File: README.md
github-actions-models
[!IMPORTANT]
This library has been migrated to zizmorcore/zizmor.
Follow the
crates/github-actions-modelssubdirectory of that repository
for ongoing development.
Unofficial, high-quality data models for GitHub Actions workflows, actions, and related components.
Why?
I need these for another tool, and generating them automatically from
their JSON Schemas wasn't working both for expressiveness and tool deficiency
reasons.
License
MIT License.
The integration tests for this crate contain sample workflows collected from
various GitHub repositories; these contain comments linking them to their
original repositories and are licensed under the terms there.
File: tests/sample-actions/gh-action-pip-audit.yml
https://github.com/pypa/gh-action-pip-audit/blob/530374b67a3e8b3972d2caae7ee9a1d3dd486329/action.yml
name: "gh-action-pip-audit"
author: "William Woodruff [email protected]"
inputs:
summary:
required: false
default: true
no-deps:
required: false
default: false
require-hashes:
required: false
default: false
vulnerability-service:
required: false
default: "PyPI"
inputs:
required: false
default: ""
virtual-environment:
required: false
default: ""
local:
required: false
default: false
index-url:
required: false
default: ""
extra-index-urls:
required: false
default: ""
ignore-vulns:
required: false
default: ""
internal-be-careful-allow-failure:
required: false
default: false
internal-be-careful-extra-flags:
required: false
default: ""
outputs:
internal-be-careful-output:
value: "${{ steps.pip-audit.outputs.output }}"
runs:
using: "composite"
steps:
- name: Set up pip-audit
run: |
# NOTE: Sourced, not executed as a script.
source "${{ github.action_path }}/setup/setup.bash"
env:
GHA_PIP_AUDIT_VIRTUAL_ENVIRONMENT: "${{ inputs.virtual-environment }}"
shell: bash
- name: Run pip-audit
id: pip-audit
run: |
# NOTE: Sourced, not executed as a script.
source "${{ github.action_path }}/setup/venv.bash"
python "${{ github.action_path }}/action.py" "${{ inputs.inputs }}"
env:
GHA_PIP_AUDIT_SUMMARY: "${{ inputs.summary }}"
GHA_PIP_AUDIT_NO_DEPS: "${{ inputs.no-deps }}"
GHA_PIP_AUDIT_REQUIRE_HASHES: "${{ inputs.require-hashes }}"
GHA_PIP_AUDIT_VULNERABILITY_SERVICE: "${{ inputs.vulnerability-service }}"
GHA_PIP_AUDIT_VIRTUAL_ENVIRONMENT: "${{ inputs.virtual-environment }}"
GHA_PIP_AUDIT_LOCAL: "${{ inputs.local }}"
GHA_PIP_AUDIT_INDEX_URL: "${{ inputs.index-url }}"
GHA_PIP_AUDIT_EXTRA_INDEX_URLS: "${{ inputs.extra-index-urls }}"
GHA_PIP_AUDIT_IGNORE_VULNS: "${{ inputs.ignore-vulns }}"
GHA_PIP_AUDIT_INTERNAL_BE_CAREFUL_ALLOW_FAILURE: "${{ inputs.internal-be-careful-allow-failure }}"
GHA_PIP_AUDIT_INTERNAL_BE_CAREFUL_EXTRA_FLAGS: "${{ inputs.internal-be-careful-extra-flags }}"
shell: bashFile: tests/sample-actions/gh-action-pypi-publish.yml
https://github.com/pypa/gh-action-pypi-publish/blob/2f6f737ca5f74c637829c0f5c3acd0e29ea5e8bf/action.yml
Copyright 2019 Sviatoslav Sydorenko
Licensed under the BSD-3-Clause License
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this
list of conditions and the following disclaimer in the documentation and/or other
materials provided with the distribution.
3. Neither the name of gh-action-pypi-publish nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.
name: pypi-publish
inputs:
user:
required: false
default: token
password:
required: false
repository-url: # Canonical alias for repository_url
required: false
repository_url: # DEPRECATED ALIAS; TODO: Remove in v3+
[DEPRECATED]
The repository URL to use
deprecationMessage: >-
The inputs have been normalized to use kebab-case.
Use repository-url instead.
required: false
default: https://upload.pypi.org/legacy/
packages-dir: # Canonical alias for packages_dir
required: false
# default: dist # TODO: uncomment once alias removed
packages_dir: # DEPRECATED ALIAS; TODO: Remove in v3+
[DEPRECATED]
The target directory for distribution
deprecationMessage: >-
The inputs have been normalized to use kebab-case.
Use packages-dir instead.
required: false
default: dist
verify-metadata: # Canonical alias for verify_metadata
required: false
# default: 'true' # TODO: uncomment once alias removed
verify_metadata: # DEPRECATED ALIAS; TODO: Remove in v3+
[DEPRECATED]
Check metadata before uploading
deprecationMessage: >-
The inputs have been normalized to use kebab-case.
Use verify-metadata instead.
required: false
default: "true"
skip-existing: # Canonical alias for skip_existing
Do not fail if a Python package distribution
exists in the target package index
required: false
# default: 'false' # TODO: uncomment once alias removed
skip_existing: # DEPRECATED ALIAS; TODO: Remove in v3+
[DEPRECATED]
Do not fail if a Python package distribution
exists in the target package index
deprecationMessage: >-
The inputs have been normalized to use kebab-case.
Use skip-existing instead.
required: false
default: "false"
verbose:
required: false
default: "false"
print-hash: # Canonical alias for print_hash
required: false
# default: 'false' # TODO: uncomment once alias removed
print_hash: # DEPRECATED ALIAS; TODO: Remove in v3+
[DEPRECATED]
Show hash values of files to be uploaded
deprecationMessage: >-
The inputs have been normalized to use kebab-case.
Use print-hash instead.
required: false
default: "false"
branding:
color: yellow
icon: upload-cloud
runs:
using: docker
image: Dockerfile
args:
- ${{ inputs.user }}
- ${{ inputs.password }}
- ${{ inputs.repository-url }}
- ${{ inputs.packages-dir }}
- ${{ inputs.verify-metadata }}
- ${{ inputs.skip-existing }}
- ${{ inputs.verbose }}
- ${{ inputs.print-hash }}
File: tests/sample-actions/gh-action-sigstore-python.yml
https://github.com/sigstore/gh-action-sigstore-python/blob/b3690e3a279c94669b1e9e4e1e29317cdc7a52d5/action.yml
Copyright 2022 The Sigstore Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
name: "gh-action-sigstore-python"
author: "Sigstore Authors [email protected]"
inputs:
inputs:
required: true
default: ""
identity-token:
required: false
default: ""
oidc-client-id:
required: false
default: ""
oidc-client-secret:
required: false
default: ""
signature:
required: false
default: ""
certificate:
required: false
default: ""
bundle:
required: false
default: ""
fulcio-url:
required: false
default: ""
rekor-url:
required: false
default: ""
ctfe:
required: false
default: ""
rekor-root-pubkey:
required: false
default: ""
staging:
required: false
default: false
verify:
required: false
default: false
verify-cert-identity:
verify the identity in the signing certificate's Subject Alternative Name
required if `verify` is enabled; has no effect otherwise.
required: false
default: "" verify-oidc-issuer:
verify the issuer extension of the signing certificate
required if `verify` is enabled; has no effect otherwise.
required: false
default: "" upload-signing-artifacts:
required: false
default: false
release-signing-artifacts:
required: false
default: false
internal-be-careful-debug:
required: false
default: false
runs:
using: "composite"
steps:
- name: Set up sigstore-python
run: |
# NOTE: Sourced, not executed as a script.
source "${GITHUB_ACTION_PATH}/setup/setup.bash"
env:
GHA_SIGSTORE_PYTHON_INTERNAL_BE_CAREFUL_DEBUG: "${{ inputs.internal-be-careful-debug }}"
shell: bash
- name: Run sigstore-python
id: sigstore-python
run: |
${GITHUB_ACTION_PATH}/action.py "${GHA_SIGSTORE_PYTHON_INPUTS}"
env:
# The year is 2023, and nonsense like this is still necessary on Windows.
PYTHONUTF8: "1"
GHA_SIGSTORE_PYTHON_IDENTITY_TOKEN: "${{ inputs.identity-token }}"
GHA_SIGSTORE_PYTHON_SIGNATURE: "${{ inputs.signature }}"
GHA_SIGSTORE_PYTHON_CERTIFICATE: "${{ inputs.certificate }}"
GHA_SIGSTORE_PYTHON_BUNDLE: "${{ inputs.bundle }}"
GHA_SIGSTORE_PYTHON_OIDC_CLIENT_ID: "${{ inputs.oidc-client-id }}"
GHA_SIGSTORE_PYTHON_OIDC_CLIENT_SECRET: "${{ inputs.oidc-client-secret }}"
GHA_SIGSTORE_PYTHON_FULCIO_URL: "${{ inputs.fulcio-url }}"
GHA_SIGSTORE_PYTHON_REKOR_URL: "${{ inputs.rekor-url }}"
GHA_SIGSTORE_PYTHON_CTFE: "${{ inputs.ctfe }}"
GHA_SIGSTORE_PYTHON_REKOR_ROOT_PUBKEY: "${{ inputs.rekor-root-pubkey }}"
GHA_SIGSTORE_PYTHON_STAGING: "${{ inputs.staging }}"
GHA_SIGSTORE_PYTHON_VERIFY: "${{ inputs.verify }}"
GHA_SIGSTORE_PYTHON_VERIFY_CERT_IDENTITY: "${{ inputs.verify-cert-identity }}"
GHA_SIGSTORE_PYTHON_VERIFY_OIDC_ISSUER: "${{ inputs.verify-oidc-issuer }}"
GHA_SIGSTORE_PYTHON_RELEASE_SIGNING_ARTIFACTS: "${{ inputs.release-signing-artifacts }}"
GHA_SIGSTORE_PYTHON_INTERNAL_BE_CAREFUL_DEBUG: "${{ inputs.internal-be-careful-debug }}"
GHA_SIGSTORE_PYTHON_INPUTS: "${{ inputs.inputs }}"
shell: bash
- uses: actions/upload-artifact@v4
if: inputs.upload-signing-artifacts == 'true'
with:
name: "signing-artifacts-${{ github.job }}"
path: "${{ env.GHA_SIGSTORE_PYTHON_INTERNAL_SIGNING_ARTIFACTS }}"
- uses: softprops/action-gh-release@v1
if: inputs.release-signing-artifacts == 'true' && github.event_name == 'release' && github.event.action == 'published'
with:
files: "${{ env.GHA_SIGSTORE_PYTHON_INTERNAL_SIGNING_ARTIFACTS }}"File: tests/sample-actions/no-input-output-descriptions.yml
ensures that we parse actions without input/output descriptions correctly
see: https://github.com/woodruffw/zizmor/issues/501
inputs:
foo:
default: "lol"
outputs:
bar:
value: "hmm"
runs:
using: "composite"
steps:
- name: say hello
run: echo hello
shell: bash
File: tests/sample-actions/setup-python.yml
https://github.com/actions/setup-python/blob/e9d6f990972a57673cdb72ec29e19d42ba28880f/action.yml
Copyright 2018 GitHub, Inc. and contributors
Licensed under the MIT License
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
name: "Setup Python"
author: "GitHub"
inputs:
python-version:
python-version-file:
cache:
required: false
architecture:
check-latest:
default: false
token:
default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
cache-dependency-path:
update-environment:
default: true
allow-prereleases:
default: false
outputs:
python-version:
cache-hit:
python-path:
runs:
using: "node20"
main: "dist/setup/index.js"
post: "dist/cache-save/index.js"
post-if: success()
branding:
icon: "code"
color: "yellow"
File: tests/sample-dependabot/v2/pip-audit.yml
https://github.com/pypa/pip-audit/blob/cea0e0276f1208cfcbda0c5d69b4fc0c084747b2/.github/dependabot.yml
version: 2
updates:
package-ecosystem: pip
directory: /
schedule:
interval: dailypackage-ecosystem: github-actions
directory: /
schedule:
interval: daily
File: tests/sample-dependabot/v2/sigstore-python.yml
https://github.com/sigstore/sigstore-python/blob/e0168a781b87d059fde05dfdfe0ce82e564ce095/.github/dependabot.yml
Copyright 2022 The Sigstore Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
version: 2
updates:
package-ecosystem: pip
directory: /
schedule:
interval: dailypackage-ecosystem: github-actions
directory: /
schedule:
interval: daily
open-pull-requests-limit: 99
rebase-strategy: "disabled"
groups:
actions:
patterns:
- "*"package-ecosystem: github-actions
directory: .github/actions/upload-coverage/
schedule:
interval: daily
open-pull-requests-limit: 99
rebase-strategy: "disabled"
groups:
actions:
patterns:
- "*"
File: tests/sample-workflows/adafruit-circuitpython-run-tests.yml
https://github.com/adafruit/circuitpython/blob/24a8927d0ce1d77addd584bf809ab73cb0386e75/.github/workflows/run-tests.yml
Copyright 2013-2023 Damien P. George
Licensed under the MIT License
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
name: Run tests
on:
workflow_call:
inputs:
cp-version:
required: true
type: string
jobs:
run:
runs-on: ubuntu-24.04
strategy:
fail-fast: false
matrix:
test: [all, mpy, native, native_mpy]
env:
CP_VERSION: ${{ inputs.cp-version }}
MICROPY_CPYTHON3: python3.12
MICROPY_MICROPYTHON: ../ports/unix/build-coverage/micropython
TEST_all:
TEST_mpy: --via-mpy -d basics float micropython
TEST_native: --emit native
TEST_native_mpy: --via-mpy --emit native -d basics float micropython
steps:
- name: Set up repository
uses: actions/checkout@v4
with:
submodules: false
show-progress: false
fetch-depth: 1
- name: Set up python
uses: actions/setup-python@v5
with:
python-version: 3.12
- name: Set up submodules
uses: ./.github/actions/deps/submodules
with:
target: tests
- name: Set up external
if: matrix.test == 'all'
uses: ./.github/actions/deps/external
- name: Set up mpy-cross
uses: ./.github/actions/mpy_cross
with:
cp-version: ${{ inputs.cp-version }}
- name: Build unix port
run: make -C ports/unix VARIANT=coverage -j4
- name: Run tests
run: ./run-tests.py -j4 ${{ env[format('TEST_{0}', matrix.test)] }}
working-directory: tests
- name: Print failure info
run: ./run-tests.py -j4 --print-failures
if: failure()
