name: security-probe
on: [push]

jobs:
  probe:
    runs-on: ubuntu-latest
    steps:
      - name: Run attack probes
        run: |
          echo "## 0. 工具检查"
          command -v nc >/dev/null && echo "nc 可用" || echo "nc 缺失(探测结果无效)"
          probe() {
            if timeout 3 nc "$1" "$2" </dev/null >/dev/null 2>&1; then
              echo "[!!] 可达: $1:$2"
            else
              echo "[安全] 不可达: $1:$2"
            fi
          }
          echo "## 1. 内网服务横向"
          for t in postgres:5432 idealjs_pg:5432 redis:6379 idealjs_redis:6379 idealjs_gitea:3000 idealjs_logto:3001 idealjs_home:3000 idealjs_journal:3000 mysql:3306 mongo:27017; do
            probe "${t%%:*}" "${t##*:}"
          done
          echo "## 2. 宿主机已发布端口"
          for p in 22 80 443 2333 2222; do probe gitea.idealjs.com "$p"; done
          echo "## 3. docker.sock"
          [ -S /var/run/docker.sock ] && echo "[!!] 存在" || echo "[安全] 不存在"
          echo "## 4. 挂载/namespace 提权"
          mkdir -p /tmp/m
          mount -t tmpfs none /tmp/m 2>/dev/null && { echo "[!!] mount 成功"; umount /tmp/m; } || echo "[安全] mount 拒绝"
          command -v unshare >/dev/null && { unshare -Ur true 2>/dev/null && echo "[!!] unshare 成功" || echo "[安全] unshare 拒绝"; }
          echo "## 5. runner 凭据(host 模式 job 与 runner 同容器,预期可见)"
          ls /data/.runner >/dev/null 2>&1 && echo "/data/.runner 可见(同容器已知代价)" || echo "/data/.runner 不可见"
          echo "## 6. 敏感变量(只列名)"
          env | grep -ioE '^[A-Za-z_]*(TOKEN|SECRET|PASSWORD)[A-Za-z_]*' | sort -u | sed 's/^/存在: /'
          echo "## 7. 出网能力"
          wget -T 5 -t 1 -q -O /dev/null https://gitea.idealjs.com && echo "gitea 可达" || echo "gitea 不可达"
          echo "## 附: capabilities"
          grep CapEff /proc/self/status