test-fips.yml

name: test-fips

# Test FIPS 140 compliance by running tests inside a FIPS-140-configured
# Docker container (the Chainguard base FIPS container).

on:
  workflow_dispatch:
  #XXX
  # schedule:
  #   # Every Tuesday at 6:00 AM
  #   - cron: '0 6 * * 2'
  # XXX
  push:
    branches:
    - main
    paths-ignore:
    - '**/*.md'
    - '**/*.asciidoc'
    - 'docs/**'
    - 'examples/**'
  pull_request:
    branches:
    - main
    paths-ignore:
    - '**/*.md'
    - '**/*.asciidoc'
    - 'docs/**'
    - 'examples/**'

# Limit the access of the generated GITHUB_TOKEN.
permissions:
  contents: read

jobs:
  # setup:
  #   runs-on: ubuntu-24.04
  #   steps:
  #     - uses: actions/checkout@v4
  #     - run: pwd
  #     - run: ls
  #     - run: mount

  test-fips:
    runs-on: ubuntu-24.04
    # XXX
    # needs: setup
    # https://docs.github.com/en/actions/writing-workflows/choosing-where-your-workflow-runs/running-jobs-in-a-container
    # docker run -it --rm --name fipsy docker.elastic.co/wolfi/chainguard-base-fips:latest
    container:
      image: docker.elastic.co/wolfi/chainguard-base-fips:latest
      credentials:
        username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
        password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
      volumes:
        - /home/runner

    timeout-minutes: 30
    steps:
      - run: |
          apk update
          apk add nodejs npm
      - uses: actions/checkout@v4
      - run: pwd
      - run: ls -al
      - run: cat /__w/_PipelineMapping/elastic/apm-agent-nodejs/PipelineFolder.json || true #XXX
      - run: |
          node -e 'const isFips = require("node:crypto").getFips(); console.log("isFips:", isFips); assert(isFips)'
      # XXX https://github.com/elastic/apm-agent-nodejs/actions/runs/13001086210/job/36259730139?pr=4441
      #  node_modules/https-pem
      - run: npm ci --ignore-scripts
      - run: node test/instrumentation/modules/express/basic.test.js

      - name: Notify in Slack
        #XXX
        if: ${{ failure() }}
        uses: elastic/oblt-actions/slack/notify-result@v1.16.0
        with:
          bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          channel-id: "#apm-agent-node"
          message: 'test-fips failed XXX'

  # notify-on-failure:
  #   # XXX can we just run on "failure()"? Does that translate to "needs"? Guessing no.
  #   if: always()
  #   runs-on: ubuntu-24.04
  #   needs: test-fips
  #   steps:
  #     # - name: Notify in Slack
  #     #   #XXX
  #     #   if: ${{ failure() }}
  #     #   uses: elastic/oblt-actions/slack/notify-result@v1.16.0
  #     #   with:
  #     #     bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
  #     #     channel-id: "#apm-agent-node"
  #     #     message: 'test-fips failed XXX'
  #     - id: check
  #       uses: elastic/oblt-actions/check-dependent-jobs@v1
  #       with:
  #         jobs: ${{ toJSON(needs) }}
  #     - run: ${{ steps.check.outputs.is-success }}
  #     #XXX