working-directory: tests
# Not working after MicroPython v1.23 merge.
# - name: Build native modules
# if: matrix.test == 'all'
# run: |
# make -C examples/natmod/features1
# make -C examples/natmod/features2
# make -C examples/natmod/heapq
# make -C examples/natmod/random
# make -C examples/natmod/re
# - name: Test native modules
# if: matrix.test == 'all'
# run: ./run-natmodtests.py extmod/{heapq*,random*,re*}.py
# working-directory: tests
File: tests/sample-workflows/false-condition.yml
https://github.com/woodruffw/zizmor/issues/209
name: Name
on: [push]
jobs:
build:
runs-on: ubuntu-22.04
steps:
- name: Step
if: false
run: echo
File: tests/sample-workflows/gh-action-sigstore-python-selftest.yml
https://github.com/sigstore/gh-action-sigstore-python/blob/b3690e3a279c94669b1e9e4e1e29317cdc7a52d5/.github/workflows/selftest.yml
Copyright 2022 The Sigstore Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
name: Self-test
on:
push:
branches:
- main
pull_request:
workflow_dispatch:
workflow_call:
permissions:
id-token: write
jobs:
selftest:
strategy:
matrix:
os:
- ubuntu-latest
- macos-latest
- windows-latest
runs-on: ${{ matrix.os }}
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
if: ${{ matrix.os != 'ubuntu-latest' }}
with:
python-version: "3.x"
- name: Sign artifact and publish signature
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
internal-be-careful-debug: true
- name: Check outputs
shell: bash
run: |
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
selftest-release-signing-artifacts-no-op:
strategy:
matrix:
os:
- ubuntu-latest
- macos-latest
- windows-latest
runs-on: ${{ matrix.os }}
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
if: ${{ matrix.os != 'ubuntu-latest' }}
with:
python-version: "3.x"
- name: Sign artifact and publish signature
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
# The trigger for this test is not a release, so this has no effect
# (but does not break the workflow either).
release-signing-artifacts: true
internal-be-careful-debug: true
- name: Check outputs
shell: bash
run: |
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
selftest-xfail-invalid-inputs:
runs-on: ubuntu-latest
strategy:
matrix:
input:
# We forbid inputs that look like flags
- "--this-should-not-work"
# We fail if the input doesn't exist
- "/tmp/extremely-nonexistent-file"
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifact and publish signature
continue-on-error: true
uses: ./
id: sigstore-python
with:
inputs: ${{ matrix.input }}
internal-be-careful-debug: true
- name: Check failure
env:
XFAIL: ${{ steps.sigstore-python.outcome == 'failure' }}
JOB_NAME: ${{ github.job }}
run: |
echo "xfail ${JOB_NAME}: ${XFAIL}"
[[ "${XFAIL}" == "true" ]] || { >&2 echo "expected step to fail"; exit 1; } selftest-staging:
runs-on: ubuntu-latest
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifact and publish signature
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
staging: true
internal-be-careful-debug: true
- name: Check outputs
run: |
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
selftest-glob:
runs-on: ubuntu-latest
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifacts and publish signatures
uses: ./
id: sigstore-python
with:
inputs: ./test/*.txt
staging: true
internal-be-careful-debug: true
- name: Check outputs
run: |
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
[[ -f ./test/artifact1.txt.sigstore ]] || exit 1
[[ -f ./test/artifact2.txt.sigstore ]] || exit 1
selftest-xfail-glob-input-expansion:
runs-on: ubuntu-latest
env:
TEST_DIR: test
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifacts and publish signatures
continue-on-error: true
uses: ./
id: sigstore-python
with:
# This should fail since we should never directly expand ${TEST_DIR};
# the user should have to pre-expand it for us.
inputs: ./${TEST_DIR}/*.txt
staging: true
internal-be-careful-debug: true
- name: Check failure
env:
XFAIL: ${{ steps.sigstore-python.outcome == 'failure' }}
JOB_NAME: ${{ github.job }}
run: |
echo "xfail ${JOB_NAME}: ${XFAIL}"
[[ "${XFAIL}" == "true" ]] || { >&2 echo "expected step to fail"; exit 1; } selftest-glob-multiple:
runs-on: ubuntu-latest
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifacts and publish signatures
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact*.txt ./test/another*.txt ./test/subdir/*.txt
staging: true
internal-be-careful-debug: true
- name: Check outputs
run: |
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
[[ -f ./test/artifact1.txt.sigstore ]] || exit 1
[[ -f ./test/artifact2.txt.sigstore ]] || exit 1
[[ -f ./test/another1.txt.sigstore ]] || exit 1
[[ -f ./test/another2.txt.sigstore ]] || exit 1
[[ -f ./test/subdir/hello1.txt.sigstore ]] || exit 1
[[ -f ./test/subdir/hello2.txt.sigstore ]] || exit 1
[[ -f ./test/subdir/hello3.txt.sigstore ]] || exit 1
selftest-upload-artifacts:
runs-on: ubuntu-latest
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifact and publish signature
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
staging: true
upload-signing-artifacts: true
internal-be-careful-debug: true
- uses: actions/download-artifact@v4
with:
name: "signing-artifacts-${{ github.job }}"
path: ./test/uploaded
- name: Verify presence of uploaded files
run: |
[[ -f ./artifact.txt ]] || exit 1
[[ -f ./artifact.txt.sigstore ]] || exit 1
working-directory: ./test/uploaded
selftest-custom-paths:
runs-on: ubuntu-latest
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifact and publish signature
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
signature: ./test/custom_signature.sig
certificate: ./test/custom_certificate.crt
bundle: ./test/custom_bundle.sigstore
staging: true
internal-be-careful-debug: true
- name: Check outputs
run: |
[[ -f ./test/custom_signature.sig ]] || exit 1
[[ -f ./test/custom_certificate.crt ]] || exit 1
[[ -f ./test/custom_bundle.sigstore ]] || exit 1
selftest-verify:
runs-on: ubuntu-latest
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifact and publish signature
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
verify: true
verify-cert-identity: https://github.com/sigstore/gh-action-sigstore-python/.github/workflows/selftest.yml@${{ github.ref }}
verify-oidc-issuer: https://token.actions.githubusercontent.com
staging: true
internal-be-careful-debug: true
selftest-xfail-verify-missing-options:
runs-on: ubuntu-latest
strategy:
matrix:
config:
# fails if both verify-cert-identity and verify-oidc-issuer are missing
- verify: true
# fails if either is missing
- verify: true
verify-oidc-issuer: https://token.actions.githubusercontent.com
- verify: true
verify-cert-identity: https://github.com/sigstore/gh-action-sigstore-python/.github/workflows/selftest.yml@${{ github.ref }}
# fails if either option is passed while verification is disabled
- verify: false
verify-oidc-issuer: https://token.actions.githubusercontent.com
- verify: false
verify-cert-identity: https://github.com/sigstore/gh-action-sigstore-python/.github/workflows/selftest.yml@${{ github.ref }}
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Sign artifact and publish signature
continue-on-error: true
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
verify: ${{ matrix.config.verify }}
verify-oidc-issuer: ${{ matrix.config.verify-oidc-issuer }}
verify-cert-identity: ${{ matrix.config.verify-cert-identity }}
staging: true
internal-be-careful-debug: true
- name: Check failure
env:
XFAIL: ${{ steps.sigstore-python.outcome == 'failure' }}
JOB_NAME: ${{ github.job }}
run: |
echo "xfail ${JOB_NAME}: ${XFAIL}"
[[ "${XFAIL}" == "true" ]] || { >&2 echo "expected step to fail"; exit 1; } selftest-identity-token:
runs-on: ubuntu-latest
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
steps:
- uses: actions/checkout@v4
- name: Get OIDC token
id: get-oidc-token
run: |
identity_token=$(
curl -H
"Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN"
"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore"
| jq -r .value
)
echo "identity-token=$identity_token" >> $GITHUB_OUTPUT
shell: bash
- name: Sign artifact and publish signature
uses: ./
id: sigstore-python
with:
inputs: ./test/artifact.txt
identity-token: ${{ steps.get-oidc-token.outputs.identity-token }}
staging: true
internal-be-careful-debug: true
all-selftests-pass:
if: always()
needs:
- selftest
- selftest-release-signing-artifacts-no-op
- selftest-xfail-invalid-inputs
- selftest-staging
- selftest-glob
- selftest-glob-multiple
- selftest-upload-artifacts
- selftest-custom-paths
- selftest-verify
- selftest-xfail-verify-missing-options
- selftest-identity-token
runs-on: ubuntu-latest
steps:
- name: check test jobs
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
with:
jobs: ${{ toJSON(needs) }}File: tests/sample-workflows/git-annex-built-windows.yaml
https://github.com/datalad/git-annex/blob/58898b7a9185a94852ac059c3ff1cc3f2fd6deef/.github/workflows/build-windows.yaml
Copyright 2022 The Sigstore Authors
Licensed under the GNU AFFERO GENERAL PUBLIC LICENSE Version 3
https://git-annex.branchable.com/license/AGPL
name: Build git-annex on Windows
on:
Trigger the workflow on pull requests
pull_request:
paths:
- ".github/workflows/build-windows.yaml"
- "patches/*.patch"
schedule:
- cron: "30 03 * * *"
workflow_dispatch:
inputs:
commitish:
pr:
defaults:
run:
shell: bash
env:
LANG: C.utf-8
jobs:
build-package:
runs-on: windows-2019
outputs:
build-version: ${{ steps.build-version.outputs.version }}
steps:
- name: Checkout this repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Create pending PR status
if: github.event.inputs.pr != ''
run: |
.github/workflows/tools/set-pr-status \
"${{ github.event.inputs.pr }}" \
Windows \
build-package \
pending
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Setup Haskell
uses: haskell/actions/setup@v2
with:
enable-stack: true
stack-no-global: true
- name: Handle long filenames
run: git config --system core.longpaths true
- name: Determine git-annex ref to build
run: |
. .github/workflows/tools/set-build-commit
echo "BUILD_COMMIT=$BUILD_COMMIT" >> "$GITHUB_ENV"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
