fix(deploy-hetzner): restore dual-stack ssh.socket (IPv4 + IPv6) #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: test | |
| # Gatekeeper for every push and PR: TypeScript typecheck (pnpm build) + | |
| # vitest unit suite (pnpm test) + TypeScript SDK build and test. Runs on | |
| # GitHub-hosted ubuntu — no Docker spawn here (that lives in a separate | |
| # workflow), so this is fast (~1-2 minutes) and cheap. Regressions on | |
| # the unit suite surface as a red PR badge before merge, not as a broken | |
| # container pulled from GHCR. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| unit: | |
| name: build + unit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| # `pnpm lint` is `tsc --noEmit -p tsconfig.json` per package.json. | |
| # Keeps the gate honest about type errors independent of dist/ output. | |
| - name: Typecheck (pnpm lint) | |
| run: pnpm lint | |
| # Full build — catches cases where emit fails even though noEmit passed | |
| # (rare but possible around declaration-file generation). | |
| - name: Build (pnpm build) | |
| run: pnpm build | |
| - name: Unit tests (pnpm test) | |
| run: pnpm test | |
| - name: Entrypoint bash syntax | |
| run: bash -n docker/entrypoint.sh | |
| - name: Deploy script bash syntax | |
| run: | | |
| for script in scripts/deploy-*.sh; do | |
| echo "checking $script" | |
| bash -n "$script" | |
| done | |
| - name: apply-provider-config.mjs syntax | |
| run: node --check docker/apply-provider-config.mjs | |
| # Egress-proxy sidecar (networking: limited enforcement). Shipped | |
| # as its own tiny image with no deps — uses node:test built-in. | |
| - name: Egress-proxy — syntax | |
| run: | | |
| node --check docker/egress-proxy/proxy.mjs | |
| node --check docker/egress-proxy/allowlist.mjs | |
| node --check docker/egress-proxy/dns.mjs | |
| - name: Egress-proxy — unit tests | |
| working-directory: docker/egress-proxy | |
| run: node --test allowlist.test.mjs dns.test.mjs | |
| # Dedicated job for the networking: limited E2E so a failure here | |
| # doesn't mask the unit suite above. Runs on ubuntu-latest because | |
| # Docker Desktop on macOS has subtly different --internal semantics — | |
| # the canonical enforcement claim is proven on native Linux. Keeps | |
| # the whole flow under 3 minutes (egress-proxy image build is tiny). | |
| networking-e2e: | |
| name: networking:limited E2E | |
| runs-on: ubuntu-latest | |
| needs: unit | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Build egress-proxy image | |
| run: docker build -t openclaw-egress-proxy:e2e docker/egress-proxy | |
| - name: Run E2E (9 cases including raw-socket + AWS IMDS SSRF) | |
| run: bash test/e2e-networking.sh | |
| env: | |
| EGRESS_PROXY_IMAGE: openclaw-egress-proxy:e2e | |
| SKIP_BUILD: "1" | |
| # TypeScript SDK lives in its own package with its own deps (vitest, | |
| # typescript). Install via npm (not pnpm workspaces) so it stays | |
| # self-contained and can be published independently. | |
| - name: TypeScript SDK — install | |
| working-directory: sdk/typescript | |
| run: npm install --no-audit --no-fund | |
| - name: TypeScript SDK — build | |
| working-directory: sdk/typescript | |
| run: npm run build | |
| - name: TypeScript SDK — tests | |
| working-directory: sdk/typescript | |
| run: npm test |