacts/caddy-linux-amd64/caddy-linux-amd64
-            artifacts/caddy-linux-arm64/caddy-linux-arm64
-          generate_release_notes: true
-          prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc') }}
-          token: ${{ secrets.CPMP_TOKEN }}
-
-  build-and-publish:
-    needs: create-release
-    uses: ./.github/workflows/docker-publish.yml # Reusable workflow present; path validated
-    secrets: inherit