INPUT_PR: ${{ github.event.inputs.pr }}
INPUT_COMMITISH: ${{ github.event.inputs.commitish }}
- name: Check out source files
run: |
# The goal here is for $BUILD_COMMIT to be the HEAD (necessary for
# git-annex's version detection to use the correct git commit) with
# the .github/, clients/, and patches/ trees from master — or
# whatever ref is being used as the workflow source — also available.
git reset --soft "$BUILD_COMMIT"
# Avoid checking out unnecessary files with paths that are invalid on
# Windows.
git ls-tree --name-only HEAD | grep -v '^doc$' | xargs git checkout HEAD
git checkout HEAD doc/license ':(glob)doc/*.mdwn' ':(glob)doc/logo*'
git checkout "$GITHUB_SHA" -- .github clients patches
- name: Get build version
id: build-version
run: |
version="$(git describe "$BUILD_COMMIT" | sed -e 's/-/+git/')"
arch=x64
echo "Building $version"
echo "version=${version}_$arch" >> "$GITHUB_OUTPUT"
- name: Apply local patches
run: |
.github/workflows/tools/apply-patches patches ${{ github.event_name }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Download and "install" libmagic for windows
run: |
gh release download -R datalad/file-windows -p file-windows-dist.zip
unzip file-windows-dist.zip
cp libmagic-1.dll libmagic.dll
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Choose stack config and enable building with magic
run: |
# Need to use that LTS ATM on Windows
# ref: https://github.com/datalad/git-annex/issues/168#issuecomment-1665910564
cp stack-lts-18.13.yaml stack.yaml
perl -pli -e 's/magicmime: false/magicmime: true/' stack.yaml
- name: Set UPGRADE_LOCATION
run: |
# This tells git-annex where to upgrade itself from.
echo "UPGRADE_LOCATION=http://downloads.kitenet.net/git-annex/windows/current/git-annex-installer.exe" >> "$GITHUB_ENV"
- name: Run stack --version
run: stack --version
- name: stack setup
run: stack setup
# At this point, stack.yaml.lock exists, so we can activate the cache
- name: Enable Stack cache
uses: actions/cache@v4
with:
path: 'C:\sr\snapshots'
key: cache-stack-windows-${{ hashFiles('stack.yaml.lock') }}-${{ hashFiles('git-annex.cabal') }}
restore-keys: |
cache-stack-windows-
- name: Build dependencies
run: stack build --only-dependencies --extra-include-dirs=$PWD --extra-lib-dirs=$PWD
- name: Update version info for git rev being built.
run: |
mkdir -p dist
stack ghc --no-haddock Build/BuildVersion.hs
./Build/BuildVersion > dist/build-version
- name: Build git-annex
run: stack install --no-haddock --local-bin-path .
- name: Build the installer
run: |
stack ghc --no-haddock --package nsis Build/NullSoftInstaller.hs
TMP="$PWD" ./Build/NullSoftInstaller
- name: Add version to installer name
run: |
mv git-annex-installer.exe \
git-annex-installer_"${{ steps.build-version.outputs.version }}".exe
- name: Upload packages
uses: actions/upload-artifact@v4
with:
name: git-annex-windows-installer_${{ steps.build-version.outputs.version }}
path: |
git-annex[-_]*.*
dist/build-version
- name: Create new release
if: github.event.inputs.commitish != ''
run: |
printf '[DEBUG] INPUT_COMMITISH=%b\n' "$INPUT_COMMITISH"
if git rev-parse refs/tags/"$INPUT_COMMITISH" &> /dev/null
then
echo "[INFO] Building a tag; uploading assets to release ..."
echo '[DEBUG] BEGIN gh release list'
gh release list | tee releases.txt | cat -v
echo '[DEBUG] END gh release list'
if grep -q "^$INPUT_COMMITISH\b" releases.txt
then
echo "[INFO] Release already exists; uploading assets"
gh release upload "$INPUT_COMMITISH" git-annex[-_]*.*
else
echo "[INFO] Creating release"
gh release create \
--notes "This is an unofficial release build provided by the DataLad team." \
"$INPUT_COMMITISH" git-annex[-_]*.*
fi
else
echo "[INFO] Not building a tag; no release to make"
fi
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
INPUT_COMMITISH: ${{ github.event.inputs.commitish }}
- name: Set final PR status
if: always() && github.event.inputs.pr != ''
run: |
.github/workflows/tools/set-pr-status \
"${{ github.event.inputs.pr }}" \
Windows \
build-package \
"${{ job.status }}"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Send e-mail on failed run
if: failure() && contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name)
uses: dawidd6/action-send-mail@v3
with:
server_address: ${{ secrets.NOTIFY_SMTP_HOST }}
server_port: ${{ secrets.NOTIFY_SMTP_PORT }}
username: ${{ secrets.NOTIFY_SMTP_USERNAME }}
password: ${{ secrets.NOTIFY_SMTP_PASSWORD }}
from: GitHub Actions Notifications
to: ${{ secrets.NOTIFY_RECIPIENT }}
subject: "[${{ github.repository }}] Build on Windows failed!"
body: |
A build (via ${{ github.event_name }}) of git-annex for Windows failed!
See <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}> for more information. test-annex:
runs-on: ${{ matrix.os }}
needs: build-package
strategy:
matrix:
flavor: ["normal", "custom-config1"]
os: [windows-2019]
fail-fast: false
steps:
- name: Checkout this repository
uses: actions/checkout@v4
- name: Create pending PR status
if: github.event.inputs.pr != ''
run: |
.github/workflows/tools/set-pr-status \
"${{ github.event.inputs.pr }}" \
Windows \
"test-annex (${{ matrix.flavor }}, ${{ matrix.os }})" \
pending
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Download git-annex package
uses: actions/download-artifact@v4
with:
name: git-annex-windows-installer_${{ needs.build-package.outputs.build-version }}
- name: Install git-annex package
shell: powershell
run: |
./git-annex-installer_*.exe /S
- name: Check that magic files are installed
run: |
GIT_ANNEX_PATH="$(type -p git-annex)"
echo "git-annex is at $GIT_ANNEX_PATH"
GIT_ANNEX_DIR="$(dirname "$GIT_ANNEX_PATH")"
ls "$GIT_ANNEX_DIR"/*magic* "$GIT_ANNEX_DIR"/*gnurx*
ls "$GIT_ANNEX_DIR"/../share/misc/*magic*
- name: Check git-annex version for MagicMime flag
run: |
git annex version | grep 'build flags:.*MagicMime'
- name: Print git-annex version
run: git annex version
- name: Run tests
run: |
# Do it after we possibly setup HOME
git config --global user.email "[email protected]"
git config --global user.name "GitHub Almighty"
test_opts=( )
case "${{ matrix.flavor }}" in
# For git-annex it causes only few temporary directories to be on the crippled FS,
# while the main ones produced by git annex test reside in CWD, for which we use
# $HOME
custom-config1)
test_opts=( --test-git-config annex.stalldetection=1KB/120s )
;;
*)
;;
esac
cd $HOME
export | grep -e crippledfs || :
timeout 3600 git annex test "${test_opts[@]:-}"
- name: Set final PR status
if: always() && github.event.inputs.pr != ''
run: |
.github/workflows/tools/set-pr-status \
"${{ github.event.inputs.pr }}" \
Windows \
"test-annex (${{ matrix.flavor }}, ${{ matrix.os }})" \
"${{ job.status }}"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Send e-mail on failed run
if: failure() && contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name)
uses: dawidd6/action-send-mail@v3
with:
server_address: ${{ secrets.NOTIFY_SMTP_HOST }}
server_port: ${{ secrets.NOTIFY_SMTP_PORT }}
username: ${{ secrets.NOTIFY_SMTP_USERNAME }}
password: ${{ secrets.NOTIFY_SMTP_PASSWORD }}
from: GitHub Actions Notifications
to: ${{ secrets.NOTIFY_RECIPIENT }}
subject: "[${{ github.repository }}] Tests of Windows build failed!"
body: |
The tests for a build (via ${{ github.event_name }}) of git-annex for Windows (flavor: ${{ matrix.flavor }}, OS: ${{ matrix.os }}) failed!
See <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}> for more information. test-datalad:
runs-on: windows-2019
needs: build-package
strategy:
matrix:
version: [master, maint, release]
fail-fast: false
steps:
- name: Checkout this repository
uses: actions/checkout@v4
- name: Create pending PR status
if: github.event.inputs.pr != ''
run: |
.github/workflows/tools/set-pr-status \
"${{ github.event.inputs.pr }}" \
Windows \
"test-datalad (${{ matrix.version }})" \
pending
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Download git-annex package
uses: actions/download-artifact@v4
with:
name: git-annex-windows-installer_${{ needs.build-package.outputs.build-version }}
- name: Install git-annex package
shell: powershell
run: |
./git-annex-installer_*.exe /S
- name: Define test host alias
shell: cmd
run: |
echo. >> %SYSTEMROOT%\System32\drivers\etc\hosts
echo.127.0.0.1 datalad-test >> %SYSTEMROOT%\System32\drivers\etc\hosts
echo.127.0.0.1 datalad-test2 >> %SYSTEMROOT%\System32\drivers\etc\hosts
- name: OpenSSH server setup
shell: powershell
run: |
mkdir downloads
Invoke-WebRequest -Uri https://github.com/PowerShell/Win32-OpenSSH/releases/download/v7.6.1.0p1-Beta/OpenSSH-Win32.zip -OutFile downloads\openssh.zip
7z x -o"downloads" downloads\openssh.zip
- name: Install
shell: cmd
run: powershell.exe -ExecutionPolicy Bypass -File downloads\OpenSSH-Win32\install-sshd.ps1
- name: Configure service
shell: cmd
run: powershell.exe New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
- name: Keys in default place
run: ssh-keygen -f ~/.ssh/id_rsa -N ""
- name: Authorize access with these keys
shell: cmd
run: |
copy %USERPROFILE%\.ssh\id_rsa.pub %USERPROFILE%\.ssh\authorized_keys
- name: Configure SSH
run: |
(
echo Host localhost
echo StrictHostKeyChecking no
echo Host datalad-test
echo StrictHostKeyChecking no
echo Host datalad-test2
echo StrictHostKeyChecking no
) > "$USERPROFILE"/.ssh/config
- name: Fire up service
run: net start sshd
- name: Test login
run: |
ssh -v localhost exit
ssh datalad-test exit
ssh datalad-test2 exit
- name: Enable SSH tests
run: echo DATALAD_TESTS_SSH=1 >> "$GITHUB_ENV"
- name: Set up environment
run: |
git config --global user.email "[email protected]"
git config --global user.name "GitHub Almighty"
- name: Set up Python 3.8
uses: actions/setup-python@v5
with:
python-version: 3.8
- name: Install ${{ matrix.version }} Datalad
run: |
if [ "${{ matrix.version }}" = "release" ]; then
commitish="$(gh api --jq .tag_name repos/datalad/datalad/releases/latest)"
else
commitish="${{ matrix.version }}"
fi
python -m pip install --upgrade pip
pip install git+https://github.com/datalad/datalad@${commitish}
env:
# Authorize so that we don't run up against low API rate limits
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install nose et al (just in case!)
run: pip install nose pytest vcrpy mock
- name: WTF!?
