mirror of
https://github.com/itplr-kosit/validator.git
synced 2026-07-25 16:15:47 +00:00
599042fb23
scripts/validate.sh is the engine behind both platforms: download the released standalone jar and the validation configuration (SHA-256-verified when pinned), validate each document, print PASS/FAIL with the failing rule ids and fail on any rejection. The GitHub Action (action.yml) maps its inputs onto the script's environment; the GitLab template fetches the same script from this repository at KOSIT_SCRIPT_REF and drives it with the same variables, so both platforms run identical logic. With Docker available the action executes each validation sealed (the "sealed" input, default "auto"): inside an eclipse-temurin:21-jre container without network access, a read-only root, no capabilities and no privilege escalation, run with an init process, a pids limit and the caller's uid; the document, the jar and the configuration are mounted read-only, only the report directory and a bounded /tmp tmpfs are writable. Downloads always happen outside the container, so the validator itself never touches the network, and the host JVM setup is skipped entirely for "sealed: always". The image tag pins the Java 21 JRE contract and floats the patch level: the released jars are the checksummed artifacts, the runtime is a security-patch channel; an "image" input (KOSIT_IMAGE on GitLab) accepts a digest-pinned reference for stricter policies. The GitLab job image is the same runtime, giving both platforms an identical execution environment. The action self-test validates a conformant XRechnung reference instance and asserts a corrupted one is rejected, exercising the sealed path through the empty-input fallback and an explicit image override, plus the host path.
93 lines
3 KiB
YAML
93 lines
3 KiB
YAML
name: Action self-test
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- action.yml
|
|
- scripts/**
|
|
- gitlab/**
|
|
- .github/workflows/action-test.yml
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CONFIGURATION_URL: https://github.com/itplr-kosit/validator-configuration-xrechnung/releases/download/v2026-01-31/xrechnung-3.0.2-validator-configuration-2026-01-31.zip
|
|
CONFIGURATION_SHA256: 6a5a5911a421b25fbc423f62f93f894df7b236f5d73ca4f84bb222a945082704
|
|
VALIDATOR_SHA256: 244978514ad48f67c7573acfffc8f4fd73d81feda6f276710033f9913579857e
|
|
# A conformant XRechnung 3.0.2 reference instance from the KoSIT test suite.
|
|
SAMPLE_URL: https://raw.githubusercontent.com/itplr-kosit/xrechnung-testsuite/b3791d47a2e1446b1751a27cb732aac294231293/src/test/business-cases/standard/01.01a-INVOICE_uncefact.xml
|
|
|
|
jobs:
|
|
accepts-a-valid-document:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
strategy:
|
|
matrix:
|
|
# "always" proves the sealed Docker path — once through the
|
|
# empty-input fallback, once with an explicit image override —
|
|
# and "never" the host JVM path.
|
|
include:
|
|
- sealed: always
|
|
image: ""
|
|
- sealed: always
|
|
image: eclipse-temurin:21-jre
|
|
- sealed: never
|
|
image: ""
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Fetch a conformant reference instance
|
|
run: |
|
|
mkdir samples
|
|
curl -fsSL "$SAMPLE_URL" -o samples/invoice.xml
|
|
|
|
- name: Validate (must accept)
|
|
id: validate
|
|
uses: ./
|
|
with:
|
|
version: "1.6.2"
|
|
checksum: ${{ env.VALIDATOR_SHA256 }}
|
|
configuration: ${{ env.CONFIGURATION_URL }}
|
|
configuration-checksum: ${{ env.CONFIGURATION_SHA256 }}
|
|
files: samples/
|
|
sealed: ${{ matrix.sealed }}
|
|
image: ${{ matrix.image }}
|
|
|
|
- name: Outputs are reported
|
|
run: |
|
|
test "${{ steps.validate.outputs.accepted }}" = "1"
|
|
test "${{ steps.validate.outputs.rejected }}" = "0"
|
|
test -d "${{ steps.validate.outputs.report-dir }}"
|
|
|
|
rejects-a-broken-document:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Fetch and break a reference instance
|
|
run: |
|
|
mkdir samples
|
|
curl -fsSL "$SAMPLE_URL" -o samples/invoice.xml
|
|
# Corrupt the issue date (BT-2): schema-invalid, must be rejected.
|
|
sed -i '0,/format="102">[0-9]*</s//format="102">not-a-date</' samples/invoice.xml
|
|
|
|
- name: Validate (must reject)
|
|
id: validate
|
|
continue-on-error: true
|
|
uses: ./
|
|
with:
|
|
version: "1.6.2"
|
|
checksum: ${{ env.VALIDATOR_SHA256 }}
|
|
configuration: ${{ env.CONFIGURATION_URL }}
|
|
configuration-checksum: ${{ env.CONFIGURATION_SHA256 }}
|
|
files: samples/invoice.xml
|
|
sealed: always
|
|
|
|
- name: The action failed as required
|
|
run: |
|
|
test "${{ steps.validate.outcome }}" = "failure"
|