[t-naumenko]

Pull Request

Description

Until now CI only checked that the Docker image builds (check-docker.yml). Since the image now runs LPVS as an unprivileged user (fix for GHSA-66xf-749c-4648), this PR adds integration tests that run the built image and verify its runtime behavior and the webhook security fixes end to end.

New script .github/scripts/docker-integration-test.sh (can also be run locally), executed by check-docker.yml against the image built in the same job:

1. Unprivileged user: the container runs as uid 10001; /etc/cron.d, /root, /usr/local/bin and Python site-packages are not writable; lpvs.jar exists and is not writable; scanoss-py runs.
2. Single scan (CLI) mode: with network access disabled, LPVS starts as lpvs, triggers a scan without permission errors and creates its Projects and Results directories as uid 10001. Thin launcher dependencies are downloaded in a separate step beforehand, so no SCANOSS API calls are made.
3. Mounted volume: a Docker volume mounted at /home/lpvs/LPVS is writable and receives the scan files.
4. Service started with docker compose (MySQL + LPVS):
   • GET /health returns 200;
   • a signed ping webhook returns 200;
   • a webhook with a wrong signature returns 403;
   • a correctly signed webhook with a path traversal head commit SHA returns 400 and creates nothing outside the working directory;
   • /scan without API key returns 403;
   • unknown endpoints return 403.

Isolation and cleanup:

• A temporary .env with random secrets is used instead of the repository .env.
• Own compose project name (lpvs-it) and port (127.0.0.1:17896), so the tests don't interfere with a running LPVS instance.
• A temporary compose override uses the locally built image without restarts and sets a placeholder github.token, which is required to start in server mode; the tests make no GitHub API calls.
• All containers and volumes are removed on exit, also on failure.

Usage:

IMAGE=lpvs:integration-test .github/scripts/docker-integration-test.sh

The image is built first if it doesn't exist (or with BUILD=1). STEPS="1 2 3 4" selects which tests to run, e.g. STEPS=4 for the compose tests only.

CI behavior (check-docker.yml):

• The image is built once and reused by the integration tests; a timeout-minutes: 60 limit was added to the job.
• The integration tests are skipped for dependabot pull requests; dependency updates are tested after they are merged to main. Re-running the job manually on a dependabot pull request runs the tests.
• A new run cancels the previous run for the same branch or pull request (concurrency with cancel-in-progress), so when several pull requests are merged to main one after another, only the latest commit is tested.
• The workflow can be started manually from the Actions tab (workflow_dispatch) on any branch.

Type of change

Please delete options that are not relevant.

• CI system update

Testing

• Ran the script locally against the image built from this branch: all 21 checks pass (about 4.5 minutes, excluding the image build).
• Verified the tests detect the vulnerabilities by running them against an image built from main before the fix:
  • step 1 fails: the container runs as uid 0 and can write to /etc/cron.d, /root, /usr/local/bin and site-packages;
  • step 4 fails: the signed webhook with a path traversal SHA is accepted with 200 instead of being rejected with 400.
• Validated the workflow syntax; required status checks (build, test-suite) are defined in other workflows and are not affected.

Test Configuration:

• Docker Compose: v2.24 or later (uses !reset / !override in the compose override)
• LPVS Release: 2.2.5 + fix for GHSA-66xf-749c-4648

Checklist:

• My code follows the style guidelines of this project
• My code meets the required code coverage for lines (90% and above)
• My code meets the required code coverage for branches (80% and above)
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[o-kopysov]

LGTM

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.11%. Comparing base (a888942) to head (fc4ec5f).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #944   +/-   ##
=========================================
  Coverage     94.11%   94.11%           
  Complexity      456      456           
=========================================
  Files            30       30           
  Lines          1869     1869           
  Branches        243      243           
=========================================
  Hits           1759     1759           
  Misses           48       48           
  Partials         62       62           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[tdrozdovsky]

LGTM