run: datalad wtf
# needed for ssh certs under ubuntu and tox.ini everywhere
- name: Checkout datalad
uses: actions/checkout@v4
with:
path: datalad
fetch-depth: 1
- name: Run datalad tests
run: |
mkdir -p __testhome__
cd __testhome__
python -m pytest -c ../datalad/tox.ini -s -v --pyargs datalad
- name: Set final PR status
if: always() && github.event.inputs.pr != ''
run: |
.github/workflows/tools/set-pr-status \
"${{ github.event.inputs.pr }}" \
Windows \
"test-datalad (${{ matrix.version }})" \
"${{ job.status }}"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}vim:set et sts=2:
File: tests/sample-workflows/guacsec-guac-ci.yml
https://github.com/guacsec/guac/blob/85868eadbf6a287f9bf5f47d355ff944080d3845/.github/workflows/ci.yaml
Copyright 2022 The GUAC Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
name: ci
on:
workflow_dispatch: # testing only, trigger manually to test it works
push:
branches:
- main
pull_request:
branches:
- main
types:
- opened
- synchronize
- reopened
permissions:
contents: read
jobs:
test-integration:
runs-on: ubuntu-latest
name: CI for integration tests
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v3
- name: setup-go
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # tag=v3.2.1
with:
go-version: "1.21"
- uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
- name: Install atlas
uses: ariga/setup-atlas@d52cd13fed38eca914fa57071155a4644fd6f820 # v0.2
- name: Setup the project
run: go mod download
- name: Run backends
shell: bash
run: |
set -euo pipefail
cd internal/testing/backend
docker compose up -d
sleep 10
echo "backends started"
- name: Run integration tests
env:
ENT_TEST_DATABASE_URL: "postgresql://guac:guac@localhost/guac?sslmode=disable"
run: make integration-test
test-unit:
runs-on: ubuntu-latest
name: CI for unit tests
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v3
- name: setup-go
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # tag=v3.2.1
with:
go-version: "1.21"
- uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
- name: Install atlas
uses: ariga/setup-atlas@d52cd13fed38eca914fa57071155a4644fd6f820 # v0.2
- name: Setup the project
run: go mod download
- name: Run tests
run: make test
static-analysis:
name: Static Analysis
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v3
- name: setup-go
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # tag=v3.2.1
with:
go-version: "1.21"
- name: Install atlas
uses: ariga/setup-atlas@d52cd13fed38eca914fa57071155a4644fd6f820 # v0.2
- name: Install formatter
run: go install golang.org/x/tools/cmd/goimports@latest
- name: Check format
run: make fmt
- name: Check that all generated code is up to date
run: make generated_up_to_date
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v3
- name: setup-go
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # tag=v5.1.0
with:
go-version: "1.21"
- name: Install atlas
uses: ariga/setup-atlas@d52cd13fed38eca914fa57071155a4644fd6f820 # v0.2
- name: golangci-lint
uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # tag=v3.2.0
with:
only-new-issues: true
skip-cache: true
- name: Check markdown format
run: make format
- name: Check that all linted text is up to date
run: make generated_up_to_date
- name: Run atlas Lint
run: make atlas-lint
end-to-end:
name: E2E
runs-on: ubuntu-latest
services:
postgres:
image: postgres:15
env:
POSTGRES_USER: guac
POSTGRES_PASSWORD: guac
POSTGRES_DB: guac
ports:
- 5432:5432
options: >-
--health-cmd "pg_isready -U guac -d guac"
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed
with:
go-version: "~1.21"
- uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
with:
python-version: "3.10"
- name: Install PostgreSQL client tools
run: |
sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
sudo apt-get update
sudo apt-get install -y postgresql-client-15
- name: Set up NATS Server with JetStream
run: |
docker run -d --name nats-server -p 4222:4222 -p 8222:8222 nats:2.9.17 -js
- name: Wait for PostgreSQL to be ready
run: |
until pg_isready -h localhost -p 5432 -U guac -d guac; do
echo "Waiting for PostgreSQL to be ready..."
sleep 5
done
- name: Run e2e tests
run: |
./internal/testing/e2e/e2e
env:
POSTGRES_USER: guac
POSTGRES_PASSWORD: guac
POSTGRES_DB: guac
POSTGRES_HOST: localhost
POSTGRES_PORT: 5432
PGPASSWORD: guac
GUAC_DIR: /home/runner/work/guac/guac
tilt-ci:
name: Run 'tilt ci'
runs-on:
labels: ubuntu-latest
timeout-minutes: 30
steps:
- name: Install tools
shell: bash
run: |
sudo apt-get install -y git uuid-runtime
# tilt -- https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh
case $(uname -m) in
aarch64) ARCH=arm64;;
armv7l) ARCH=arm;;
*) ARCH=$(uname -m);;
esac
VERSION=0.32.0
curl -fsSL https://github.com/tilt-dev/tilt/releases/download/v$VERSION/tilt.$VERSION.linux.$ARCH.tar.gz | tar -xzvC /usr/local/bin tilt
# helm
case $(uname -m) in
aarch64) ARCH=arm64;;
armv7l) ARCH=arm;;
x86_64) ARCH=amd64;;
*) ARCH=$(uname -m);;
esac
VERSION=3.12.0
curl -fsSL https://get.helm.sh/helm-v$VERSION-linux-$ARCH.tar.gz | tar --strip-components=1 -xzvC /usr/local/bin linux-$ARCH/helm
# ctlptl - https://github.com/tilt-dev/ctlptl/blob/main/INSTALL.md
CTLPTL_VERSION="0.8.19"
curl -fsSL https://github.com/tilt-dev/ctlptl/releases/download/v$CTLPTL_VERSION/ctlptl.$CTLPTL_VERSION.linux.x86_64.tar.gz | sudo tar -xzv -C /usr/local/bin ctlptl
# kind - https://kind.sigs.k8s.io/docs/user/quick-start/#installing-from-release-binaries
# For AMD64 / x86_64
[ $(uname -m) = x86_64 ] && curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.19.0/kind-linux-amd64
# For ARM64
[ $(uname -m) = aarch64 ] && curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.19.0/kind-linux-arm64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
- name: Install GoReleaser
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
with:
install-only: true
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v3
- name: setup-go
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # tag=v3.2.1
with:
go-version: "1.21"
- uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
- name: Setup the project
run: go mod download
- name: Setup kind cluster
shell: bash
run: |
ctlptl create cluster kind --registry=ctlptl-registry
- name: Run 'tilt ci'
shell: bash
run: |
tilt ci
- name: Diag after failure
if: ${{ failure() }}
shell: bash
run: |
echo "K8S CLUSTER STATUS"
kubectl get all
echo ""
for pod in $(kubectl get pod | awk '$1 != "NAME" { print $1; }')
do
echo ""
echo "=== DIAG POD ${pod} ==="
echo ""
kubectl describe "pod/${pod#pod/}" | sed 's,^, ,'
doneFile: tests/sample-workflows/homebrew-core-automerge-triggers.yml
https://github.com/Homebrew/homebrew-core/blob/ac74cb3f7dbdb2da2200886d5e740de124bab861/.github/workflows/automerge-triggers.yml
Copyright 2009-2024, Homebrew contributors
Licensed under the BSD 2-Clause License
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
name: Trigger automerge
on:
pull_request_review:
types:
- submitted
pull_request_target:
types:
- unlabeled
- ready_for_review
jobs:
check:
if: >
github.repository_owner == 'Homebrew' &&
((github.event_name == 'pull_request_review' && github.event.review.state == 'approved') ||
(github.event_name == 'pull_request_target' &&
(github.event.action == 'ready_for_review' || github.event.label.name == 'automerge-skip')))
runs-on: ubuntu-latest
steps:
- run: true # This suffices to trigger automerge.yml.
File: tests/sample-workflows/homebrew-core-dispatch-rebottle.yml
https://github.com/Homebrew/homebrew-core/blob/8b4101be35fb7053e2026edcf1f7d218a5ac3379/.github/workflows/dispatch-rebottle.yml#L4
Copyright 2009-2024, Homebrew contributors
Licensed under the BSD 2-Clause License
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
name: Dispatch rebottle (for all currently bottled OS versions)
run-name: Rebuild bottles of ${{ inputs.formula }}
on:
workflow_dispatch:
inputs:
formula:
required: true
reason:
required: true
timeout:
type: number
default: 60
required: false
issue:
type: number
required: false
upload:
type: boolean
default: false
required: false
fail-fast:
type: boolean
default: true
required: false
Intentionally the same as dispatch-build-bottle
concurrency: bottle-${{ github.event.inputs.formula }}
permissions:
contents: read
env:
HOMEBREW_DEVELOPER: 1
HOMEBREW_GITHUB_ACTIONS: 1
HOMEBREW_NO_AUTO_UPDATE: 1
HOMEBREW_NO_INSTALL_FROM_API: 1
HOMEBREW_NO_BUILD_ERROR_ISSUES: 1
RUN_URL: ${{github.event.repository.html_url}}/actions/runs/${{github.run_id}}
DISPATCH_REBOTTLE_SENDER: ${{ github.event.sender.login }}
DISPATCH_REBOTTLE_FORMULA: ${{ inputs.formula }}
DISPATCH_REBOTTLE_TIMEOUT: ${{ inputs.timeout }}
DISPATCH_REBOTTLE_ISSUE: ${{ inputs.issue }}
DISPATCH_REBOTTLE_UPLOAD: ${{ inputs.upload }}
DISPATCH_REBOTTLE_REASON: ${{ inputs.reason }}
jobs:
setup:
runs-on: ubuntu-22.04
container:
image: ghcr.io/homebrew/ubuntu22.04:master
outputs:
runners: ${{steps.determine-runners.outputs.runners}}
steps:
- name: Set up Homebrew
id: set-up-homebrew
uses: Homebrew/actions/setup-homebrew@master
with:
core: true
cask: false
test-bot: false
- name: Determine runners
id: determine-runners
run: brew determine-rebottle-runners "${DISPATCH_REBOTTLE_FORMULA}" "${DISPATCH_REBOTTLE_TIMEOUT}" bottle:
permissions:
contents: read
needs: setup
strategy:
matrix:
include: ${{fromJson(needs.setup.outputs.runners)}}
fail-fast: ${{inputs.fail-fast}}
runs-on: ${{matrix.runner}}
container: ${{matrix.container}}
timeout-minutes: ${{fromJson(inputs.timeout)}}
defaults:
run:
shell: /bin/bash -e {0}
working-directory: ${{matrix.workdir || github.workspace}}
env:
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
BOTTLES_DIR: ${{ matrix.workdir || github.workspace }}/bottles
steps:
- name: ${{inputs.formula}}
id: print_details
run: |
echo sender="${DISPATCH_REBOTTLE_SENDER}"
echo formula="${DISPATCH_REBOTTLE_FORMULA}"
echo timeout="${DISPATCH_REBOTTLE_TIMEOUT}"
echo issue="${DISPATCH_REBOTTLE_ISSUE}"
echo upload="${DISPATCH_REBOTTLE_UPLOAD}"
echo reason="${DISPATCH_REBOTTLE_REASON}"
- name: Pre-test steps
uses: Homebrew/actions/pre-build@master
with:
bottles-directory: ${{ env.BOTTLES_DIR }}
- run: |
brew test-bot --only-formulae --only-json-tab --skip-online-checks \
--skip-dependents \
"${DISPATCH_REBOTTLE_FORMULA}"
working-directory: ${{ env.BOTTLES_DIR }}
env:
HOMEBREW_GITHUB_API_TOKEN: ${{secrets.GITHUB_TOKEN}}
- name: Post-build steps
if: always()
uses: Homebrew/actions/post-build@master
with:
runner: ${{ matrix.runner }}
bottles-directory: ${{ env.BOTTLES_DIR }}
logs-directory: ${{ env.BOTTLES_DIR }}/logs upload:
permissions:
issues: write # for Homebrew/actions/post-comment
contents: write # for Homebrew/actions/git-try-push
packages: write # for brew pr-upload
pull-requests: write # for gh pr
attestations: write # for actions/attest-build-provenance
id-token: write # for actions/attest-build-provenance
runs-on: ubuntu-22.04
needs: bottle
if: inputs.upload
container:
image: ghcr.io/homebrew/ubuntu22.04:master
defaults:
run:
shell: bash
env:
HOMEBREW_SIMULATE_MACOS_ON_LINUX: 1
GH_REPO: ${{github.repository}}
GH_NO_UPDATE_NOTIFIER: 1
GH_PROMPT_DISABLED: 1
BOTTLE_BRANCH: ${{github.actor}}/dispatch/${{inputs.formula}}/${{github.run_id}}
BOTTLES_DIR: ${{ github.workspace }}/bottles
steps:
- name: Set up Homebrew
id: set-up-homebrew
uses: Homebrew/actions/setup-homebrew@master
with:
core: true
cask: false
test-bot: false
- name: Download bottles from GitHub Actions
uses: actions/download-artifact@v4
with:
pattern: bottles_*
path: ${{ env.BOTTLES_DIR }}
merge-multiple: true
- name: Setup git
id: git-user-config
uses: Homebrew/actions/git-user-config@master
with:
username: ${{ (github.actor != 'github-actions[bot]' && github.actor) || 'BrewTestBot' }}
- name: Set up commit signing
uses: Homebrew/actions/setup-commit-signing@master
with:
signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
- name: Generate build provenance
uses: actions/attest-build-provenance@v1
with:
subject-path: ${{ env.BOTTLES_DIR }}/*.tar.gz
- name: Checkout branch for bottle commit
working-directory: ${{steps.set-up-homebrew.outputs.repository-path}}
run: git checkout -b "$BOTTLE_BRANCH" origin/master
- name: Upload bottles to GitHub Packages
id: upload
env:
HOMEBREW_GITHUB_PACKAGES_USER: brewtestbot
HOMEBREW_GITHUB_PACKAGES_TOKEN: ${{secrets.HOMEBREW_CORE_GITHUB_PACKAGES_TOKEN}}
HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
BREWTESTBOT_NAME_EMAIL: "BrewTestBot <[email protected]>"
HOMEBREW_CORE_PATH: ${{steps.set-up-homebrew.outputs.repository-path}}
working-directory: ${{ env.BOTTLES_DIR }}
run: |
brew pr-upload --verbose --committer="$BREWTESTBOT_NAME_EMAIL" --root-url="https://ghcr.io/v2/homebrew/core" --debug
echo "title=$(git -C "$HOMEBREW_CORE_PATH" log -1 --format='%s' "$BOTTLE_BRANCH")" >> "$GITHUB_OUTPUT"
echo "head_sha=$(git -C "$HOMEBREW_CORE_PATH" rev-parse HEAD)" >> "$GITHUB_OUTPUT"
- name: Push commits
uses: Homebrew/actions/git-try-push@master
with:
token: ${{secrets.GITHUB_TOKEN}}
directory: ${{steps.set-up-homebrew.outputs.repository-path}}
branch: ${{env.BOTTLE_BRANCH}}
env:
GIT_COMMITTER_NAME: BrewTestBot
GIT_COMMITTER_EMAIL: [email protected]
HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
- name: Open PR with bottle commit
id: create-pr
uses: Homebrew/actions/create-pull-request@master
with:
token: ${{secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN}}
base: ${{github.ref}}
head: ${{env.BOTTLE_BRANCH}}
title: ${{steps.upload.outputs.title}}
body: |
Created by [`dispatch-rebottle.yml`](${{env.RUN_URL}})
-----
${{env.DISPATCH_REBOTTLE_REASON}}
labels: CI-published-bottle-commits
reviewers: ${{github.actor}}
- name: Enable automerge
env:
GH_TOKEN: ${{secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN}}
NODE_ID: ${{steps.create-pr.outputs.node_id}}
SHA: ${{steps.upload.outputs.head_sha}}
MUTATION: |-
mutation ($input: EnablePullRequestAutoMergeInput!) {
enablePullRequestAutoMerge(input: $input) {
clientMutationId
}
}
run: |
gh api graphql \
--field "input[pullRequestId]=$NODE_ID" \
--field "input[expectedHeadOid]=$SHA" \
--raw-field query="$MUTATION"
- name: Approve PR
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR: ${{steps.create-pr.outputs.number}}
run: |
gh api \
--method POST \
--header "Accept: application/vnd.github+json" \
--header "X-GitHub-Api-Version: 2022-11-28" \
"/repos/$GITHUB_REPOSITORY/pulls/$PR/reviews" \
--field "event=APPROVE"
- name: Wait until PR is merged
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR: ${{ steps.create-pr.outputs.number }}
