github-mirror/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2026-10-17 13:39:44 +02:00
Code Issues Actions 13 Packages Projects Releases Wiki Activity Graph

ci: Serve the local sandbox runner over TLS (no-changelog) (#37599)

Browse Source 
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matsu 2026-09-02 08:09:13 +00:00 committed by GitHub
parent 5a88f06bb9
commit 6586dbe05e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
packages/testing/containers/services/sandbox.ts
View File

@ -258,7 +258,7 @@ export const sandbox: Service<SandboxResult> = {
SANDBOX_RUNNER_API_KEYS: RUNNER_API_KEY,
SANDBOX_RUNNER_REGISTRATION_TOKEN: REGISTRATION_TOKEN,
SANDBOX_RUNNER_API_GRPC_ADDR: `${API_HOSTNAME}:${API_GRPC_PORT}`,
SANDBOX_RUNNER_HTTP_BASE_URL: `http://${RUNNER_HOSTNAME}:${API_HTTP_PORT}`,
SANDBOX_RUNNER_HTTP_BASE_URL: `https://${RUNNER_HOSTNAME}:${API_HTTP_PORT}`,
SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ':9091',
SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: `${RUNNER_HOSTNAME}:9091`,
SANDBOX_RUNNER_ID: 'ci-runner-1',
@ -274,8 +274,11 @@ export const sandbox: Service<SandboxResult> = {
})
.withExposedPorts(API_HTTP_PORT)
.withWaitStrategy(
// `/healthz` is the one route exempt from the client-certificate check.
// BusyBox wget cannot be given a CA file, so the probe skips verification:
// it answers "is the listener up", and the mTLS path is what the API uses.
Wait.forSuccessfulCommand(
`wget -q -O /dev/null --header='X-Api-Key: ${RUNNER_API_KEY}' http://localhost:${API_HTTP_PORT}/healthz`,
`wget -q -O /dev/null --no-check-certificate https://localhost:${API_HTTP_PORT}/healthz`,
).withStartupTimeout(120_000),
)
.withLogConsumer(runnerConsumer)

8
packages/testing/containers/test-containers.ts
View File

@ -45,11 +45,9 @@ const DEFAULT_IMAGES = {
localstack: 'localstack/localstack:4.13.1',
postgresExporter: 'prometheuscommunity/postgres-exporter:v0.17.1',
cadvisor: 'gcr.io/cadvisor/cadvisor:v0.49.1',
// Pinned: from 1.3.0 the runner rejects a non-https SANDBOX_RUNNER_HTTP_BASE_URL,
// which the local stack in services/sandbox.ts still sets.
sandboxApi: 'n8nio/n8n-sandbox-service-api:1.2.0',
sandboxRunner: 'n8nio/n8n-sandbox-service-runner-dind:1.2.0',
sandboxSandbox: 'n8nio/n8n-sandbox-service-sandbox:1.1.0',
sandboxApi: 'n8nio/n8n-sandbox-service-api:1.3.0',
sandboxRunner: 'n8nio/n8n-sandbox-service-runner-dind:1.3.0',
sandboxSandbox: 'n8nio/n8n-sandbox-service-sandbox:1.3.0',
} as const;
/** Convert camelCase to SCREAMING_SNAKE_CASE for env var names */