proxyTesting.yml

name: Proxy Test with Dual Squid Proxies

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  proxy-test:
    runs-on:
      group: databricks-protected-runner-group
      labels: linux-ubuntu-latest

    steps:
      ################################################################
      # 1) Check Out the Repo
      ################################################################
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      ################################################################
      # 2) Set Up Java
      ################################################################
      - name: Set Up Java
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          java-version: "21"
          distribution: "adopt"

      ################################################################
      # 3) Configure Maven
      ################################################################
      - name: Get JFrog OIDC token
        run: |
          set -euo pipefail

          # Get GitHub OIDC ID token
          ID_TOKEN=$(curl -sLS \
            -H "User-Agent: actions/oidc-client" \
            -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"')
          echo "::add-mask::${ID_TOKEN}"

          # Exchange for JFrog access token
          ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \
            "https://databricks.jfrog.io/access/api/v1/oidc/token" \
            -d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq .access_token | tr -d '"')
          echo "::add-mask::${ACCESS_TOKEN}"

          if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
            echo "FAIL: Could not extract JFrog access token"
            exit 1
          fi

          echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV"

          echo "JFrog OIDC token obtained successfully"

      - name: Configure maven
        run: |
          set -euo pipefail

          mkdir -p ~/.m2
          cat > ~/.m2/settings.xml << EOF
          <settings>
            <mirrors>
              <mirror>
                <id>jfrog-central</id>
                <mirrorOf>*</mirrorOf>
                <url>https://databricks.jfrog.io/artifactory/db-maven/</url>
              </mirror>
            </mirrors>
            <servers>
              <server>
                <id>jfrog-central</id>
                <username>gha-service-account</username>
                <password>${JFROG_ACCESS_TOKEN}</password>
              </server>
            </servers>
          </settings>
          EOF

          echo "Maven configured to use JFrog registry"

      ################################################################
      # 4) Install Squid Proxy
      ################################################################
      - name: Install Squid
        run: |
          sudo apt-get update
          sudo apt-get install -y squid

      ################################################################
      # 4) Configure the Squid for SDK proxy (Port 3128)
      ################################################################
      - name: Configure Squid (Primary 3128)
        run: |
          echo "
          http_port 3128
          # Restrict to localhost for security
          acl localnet src 127.0.0.1/32 ::1
          http_access allow localnet
          http_access deny all
          access_log stdio:/var/log/squid/access.log squid
          " | sudo tee /etc/squid/squid.conf

      ################################################################
      # 5) Start the Squid for SDK proxy
      ################################################################
      - name: Start the Squid for SDK proxy
        run: |
          sudo systemctl restart squid
          sudo systemctl enable squid

      ################################################################
      # 6) Wait for the Squid for SDK proxy to be Ready
      ################################################################
      - name: Wait for Squid (3128)
        run: |
          for i in {1..5}; do
            echo "Checking if Squid on 3128 is up (attempt $i)..."
            if curl -x http://localhost:3128 http://example.com -sSf -o /dev/null; then
              echo "Squid on 3128 is up."
              break
            fi
            if [ $i -eq 5 ]; then
              echo "Squid on 3128 did not respond after 5 attempts. Failing..."
              exit 1
            fi
            sleep 5
          done

      ################################################################
      # 7) Configure Squid for CloudFetch Proxy (Port 8889)
      #    with Unique PID, Cache, and Logging
      ################################################################
      - name: Configure Squid for CloudFetch Proxy (8889)
        run: |
          sudo cp /etc/squid/squid.conf /etc/squid/squid2.conf
          # Update the port to 8889 in the new config
          sudo sed -i 's/http_port 3128/http_port 8889/' /etc/squid/squid2.conf
          # Set unique PID file and cache directory for the second instance
          echo "pid_filename /var/run/squid2.pid" | sudo tee -a /etc/squid/squid2.conf
          echo "cache_dir ufs /var/spool/squid2 100 16 256" | sudo tee -a /etc/squid/squid2.conf
          # Configure logging for the second instance
          echo "access_log stdio:/var/log/squid2/access.log squid" | sudo tee -a /etc/squid/squid2.conf
          echo "cache_log /var/log/squid2/cache.log" | sudo tee -a /etc/squid/squid2.conf
          
          # (Removed the problematic sed line that caused /var/log/squid22)
          # Create necessary directories and set permissions
          sudo mkdir -p /var/log/squid2 /var/spool/squid2
          sudo chown -R proxy:proxy /var/log/squid2 /var/spool/squid2

      ################################################################
      # 8) Initialize Cache Directory for CloudFetch Proxy
      ################################################################
      - name: Initialize Cache for CloudFetch Proxy
        run: |
          sudo squid -f /etc/squid/squid2.conf -z

      ################################################################
      # 9) Start the Squid for CloudFetch Proxy
      ################################################################
      - name: Start the Squid for CloudFetch Proxy
        run: |
          sudo squid -f /etc/squid/squid2.conf -N &> /tmp/squid2.log &
          sleep 3

      ################################################################
      # 10) Wait for the Squid for CloudFetch Proxy (8889)
      ################################################################
      - name: Verify Squid (8889)
        run: |
          for i in {1..5}; do
            echo "Checking if Squid on 8889 is up (attempt $i)..."
            if curl -x http://localhost:8889 http://example.com -sSf -o /dev/null; then
              echo "Squid for CloudFetch proxy on 8889 is up."
              break
            fi
            if [ $i -eq 5 ]; then
              echo "Squid on 8889 did not respond after 5 attempts. Failing..."
              cat /tmp/squid2.log
              exit 1
            fi
            sleep 5
          done

      ################################################################
      # 11) Maven Build
      ################################################################
      - name: Maven Build
        run: mvn clean package -DskipTests

      ################################################################
      # 12) Set Environment Variables for Tests
      ################################################################
      - name: Set Environment Variables
        env:
          DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
          DATABRICKS_HOST: ${{ secrets.DATABRICKS_HOST }}
          DATABRICKS_HTTP_PATH: ${{ secrets.DATABRICKS_HTTP_PATH }}
          PROXY_URL: "http://localhost:3128"
          CF_PROXY_URL: "http://localhost:8889"
        run: |
          echo "DATABRICKS_TOKEN=${DATABRICKS_TOKEN}" >> $GITHUB_ENV
          echo "DATABRICKS_HOST=${DATABRICKS_HOST}" >> $GITHUB_ENV
          echo "DATABRICKS_HTTP_PATH=${DATABRICKS_HTTP_PATH}" >> $GITHUB_ENV
          echo "PROXY_URL=${PROXY_URL}" >> $GITHUB_ENV
          echo "CF_PROXY_URL=${CF_PROXY_URL}" >> $GITHUB_ENV

      ################################################################
      # 13) Run Proxy Tests
      ################################################################
      - name: Run ProxyTest
        run: |
          mvn -pl jdbc-core test -Dtest=**/ProxyTest.java

      ################################################################
      # 14) Cleanup
      ################################################################
      - name: Cleanup Squid
        if: always()
        run: |
          echo "Stopping and disabling primary Squid..."
          sudo systemctl stop squid
          sudo systemctl disable squid
          echo "Killing Squid for CloudFetch proxy if still running..."
          sudo pkill squid