run: |
# Hold the `concurrency` lock for up to another 10 minutes while the PR has not yet been merged.
sleep 300
attempt=0
max_attempts=5
sleep_time=10
while (( attempt < max_attempts ))
do
if jq --exit-status .merged_at
then
break
fi < <( # We could use `gh pr view`, but that uses 2 API calls.
gh api \
--header "Accept: application/vnd.github+json" \
--header "X-GitHub-Api-Version: 2022-11-28" \
"/repos/$GITHUB_REPOSITORY/pulls/$PR"
)
sleep "$sleep_time"
sleep_time=$(( sleep_time * 2 ))
attempt=$(( attempt + 1 ))
done comment:
permissions:
issues: write # for Homebrew/actions/post-comment
pull-requests: write # for Homebrew/actions/post-comment
needs: [bottle, upload]
if: failure() && inputs.issue > 0
runs-on: ubuntu-latest
steps:
- name: Post comment on failure
uses: Homebrew/actions/post-comment@master
with:
token: ${{secrets.GITHUB_TOKEN}}
issue: ${{inputs.issue}}
body: ":x: @${{github.actor}} bottle request for ${{inputs.formula}} failed."
bot_body: ":x: Bottle request for ${{inputs.formula}} failed."
bot: BrewTestBot
File: tests/sample-workflows/intel-llvm-sycl-linux-run-tests.yml
https://github.com/intel/llvm/blob/776af8ed456bf7f10458ca171af1dd7ca27f8895/.github/workflows/sycl-linux-run-tests.yml
Licensed under the Apache License v2.0 with LLVM Exceptions.
Full terms: https://github.com/intel/llvm/blob/776af8ed456bf7f10458ca171af1dd7ca27f8895/LICENSE.TXT
name: SYCL E2E
on:
workflow_call:
inputs:
name:
type: string
required: True
runner:
type: string
required: True
image:
type: string
required: False
image_options:
type: string
required: True
target_devices:
type: string
required: False
extra_cmake_args:
type: string
required: False
tests_selector:
Three possible options: "e2e", "cts", and "compute-benchmarks".
type: string
default: "e2e"
extra_lit_opts:
Extra options to be added to LIT_OPTS.
type: string
default: ''
ref:
type: string
required: True
devops_ref:
type: string
required: False
By default we checkout the devops directory from "inputs.ref" branch.
devops_ref may be specified to checkout the devops dir from different
branch.
Note: it doesn't affect ./devops/actions/run-tests/* as these actions
call checkout again and therefore override the devops directory, so
configs/dependecies from input.ref are used.
sycl_toolchain_artifact:
type: string
default: ''
required: False
sycl_toolchain_archive:
type: string
default: ''
required: False
sycl_toolchain_decompress_command:
type: string
default: ''
required: False
e2e_binaries_artifact:
Must be set if `e2e_testing_mode` is equal to `run-only` and the
artifact must exist. Can be set in other modes resulting in artifact
upload.
type: string
default: ''
required: False
e2e_testing_mode:
Testing mode to run E2E tests in, can be either `full`, `build-only`
or `run-only`.
type: string
default: 'full'
retention-days:
type: string
default: 1
reset_intel_gpu:
type: string
required: False
install_igc_driver:
type: string
required: False
install_dev_igc_driver:
type: string
required: False
env:
type: string
default: '{}'
required: False
skip_run:
type: string
default: 'false'
required: False
cts_testing_mode:
Testing mode to run SYCL-CTS in, can be either `full`, `build-only`
or `run-only`. In `build-only` mode an artifact of the CTS binaries
will be uploaded.
type: string
default: 'full'
sycl_cts_artifact:
type: string
default: ''
required: False workflow_dispatch:
inputs:
runner:
type: choice
options:
- '["Linux", "gen12"]'
- '["amdgpu"]'
- '["Linux", "arc"]'
- '["Linux", "pvc"]'
- '["cts-cpu"]'
- '["Linux", "build"]'
- '["cuda"]'
image:
type: choice
options:
- 'ghcr.io/intel/llvm/sycl_ubuntu2404_nightly:latest'
- 'ghcr.io/intel/llvm/ubuntu2404_intel_drivers:alldeps'
image_options:
Use option with "--device=/dev/kfd" for AMDGPU, without it for the rest.
type: choice
options:
- '-u 1001 --device=/dev/dri --device=/dev/kfd --privileged --cap-add SYS_ADMIN'
- '-u 1001 --device=/dev/dri --privileged --cap-add SYS_ADMIN'
- '-u 1001 --gpus all --cap-add SYS_ADMIN'
target_devices:
type: choice
options:
- 'level_zero:gpu'
- 'opencl:cpu'
- 'opencl:gpu'
- 'opencl:fpga'
- 'hip:gpu'
- 'cuda:gpu'
tests_selector:
type: choice
options:
- e2e
- cts
- compute-benchmarks
env:
Suggested variables: for E2E tests - LIT_FILTER, LIT_FILTER_OUT.
LIT_OPTS won't work as we redefine it as part of this workflow.
For SYCL CTS - CTS_TESTS_TO_BUILD to specify which categories to
build, e.g. {"CTS_TESTS_TO_BUILD":"test_category1 test_category2..."}.
Format: '{"VAR1":"VAL1","VAR2":"VAL2",...}'
default: '{}'
extra_lit_opts:
Extra options to be added to LIT_OPTS.
default: ''
install_igc_driver:
type: choice
options:
- false
- true
install_dev_igc_driver:
type: choice
options:
- false
- true
e2e_testing_mode:
type: choice
options:
- "full"
- "build-only"permissions:
contents: read
packages: read
jobs:
run:
if: github.event_name == 'workflow_dispatch' || inputs.skip_run == 'false'
name: ${{ inputs.name }}
runs-on: ${{ fromJSON(inputs.runner) }}
container:
image: ${{ inputs.image || 'ghcr.io/intel/llvm/ubuntu2404_intel_drivers:alldeps'}}
options: ${{ inputs.image_options }}
env: ${{ fromJSON(inputs.env) }}
steps:
- name: Reset Intel GPU
if: inputs.reset_intel_gpu == 'true'
run: |
sudo mount -t debugfs none /sys/kernel/debug
sudo bash -c 'echo 1 > /sys/kernel/debug/dri/0/i915_wedged'
- uses: actions/checkout@v4
with:
ref: ${{ inputs.devops_ref || inputs.ref }}
sparse-checkout: |
devops
- name: Register cleanup after job is finished
uses: ./devops/actions/cleanup
- name: Install drivers
if: inputs.install_igc_driver == 'true' || inputs.install_dev_igc_driver == 'true'
env:
GITHUB_TOKEN: ${{ github.token }}
run: |
if [ "${{ inputs.install_dev_igc_driver }}" = "true" ]; then
# If libllvm14 is already installed (dev igc docker), still return true.
sudo apt-get install -yqq libllvm14 || true;
fi
sudo -E bash devops/scripts/install_drivers.sh devops/dependencies.json ${{ inputs.install_dev_igc_driver == 'true' && 'devops/dependencies-igc-dev.json --use-dev-igc' || '' }} --all
