Align PMG integration: use PMG_PUBLIC_REPOS_TOKEN/PMG_TENANT_ID + add pmg-test.yml

Author: vanshika-verma-rzp

.github/workflows/ci.yml

@@ -19,8 +19,8 @@ jobs:
     uses: safedep/pmg@v1
     with:
       server-mode: true
-      api-key: ${{ secrets.SAFEDEP_API_KEY }}
-      tenant-id: ${{ secrets.SAFEDEP_TENANT_ID }}
+      api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
+      tenant-id: ${{ secrets.PMG_TENANT_ID }}
   - name: Set up Ruby
     uses: ruby/setup-ruby@v1
     with:
@@ -51,8 +51,8 @@ jobs:
       uses: safedep/pmg@v1
       with:
         server-mode: true
-        api-key: ${{ secrets.SAFEDEP_API_KEY }}
-        tenant-id: ${{ secrets.SAFEDEP_TENANT_ID }}
+        api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
+        tenant-id: ${{ secrets.PMG_TENANT_ID }}
     - name: Set up Ruby latest
       uses: ruby/setup-ruby@v1
       with:
@@ -80,8 +80,8 @@ jobs:
       uses: safedep/pmg@v1
       with:
         server-mode: true
-        api-key: ${{ secrets.SAFEDEP_API_KEY }}
-        tenant-id: ${{ secrets.SAFEDEP_TENANT_ID }}
+        api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
+        tenant-id: ${{ secrets.PMG_TENANT_ID }}
     - run: sudo apt-get install -y oathtool
     - name: Download all workflow run artifacts
       uses: actions/download-artifact@v3

.github/workflows/pmg-test.yml

@@ -0,0 +1,52 @@
+name: PMG Proxy Test
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+
+jobs:
+  test-pmg-allows-clean-install:
+    name: PMG - Clean package should not be blocked
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup PMG proxy
+        uses: safedep/pmg@v1
+        with:
+          server-mode: true
+          api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
+          tenant-id: ${{ secrets.PMG_TENANT_ID }}
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.2"
+
+      - name: Install clean package (should succeed)
+        run: gem install rake
+
+      - name: Enforce PMG policy
+        if: always()
+        run: pmg proxy stop --fail-on-violation
+
+  test-pmg-blocks-malicious-package:
+    name: PMG - Malicious package should be blocked
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup PMG proxy
+        uses: safedep/pmg@v1
+        with:
+          server-mode: true
+          api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
+          tenant-id: ${{ secrets.PMG_TENANT_ID }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install flagged test package (PMG should block this)
+        continue-on-error: true
+        run: npm install --no-cache --prefer-online safedep-test-pkg@0.1.3
+
+      - name: Enforce PMG policy (expect failure — violation recorded)
+        if: always()
+        run: pmg proxy stop --fail-on-violation

.github/workflows/ruby.yml

@@ -30,8 +30,8 @@ jobs:
       uses: safedep/pmg@v1
       with:
         server-mode: true
-        api-key: ${{ secrets.SAFEDEP_API_KEY }}
-        tenant-id: ${{ secrets.SAFEDEP_TENANT_ID }}
+        api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
+        tenant-id: ${{ secrets.PMG_TENANT_ID }}
     - name: Set up Ruby
     # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby,
     # change this to (see https://github.com/ruby/setup-ruby#versioning):