# The extension sandbox's deny rules, proven on real traffic.
#
# scripts/sandbox-rules-test.py loads meta-forgefirm's ffx.nft into a network
# namespace of its own and sends at it from real uids: a pool uid is refused
# on loopback (IPv4 and IPv6, TCP at once, UDP with EPERM), the uids on
# either side of the pool and root are not touched, an allowlist chain opens
# one destination to one uid, and loading the file again takes it away. The
# runner's nft is the version the image carries or newer; the kernel side is
# the image's own business and is proven on the machine (exthost.platform).

name: sandbox-ci

on:
  push:
    branches: [master]
    paths:
      - 'meta-forgefirm/recipes-forgefirm/forgefirm-sandbox/**'
      - 'scripts/sandbox-rules-test.py'
      - '.github/workflows/sandbox-ci.yml'
  pull_request:
  workflow_dispatch:

jobs:
  rules:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4

      - name: nft
        run: sudo apt-get update && sudo apt-get install -y nftables

      - name: The deny rules on real traffic
        run: |
          # 77 is the script's "could not run here": on this runner that is a failure.
          sudo python3 -B scripts/sandbox-rules-test.py