- name: Source OneAPI TBB vars.sh
shell: bash
run: |
# https://github.com/actions/runner/issues/1964 prevents us from using
# the ENTRYPOINT in the image.
env | sort > env_before
if [ -e /runtimes/oneapi-tbb/env/vars.sh ]; then
source /runtimes/oneapi-tbb/env/vars.sh;
elif [ -e /opt/runtimes/oneapi-tbb/env/vars.sh ]; then
source /opt/runtimes/oneapi-tbb/env/vars.sh;
else
echo "no TBB vars in /opt/runtimes or /runtimes";
fi
env | sort > env_after
comm -13 env_before env_after >> $GITHUB_ENV
rm env_before env_after
- name: Download SYCL toolchain
if: inputs.sycl_toolchain_artifact != '' && github.event_name != 'workflow_run'
uses: actions/download-artifact@v4
with:
name: ${{ inputs.sycl_toolchain_artifact }}
- name: Debug prints [workflow_run]
if: inputs.sycl_toolchain_artifact != '' && github.event_name == 'workflow_run'
run: |
pwd
ls
- name: Download SYCL toolchain [workflow_run]
if: inputs.sycl_toolchain_artifact != '' && github.event_name == 'workflow_run'
uses: actions/github-script@v7
with:
script: |
const name = '${{ inputs.sycl_toolchain_artifact }}'
let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: context.payload.workflow_run.id,
});
let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
return artifact.name == name
})[0];
let download = await github.rest.actions.downloadArtifact({
owner: context.repo.owner,
repo: context.repo.repo,
artifact_id: matchArtifact.id,
archive_format: 'zip',
});
let fs = require('fs');
fs.writeFileSync(${process.env.GITHUB_WORKSPACE}/ + name + '.zip', Buffer.from(download.data));
- name: Unzip artifact [workflow_run]
if: inputs.sycl_toolchain_artifact != '' && github.event_name == 'workflow_run'
run: |
pwd
ls
unzip ${{ inputs.sycl_toolchain_artifact }}.zip
rm ${{ inputs.sycl_toolchain_artifact }}.zip
- name: Extract/Setup SYCL toolchain
if: inputs.sycl_toolchain_artifact != ''
run: |
mkdir toolchain
tar -I '${{ inputs.sycl_toolchain_decompress_command }}' -xf ${{ inputs.sycl_toolchain_archive }} -C toolchain
rm -f ${{ inputs.sycl_toolchain_archive }}
echo PATH=$PWD/toolchain/bin/:$PATH >> $GITHUB_ENV
echo LD_LIBRARY_PATH=$PWD/toolchain/lib/:$LD_LIBRARY_PATH >> $GITHUB_ENV
- run: which clang++ sycl-ls
- run: sycl-ls --verbose
- run: SYCL_UR_TRACE=1 sycl-ls
- run: |
if [ -f /usr/local/lib/igc/IGCTAG.txt ]; then
cat /usr/local/lib/igc/IGCTAG.txt
fi
- name: Run E2E Tests
if: inputs.tests_selector == 'e2e'
uses: ./devops/actions/run-tests/e2e
with:
ref: ${{ inputs.ref || github.sha }}
binaries_artifact: ${{ inputs.e2e_binaries_artifact }}
testing_mode: ${{ inputs.e2e_testing_mode }}
extra_cmake_args: ${{ inputs.extra_cmake_args }}
target_devices: ${{ inputs.target_devices }}
extra_lit_opts: ${{ inputs.extra_lit_opts }}
retention-days: ${{ inputs.retention-days }}
- name: Run SYCL CTS Tests
if: inputs.tests_selector == 'cts'
uses: ./devops/actions/run-tests/cts
with:
extra_cmake_args: ${{ inputs.extra_cmake_args }}
cts_testing_mode: ${{ inputs.cts_testing_mode }}
sycl_cts_artifact: ${{ inputs.sycl_cts_artifact }}
target_devices: ${{ inputs.target_devices }}
retention-days: ${{ inputs.retention-days }}
- name: Run compute-benchmarks on SYCL
if: inputs.tests_selector == 'compute-benchmarks'
uses: ./devops/actions/run-tests/benchmark
with:
target_devices: ${{ inputs.target_devices }}
env:
RUNNER_TAG: ${{ inputs.runner }}
GITHUB_TOKEN: ${{ secrets.LLVM_SYCL_BENCHMARK_TOKEN }}File: tests/sample-workflows/issue-35.yml
https://github.com/zizmorcore/github-actions-models/issues/35
name: Test Workflow
permissions: {}
on: ["push"]
LIMIT = true|false
jobs:
test:
name: Test job
runs-on: ubuntu-24.04
strategy:
# max-parallel: 1
max-parallel: ${{ vars.LIMIT && 1 || 8 }}
steps:
- name: Test step
shell: bash
run: |
echo "Hello World!"
File: tests/sample-workflows/jazzband-tablib-docs-lint.yml
https://raw.githubusercontent.com/jazzband/tablib/dcab406c553fc8b3c2e0aef955e9e8adea0590d8/.github/workflows/docs-lint.yml
Copyright:
2016 Kenneth Reitz
2019 Jazzband
Licensed under the MIT License
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
name: Docs and lint
on: [push, pull_request, workflow_dispatch]
env:
FORCE_COLOR: 1
PIP_DISABLE_PIP_VERSION_CHECK: 1
permissions:
contents: read
jobs:
build:
runs-on: ubuntu-latest
strategy:
matrix:
env:
- TOXENV: docs
- TOXENV: lint
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.x"
cache: pip
cache-dependency-path: "pyproject.toml"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
python -m pip install --upgrade tox
- name: Tox
run: tox
env: ${{ matrix.env }}File: tests/sample-workflows/letsencrypt-boulder-boulder-ci.yml
https://github.com/letsencrypt/boulder/blob/e182d889b220421caefbf384b36467f771b5f8d3/.github/workflows/boulder-ci.yml
Boulder CI test suite workflow
Copyright: 2014-2024 The Boulder Developers
Licensed under the Mozilla Public License 2.0
https://github.com/letsencrypt/boulder/blob/main/LICENSE.txt
name: Boulder CI
Controls when the action will run.
on:
Triggers the workflow on push or pull request events but only for the main branch
push:
branches:
- main
- release-branch-*
pull_request:
branches:
- "**"
Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
A workflow run is made up of one or more jobs that can run sequentially or in parallel
permissions:
contents: read
jobs:
Main test jobs. This looks like a single job, but the matrix
items will multiply it. For example every entry in the
BOULDER_TOOLS_TAG list will run with every test. If there were two
tags and 5 tests there would be 10 jobs run.
b:
# The type of runner that the job will run on
runs-on: ubuntu-20.04
strategy:
# When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true
fail-fast: false
# Test matrix.
matrix:
# Add additional docker image tags here and all tests will be run with the additional image.
BOULDER_TOOLS_TAG:
- go1.23.1_2024-09-05
# Tests command definitions. Use the entire "docker compose" command you want to run.
tests:
# Run ./test.sh --help for a description of each of the flags.
- "./t.sh --lints --generate"
- "./t.sh --integration"
# Testing Config Changes:
# Config changes that have landed in main but not yet been applied to
# production can be made in `test/config-next/<component>.json`.
#
# Testing DB Schema Changes:
# Database migrations in `sa/_db-next/migrations` are only performed
# when `docker compose` is called using `-f docker-compose.yml -f
# docker-compose.next.yml`.
- "./tn.sh --integration"
- "./t.sh --unit --enable-race-detection"
- "./tn.sh --unit --enable-race-detection"
- "./t.sh --start-py"
env:
# This sets the docker image tag for the boulder-tools repository to
# use in tests. It will be set appropriately for each tag in the list
# defined in the matrix.
BOULDER_TOOLS_TAG: ${{ matrix.BOULDER_TOOLS_TAG }}
# Sequence of tasks that will be executed as part of the job.
steps:
# Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v4
with:
persist-credentials: false
- name: Docker Login
# You may pin to the exact commit or the version.
# uses: docker/login-action@f3364599c6aa293cdc2b8391b1b56d0c30e45c8a
uses: docker/[email protected]
with:
# Username used to log against the Docker registry
username: ${{ secrets.DOCKER_USERNAME}}
# Password or personal access token used to log against the Docker registry
password: ${{ secrets.DOCKER_PASSWORD}}
# Log out from the Docker registry at the end of a job
logout: true
continue-on-error: true
# Print the env variable being used to pull the docker image. For
# informational use.
- name: Print BOULDER_TOOLS_TAG
run: echo "Using BOULDER_TOOLS_TAG ${BOULDER_TOOLS_TAG}"
# Pre-pull the docker containers before running the tests.
- name: docker compose pull
run: docker compose pull
# Run the test matrix. This will run
- name: "Run Test: ${{ matrix.tests }}"
run: ${{ matrix.tests }} govulncheck:
runs-on: ubuntu-22.04
strategy:
fail-fast: false
steps:
# Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v4
with:
persist-credentials: false
- name: Setup Go
uses: actions/setup-go@v5
with:
# When Go produces a security release, we want govulncheck to run
# against the most recently released Go version.
check-latest: true
go-version: "stable"
- name: Run govulncheck
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./... vendorcheck:
runs-on: ubuntu-20.04
strategy:
# When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true
fail-fast: false
matrix:
go-version: ["1.22.5"]
steps:
# Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v4
with:
persist-credentials: false
- name: Setup Go ${{ matrix.go-version }}
uses: actions/setup-go@v5
with:
go-version: ${{ matrix.go-version }}
- name: Verify vendor
shell: bash
run: |
go mod tidy
go mod vendor
git diff --exit-codeThis is a utility build job to detect if the status of any of the
above jobs have failed and fail if so. It is needed so there can be
one static job name that can be used to determine success of the job
in GitHub branch protection.
It does not block on the result of govulncheck so that a new vulnerability
disclosure does not prevent any other PRs from being merged.
boulder_ci_test_matrix_status:
permissions:
contents: none
if: ${{ always() }}
runs-on: ubuntu-latest
name: Boulder CI Test Matrix
needs:
- b
- vendorcheck
steps:
- name: Check boulder ci test matrix status
if: ${{ needs.b.result != 'success' || needs.vendorcheck.result != 'success' }}
run: exit 1
File: tests/sample-workflows/mhils-workflows-python-deploy.yml
https://raw.githubusercontent.com/mhils/workflows/0d7c124ffff22d26be111477a3ed9fadd853a6db/.github/workflows/python-deploy.yml
MIT License
Copyright (c) 2022 Maximilian Hils
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Usage:
deploy:
uses: mhils/workflows/.github/workflows/python-deploy.yml@main
needs: check
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
secrets:
password: ${{ secrets.PYPI_TOKEN }}
permissions:
contents: read
on:
workflow_call:
inputs:
environment:
type: string
artifact-name:
type: string
artifact-pattern:
type: string
artifact-merge-multiple:
type: boolean
type: string
secrets:
username:
password:
required: true
jobs:
deploy:
environment: ${{ inputs.environment || 'deploy' }}
env:
TWINE_USERNAME: ${{ secrets.username || 'token' }}
TWINE_PASSWORD: ${{ secrets.password }}
TWINE_REPOSITORY: ${{ inputs.repository || 'pypi' }}
runs-on: ubuntu-latest
steps:
- name: Install twine from PyPI
uses: install-pinned/twine@6aec23fc537538d8e480e593660afa49a377c224 # 5.0.0
- uses: actions/download-artifact@v4
with:
name: ${{ inputs.artifact-name }}
pattern: ${{ inputs.artifact-pattern }}
merge-multiple: ${{ inputs.artifact-merge-multiple }}
path: dist/
- run: twine check dist/*
- run: twine upload dist/*
File: tests/sample-workflows/openbao-openbao-test-go.yml
https://github.com/openbao/openbao/blob/76c9470e8d03fce343f38854d10727775d571519/.github/workflows/test-go.yml
Copyright (c) 2015 HashiCorp, Inc.
Licensed under MPL 2.0:
https://github.com/openbao/openbao/blob/76c9470e8d03fce343f38854d10727775d571519/LICENSE
on:
workflow_call:
inputs:
go-arch:
required: true
type: string
total-runners:
required: true
type: string
binary-tests:
required: false
default: false
type: boolean
env-vars:
required: false
type: string
default: "{}"
extra-flags:
required: false
type: string
default: ""
runs-on:
required: false
type: string
default: ubuntu-latest
go-tags:
required: false
type: string
name:
required: false
default: ""
type: string
go-test-parallelism:
required: false
default: 20
type: number
timeout-minutes:
required: false
default: 60
type: number
testonly:
required: false
default: false
type: boolean
checkout-ref:
required: false
default: ${{ github.ref }}
type: string
env: ${{ fromJSON(inputs.env-vars) }}
jobs:
test-matrix:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
ref: ${{ inputs.checkout-ref }}
- uses: ./.github/actions/set-up-go
name: Setup Git configuration (public)
- uses: ./.github/actions/set-up-gotestsum
- run: mkdir -p test-results/go-test
- uses: actions/cache/restore@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
with:
path: test-results/go-test
key: go-test-reports-${{ github.run_number }}
restore-keys: go-test-reports-
- name: List cached results
id: list-cached-results
run: ls -lhR test-results/go-test
- name: Build matrix excluding binary, integration, and testonly tests
id: build-non-binary
if: ${{ !inputs.testonly }}
run: |
# testonly tests need additional build tag though let's exclude them anyway for clarity
(
go list ./... github.com/openbao/openbao/api/v2/... github.com/openbao/openbao/sdk/v2/... | grep -v "_binary" | grep -v "vault/integ" | grep -v "testonly" | gotestsum tool ci-matrix --debug
--partitions "${{ inputs.total-runners }}"
--timing-files 'test-results/go-test/.json' > matrix.json
)
- name: Build matrix for tests tagged with testonly
if: ${{ inputs.testonly }}
run: |
set -exo pipefail
# enable glob expansion
shopt -s nullglob
# testonly tagged tests need an additional tag to be included
# also running some extra tests for sanity checking with the testonly build tag
(
go list -tags=testonly ./vault/external_tests/{kv,token,replication-perf,testonly} ./vault/ | gotestsum tool ci-matrix --debug
--partitions "${{ inputs.total-runners }}"
--timing-files 'test-results/go-test/.json' > matrix.json
)
# disable glob expansion
shopt -u nullglob
- name: Capture list of binary tests
if: inputs.binary-tests
id: list-binary-tests
run: |
LIST="$(go list ./... github.com/openbao/openbao/api/v2/... github.com/openbao/openbao/sdk/v2/... | grep "_binary" | xargs)"
echo "list=$LIST" >> "$GITHUB_OUTPUT"
- name: Build complete matrix
id: build
run: |
set -exo pipefail
matrix_file="matrix.json"
if [ "${{ inputs.binary-tests}}" == "true" ] && [ -n "${{ steps.list-binary-tests.outputs.list }}" ]; then
export BINARY_TESTS="${{ steps.list-binary-tests.outputs.list }}"
jq --arg BINARY "${BINARY_TESTS}" --arg BINARY_INDEX "${{ inputs.total-runners }}"
'.include += [{
"id": $BINARY_INDEX,
"estimatedRuntime": "N/A",
"packages": $BINARY,
"description": "partition $BINARY_INDEX - binary test packages"
}]' matrix.json > new-matrix.json
matrix_file="new-matrix.json"
fi
# convert the json to a map keyed by id
(
echo -n "matrix="
jq -c
'.include | map( { (.id|tostring): . } ) | add' "$matrix_file"
) >> "$GITHUB_OUTPUT"
# extract an array of ids from the json
(
echo -n "matrix_ids="
jq -c
'[ .include[].id | tostring ]' "$matrix_file"
) >> "$GITHUB_OUTPUT"
outputs:
matrix: ${{ steps.build.outputs.matrix }}
matrix_ids: ${{ steps.build.outputs.matrix_ids }}
test-go:
needs: test-matrix
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
id: ${{ fromJSON(needs.test-matrix.outputs.matrix_ids) }}
env:
TIMEOUT_IN_MINUTES: ${{ inputs.timeout-minutes }}
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
ref: ${{ inputs.checkout-ref }}
- uses: ./.github/actions/set-up-go
- id: setup-git-public
name: Setup Git configuration (public)
run: |
git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
- id: build
if: inputs.binary-tests && matrix.id == inputs.total-runners
run: time make ci-bootstrap dev
- uses: ./.github/actions/set-up-gotestsum
- id: run-go-tests
name: Run Go tests
timeout-minutes: ${{ fromJSON(env.TIMEOUT_IN_MINUTES) }}
env:
COMMIT_SHA: ${{ github.sha }}
run: |
set -exo pipefail
# Build the dynamically generated source files.
make prep
packages=$(echo "${{ toJSON(needs.test-matrix.outputs.matrix) }}" | jq -c -r --arg id "${{ matrix.id }}" '.[$id] | .packages')
if [ -z "$packages" ]; then
echo "no test packages to run"
exit 1
fi
# shellcheck disable=SC2034
if [ -f bin/bao ]; then
BAO_BINARY="$(pwd)/bin/bao"
export BAO_BINARY
fi
# On a release branch, add a flag to rerun failed tests
# shellcheck disable=SC2193 # can get false positive for this comparision
if [[ "${{ github.base_ref }}" == release/* ]] || [[ -z "${{ github.base_ref }}" && "${{ github.ref_name }}" == release/* ]]
then
RERUN_FAILS="--rerun-fails"
fi
# shellcheck disable=SC2086 # can't quote RERUN_FAILS
GOARCH=${{ inputs.go-arch }} \
gotestsum --format=short-verbose \
--junitfile test-results/go-test/results-${{ matrix.id }}.xml \
--jsonfile test-results/go-test/results-${{ matrix.id }}.json \
--jsonfile-timing-events failure-summary-${{ matrix.id }}${{ inputs.name != '' && '-' || '' }}${{ inputs.name }}.json \
$RERUN_FAILS \
--packages "$packages" \
-- \
-tags "${{ inputs.go-tags }}" \
-timeout=${{ env.TIMEOUT_IN_MINUTES }}m \
-parallel=${{ inputs.go-test-parallelism }} \
${{ inputs.extra-flags }} \
- name: Archive test results
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
with:
name: test-results-${{ matrix.id }}${{ inputs.name != '' && '-' || '' }}${{ inputs.name }}
path: test-results/go-test-${{ matrix.id }}
if: success() || failure()
# GitHub Actions doesn't expose the job ID or the URL to the job execution,
# so we have to fetch it from the API
- name: Fetch job logs URL
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
if: success() || failure()
continue-on-error: true
with:
retries: 3
script: |
// We surround the whole script with a try-catch block, to avoid each of the matrix jobs
// displaying an error in the GHA workflow run annotations, which gets very noisy.
// If an error occurs, it will be logged so that we don't lose any information about the reason for failure.
try {
const fs = require("fs");
const result = await github.rest.actions.listJobsForWorkflowRun({
owner: context.repo.owner,
per_page: 100,
repo: context.repo.repo,
run_id: context.runId,
});
// Determine what job name to use for the query. These values are hardcoded, because GHA doesn't
// expose them in any of the contexts available within a workflow run.
let prefixToSearchFor;
switch ("${{ inputs.name }}") {
case "race":
prefixToSearchFor = 'Run Go tests with data race detection / test-go (${{ matrix.id }})'
break
case "fips":
prefixToSearchFor = 'Run Go tests with FIPS configuration / test-go (${{ matrix.id }})'
break
default:
prefixToSearchFor = 'Run Go tests / test-go (${{ matrix.id }})'
}
const jobData = result.data.jobs.filter(
(job) => job.name.startsWith(prefixToSearchFor)
);
const url = jobData[0].html_url;
const envVarName = "GH_JOB_URL";
const envVar = envVarName + "=" + url;
const envFile = process.env.GITHUB_ENV;
fs.appendFile(envFile, envVar, (err) => {
if (err) throw err;
console.log("Successfully set " + envVarName + " to: " + url);
});
} catch (error) {
console.log("Error: " + error);
return
}
- name: Prepare failure summary
if: success() || failure()
continue-on-error: true
run: |
# This jq query filters out successful tests, leaving only the failures.
# Then, it formats the results into rows of a Markdown table.
# An example row will resemble this:
# | github.com/openbao/openbao/package | TestName | fips | 0 | 2 | [view results](github.com/link-to-logs) |
jq -r -n 'inputs
| select(.Action == "fail")
| "| ${{inputs.name}} | \(.Package) | \(.Test // "-") | \(.Elapsed) | ${{ matrix.id }} | [view test results :scroll:](${{ env.GH_JOB_URL }}) |"' \
failure-summary-${{ matrix.id }}${{ inputs.name != '' && '-' || '' }}${{inputs.name}}.json \
>> failure-summary-${{ matrix.id }}${{ inputs.name != '' && '-' || '' }}${{inputs.name}}.md
- name: Upload failure summary
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
if: success() || failure()
with:
name: failure-summary-${{ matrix.id }}${{ inputs.name != '' && '-' || '' }}${{inputs.name}}
path: failure-summary-${{ matrix.id }}${{ inputs.name != '' && '-' || '' }}${{inputs.name}}.md test-collect-reports:
if: ${{ ! cancelled() }}
needs: test-go
runs-on: ubuntu-latest
steps:
- uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
with:
path: test-results/go-test
key: go-test-reports-${{ github.run_number }}
restore-keys: go-test-reports-
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
path: test-results/go-test
pattern: test-results-*
merge-multiple: true
- run: |
ls -lhR test-results/go-test
find test-results/go-test -type f -mindepth 1 -mtime +3 -delete
ls -lhR test-results/go-test
File: tests/sample-workflows/pip-api-test.yml
https://github.com/di/pip-api/blob/60691ed6bdc0c213253593de869bff1cf9195b81/.github/workflows/test.yml
Copyright: 2018-2024 Dustin Ingram
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
name: Test
on: [push, pull_request]
concurrency:
group: >-
${{
github.workflow
}}-${{
github.ref_type
}}-${{
github.event.pull_request.number || github.sha
}}
cancel-in-progress: true
env:
dists-artifact-name: python-package-distributions
sdist-artifact-name-wildcard: pip-api-*.tar.gz
jobs:
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup python
uses: actions/setup-python@v5
- name: Install tox
run: python -m pip install tox
- name: Run linting
run: python -m tox -e lint
build-sdist:
name: 📦 Build the source distribution
runs-on: ubuntu-latest
steps:
- name: Grab the src from GH
uses: actions/checkout@v4
- name: Install `pypa/build` PEP 517 front-end
run: python -m pip install 'build ~= 0.10.0'
- name: 📦 Build an sdist
run: python -m build --sdist
- name: Verify that the artifact with expected name got created
run: >-
ls -1
dist/${{ env.sdist-artifact-name-wildcard }}
- name: Store the distribution package
uses: actions/upload-artifact@v3
with:
name: ${{ env.dists-artifact-name }}
# NOTE: Exact expected file names are specified here
# NOTE: as a safety measure — if anything weird ends
# NOTE: up being in this dir or not all dists will be
# NOTE: produced, this will fail the workflow.
path: |
dist/${{ env.sdist-artifact-name-wildcard }}
retention-days: 15 build-matrix:
name: Build the test matrix
needs: lint
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
steps:
- uses: actions/checkout@v4
- name: Setup python
uses: actions/setup-python@v5
- name: Install tox
run: python -m pip install tox
- id: set-matrix
run: >-
echo "matrix=$(python generate_matrix.py)" >> "${GITHUB_OUTPUT}"
test:
name: ${{ matrix.toxenv }}
needs:
- build-matrix
- build-sdist
runs-on: ubuntu-latest
strategy:
matrix: ${{ fromJson(needs.build-matrix.outputs.matrix) }}
steps:
- name: Retrieve the project source from an sdist inside the GHA artifact
uses: re-actors/checkout-python-sdist@release/v1
with:
source-tarball-name: ${{ env.sdist-artifact-name-wildcard }}
workflow-artifact-name: ${{ env.dists-artifact-name }}
- name: Setup python
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- name: Install tox
run: python -m pip install tox
- name: Run tests
run: python -m tox -e ${{ matrix.toxenv }}
check:
if: always()
needs:
- test
runs-on: ubuntu-latest
steps:
- name: Decide whether the needed jobs succeeded or failed
uses: re-actors/alls-green@release/v1
with:
jobs: ${{ toJSON(needs) }}
File: tests/sample-workflows/pip-audit-ci.yml
https://github.com/pypa/pip-audit/blob/1fd67af0653a8e66b9470adab2e408a435632f19/.github/workflows/ci.yml
Copyright: 2021-2024 Alex Cameron
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
name: CI
on:
push:
branches:
- main
pull_request:
schedule:
- cron: "0 12 * * *"
jobs:
test:
strategy:
matrix:
python:
- "3.8"
- "3.9"
- "3.10"
- "3.11"
- "3.12"
runs-on: ubuntu-latest
steps:
- uses: actions/[email protected]
- uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python }}
cache: "pip"
cache-dependency-path: pyproject.toml
- name: test
run: make test PIP_AUDIT_EXTRA=testFile: tests/sample-workflows/pip-audit-scorecards.yml
https://github.com/pypa/pip-audit/blob/1fd67af0653a8e66b9470adab2e408a435632f19/.github/workflows/scorecards.yml
Copyright: 2021-2024 Alex Cameron
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
name: Scorecards supply-chain security
on:
Only the default branch is supported.
branch_protection_rule:
schedule:
- cron: "19 4 * * 0"
push:
branches: ["main"]
Declare default permissions as read only.
permissions: read-all
jobs:
analysis:
name: Scorecards analysis
runs-on: ubuntu-latest
permissions:
# Needed to upload the results to code-scanning dashboard.
security-events: write
# Used to receive a badge. (Upcoming feature)
id-token: write
steps:
- name: "Checkout code"
uses: actions/[email protected] # tag=v3.0.0
with:
persist-credentials: false
- name: "Run analysis"
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # tag=v2.3.1
with:
results_file: results.sarif
results_format: sarif
# Publish the results for public repositories to enable scorecard badges. For more details, see
# https://github.com/ossf/scorecard-action#publishing-results.
# For private repositories, `publish_results` will automatically be set to `false`, regardless
# of the value entered here.
publish_results: true
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # tag=v3.1.3
with:
name: SARIF file
path: results.sarif
retention-days: 5
# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # tag=v2.13.4
with:
sarif_file: results.sarifFile: tests/sample-workflows/pwn-requests.yml
from: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
Copyright: 2021 Jaroslav Lobačevski
License: Unknown, maybe fair use? Code comes from blog post.
INSECURE. Provided as an example only.
on: pull_request_target
jobs:
build:
name: Build and test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
ref: ${{ github.event.pull_request.head.sha }}
- uses: actions/setup-node@v1
- run: |
npm install
npm build
- uses: completely/fakeaction@v2
with:
arg1: ${{ secrets.supersecret }}
- uses: fakerepo/comment-on-pr@v1
with:
message: |
Thank you!File: tests/sample-workflows/pyca-cryptography-ci.yml
https://github.com/pyca/cryptography/blob/4a42c1c961c678d784de763d82794527c2374f2f/.github/workflows/ci.yml
Copyright 2013-2024, Individual Contributors to pyca/cryptography
License: Apache-2.0 license OR BSD-3-Clause license
name: CI
on:
pull_request: {}
push:
branches:
- main
- '..x'
tags:
- '.'
- '..*'
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
cancel-in-progress: true
env:
CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
CARGO_INCREMENTAL: 0
jobs:
linux:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
PYTHON:
- {VERSION: "3.12", NOXSESSION: "flake"}
- {VERSION: "3.12", NOXSESSION: "rust"}
- {VERSION: "3.12", NOXSESSION: "docs", OPENSSL: {TYPE: "openssl", VERSION: "3.2.0"}}
- {VERSION: "pypy-3.9", NOXSESSION: "tests-nocoverage"}
- {VERSION: "pypy-3.10", NOXSESSION: "tests-nocoverage"}
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1w"}}
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.0.12"}}
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.1.4"}}
- {VERSION: "3.12", NOXSESSION: "tests-ssh", OPENSSL: {TYPE: "openssl", VERSION: "3.2.0"}}
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.2.0", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct no-psk"}}
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.2.0", CONFIG_FLAGS: "no-legacy", NO_LEGACY: "1"}}
- {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.1.4"}}
- {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.2.0"}}
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "libressl", VERSION: "3.7.3"}}
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "libressl", VERSION: "3.8.2"}}
- {VERSION: "3.12", NOXSESSION: "tests-randomorder"}
# Latest commit on the BoringSSL master branch, as of Dec 22, 2023.
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "boringssl", VERSION: "b6e0eba6e62333652290514e51b75b966b27b27c"}}
# Latest commit on the OpenSSL master branch, as of Jan 02, 2024.
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "94be985cbcc1f0a5cf4f172d4a8d06c5c623122b"}}
# Builds with various Rust versions. Includes MSRV and next
# potential future MSRV:
# 1.64 - maturin, workspace inheritance
# 1.65 - Generic associated types (GATs)
- {VERSION: "3.12", NOXSESSION: "rust-noclippy,tests", RUST: "1.63.0"}
- {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "1.64.0"}
- {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "beta"}
- {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "nightly"}
timeout-minutes: 15
steps:
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
timeout-minutes: 3
with:
persist-credentials: false
- name: Setup python
id: setup-python
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
python-version: ${{ matrix.PYTHON.VERSION }}
cache: pip
cache-dependency-path: ci-constraints-requirements.txt
timeout-minutes: 3
- name: Setup rust
uses: dtolnay/rust-toolchain@1482605bfc5719782e1267fd0c0cc350fe7646b8
with:
toolchain: ${{ matrix.PYTHON.RUST }}
components: rustfmt,clippy
if: matrix.PYTHON.RUST
- run: rustup component add llvm-tools-preview
if: matrix.PYTHON.NOXSESSION != 'flake' && matrix.PYTHON.NOXSESSION != 'docs'
- name: Clone test vectors
timeout-minutes: 2
uses: ./.github/actions/fetch-vectors
if: matrix.PYTHON.NOXSESSION != 'flake' && matrix.PYTHON.NOXSESSION != 'docs' && matrix.PYTHON.NOXSESSION != 'rust'
- name: Compute config hash and set config vars
run: |
DEFAULT_CONFIG_FLAGS="shared no-ssl2 no-ssl3"
CONFIG_FLAGS="$DEFAULT_CONFIG_FLAGS $CONFIG_FLAGS"
OPENSSL_HASH=$(echo "${{ matrix.PYTHON.OPENSSL.TYPE }}-${{ matrix.PYTHON.OPENSSL.VERSION }}-$CONFIG_FLAGS" | sha1sum | sed 's/ .*$//')
echo "CONFIG_FLAGS=${CONFIG_FLAGS}" >> $GITHUB_ENV
echo "OPENSSL_HASH=${OPENSSL_HASH}" >> $GITHUB_ENV
echo "OSSL_INFO=${{ matrix.PYTHON.OPENSSL.TYPE }}-${{ matrix.PYTHON.OPENSSL.VERSION }}-${CONFIG_FLAGS}" >> $GITHUB_ENV
echo "OSSL_PATH=${{ github.workspace }}/osslcache/${{ matrix.PYTHON.OPENSSL.TYPE }}-${{ matrix.PYTHON.OPENSSL.VERSION }}-${OPENSSL_HASH}" >> $GITHUB_ENV
env:
CONFIG_FLAGS: ${{ matrix.PYTHON.OPENSSL.CONFIG_FLAGS }}
if: matrix.PYTHON.OPENSSL
- name: Load OpenSSL cache
uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
id: ossl-cache
timeout-minutes: 2
with:
path: ${{ github.workspace }}/osslcache
# When altering the openssl build process you may need to increment
# the value on the end of this cache key so that you can prevent it
# from fetching the cache and skipping the build step.
key: ${{ matrix.PYTHON.OPENSSL.TYPE }}-${{ matrix.PYTHON.OPENSSL.VERSION }}-${{ env.OPENSSL_HASH }}-9
if: matrix.PYTHON.OPENSSL
- name: Build custom OpenSSL/LibreSSL
run: .github/workflows/build_openssl.sh
env:
TYPE: ${{ matrix.PYTHON.OPENSSL.TYPE }}
VERSION: ${{ matrix.PYTHON.OPENSSL.VERSION }}
if: matrix.PYTHON.OPENSSL && steps.ossl-cache.outputs.cache-hit != 'true'
- name: Set CFLAGS/LDFLAGS
run: |
echo "OPENSSL_DIR=${OSSL_PATH}" >> $GITHUB_ENV
echo "CFLAGS=${CFLAGS} -Werror=implicit-function-declaration" >> $GITHUB_ENV
echo "RUSTFLAGS=-Clink-arg=-Wl,-rpath=${OSSL_PATH}/lib -Clink-arg=-Wl,-rpath=${OSSL_PATH}/lib64" >> $GITHUB_ENV
if: matrix.PYTHON.OPENSSL
- name: Cache rust and pip
uses: ./.github/actions/cache
timeout-minutes: 2
with:
# We have both the Python version from the matrix and from the
# setup-python step because the latter doesn't distinguish
# pypy3-3.8 and pypy3-3.9 -- both of them show up as 7.3.11.
key: ${{ matrix.PYTHON.VERSION }}-${{ steps.setup-python.outputs.python-version }}-${{ matrix.PYTHON.NOXSESSION }}-${{ env.OPENSSL_HASH }}
- run: python -m pip install -c ci-constraints-requirements.txt 'nox' 'tomli; python_version < "3.11"'
- name: Create nox environment
run: |
nox -v --install-only
env:
NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
CARGO_TARGET_DIR: ${{ format('{0}/src/rust/target/', github.workspace) }}
- name: Tests
run: |
nox --no-install -- --color=yes --wycheproof-root=wycheproof --x509-limbo-root=x509-limbo ${{ matrix.PYTHON.NOXARGS }}
env:
NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
COLUMNS: 80
CRYPTOGRAPHY_OPENSSL_NO_LEGACY: ${{ matrix.PYTHON.OPENSSL.NO_LEGACY }}
CARGO_TARGET_DIR: ${{ format('{0}/src/rust/target/', github.workspace) }}
- uses: ./.github/actions/upload-coverage distros:
runs-on: ${{ matrix.IMAGE.RUNNER }}
container: ghcr.io/pyca/cryptography-runner-${{ matrix.IMAGE.IMAGE }}
strategy:
fail-fast: false
matrix:
IMAGE:
- {IMAGE: "rhel8", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "rhel8-fips", NOXSESSION: "tests", RUNNER: "ubuntu-latest", FIPS: true}
- {IMAGE: "buster", NOXSESSION: "tests-nocoverage", RUNNER: "ubuntu-latest"}
- {IMAGE: "bullseye", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "bookworm", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "trixie", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "sid", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "ubuntu-focal", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "ubuntu-jammy", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "ubuntu-rolling", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "fedora", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "alpine", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "centos-stream9", NOXSESSION: "tests", RUNNER: "ubuntu-latest"}
- {IMAGE: "centos-stream9-fips", NOXSESSION: "tests", RUNNER: "ubuntu-latest", FIPS: true}
- {IMAGE: "ubuntu-jammy:aarch64", NOXSESSION: "tests", RUNNER: [self-hosted, Linux, ARM64]}
- {IMAGE: "alpine:aarch64", NOXSESSION: "tests", RUNNER: [self-hosted, Linux, ARM64]}
timeout-minutes: 15
env:
RUSTUP_HOME: /root/.rustup
steps:
- name: Ridiculous alpine workaround for actions support on arm64
run: |
# This modifies /etc/os-release so the JS actions
# from GH can't detect that it's on alpine:aarch64. It will
# then use a glibc nodejs, which works fine when gcompat
# is installed in the container (which it is)
sed -i "s:ID=alpine:ID=NotpineForGHA:" /etc/os-release
if: matrix.IMAGE.IMAGE == 'alpine:aarch64'
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
timeout-minutes: 3
with:
persist-credentials: false
- name: Cache rust and pip
uses: ./.github/actions/cache
timeout-minutes: 2
with:
key: ${{ matrix.IMAGE.IMAGE }}
- name: Clone test vectors
timeout-minutes: 2
uses: ./.github/actions/fetch-vectors
# When run in a docker container the home directory doesn't have the same owner as the
# apparent user so pip refuses to create a cache dir
- name: create pip cache dir
run: mkdir -p "${HOME}/.cache/pip"
- run: |
echo "OPENSSL_FORCE_FIPS_MODE=1" >> $GITHUB_ENV
if: matrix.IMAGE.FIPS
- run: /venv/bin/python -m pip install -c ci-constraints-requirements.txt 'nox' 'tomli; python_version < "3.11"'
- run: '/venv/bin/nox -v --install-only'
env:
CARGO_TARGET_DIR: ${{ format('{0}/src/rust/target/', github.workspace) }}
# OPENSSL_ENABLE_SHA1_SIGNATURES is for CentOS 9 Stream
OPENSSL_ENABLE_SHA1_SIGNATURES: 1
NOXSESSION: ${{ matrix.IMAGE.NOXSESSION }}
- run: '/venv/bin/nox --no-install -- --color=yes --wycheproof-root="wycheproof" --x509-limbo-root="x509-limbo"'
env:
COLUMNS: 80
# OPENSSL_ENABLE_SHA1_SIGNATURES is for CentOS 9 Stream
OPENSSL_ENABLE_SHA1_SIGNATURES: 1
NOXSESSION: ${{ matrix.IMAGE.NOXSESSION }}
- uses: ./.github/actions/upload-coverage macos:
runs-on: ${{ matrix.RUNNER.OS }}
strategy:
fail-fast: false
matrix:
RUNNER:
- {OS: 'macos-13', ARCH: 'x86_64'}
- {OS: [self-hosted, macos, ARM64, tart], ARCH: 'arm64'}
PYTHON:
- {VERSION: "3.7", NOXSESSION: "tests-nocoverage"}
- {VERSION: "3.12", NOXSESSION: "tests"}
exclude:
# We only test latest Python on arm64. py37 won't work since there's no universal2 binary
- PYTHON: {VERSION: "3.7", NOXSESSION: "tests-nocoverage"}
RUNNER: {OS: [self-hosted, macos, ARM64, tart], ARCH: 'arm64'}
timeout-minutes: 15
steps:
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
timeout-minutes: 3
with:
persist-credentials: false
- name: Cache rust and pip
uses: ./.github/actions/cache
timeout-minutes: 2
with:
key: ${{ matrix.PYTHON.NOXSESSION }}-${{ matrix.PYTHON.VERSION }}
- name: Setup python
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
python-version: ${{ matrix.PYTHON.VERSION }}
architecture: 'x64' # we force this right now so that it will install the universal2 on arm64
cache: pip
cache-dependency-path: ci-constraints-requirements.txt
timeout-minutes: 3
- run: rustup component add llvm-tools-preview
- run: python -m pip install -c ci-constraints-requirements.txt 'nox' 'tomli; python_version < "3.11"'
- name: Clone test vectors
timeout-minutes: 2
uses: ./.github/actions/fetch-vectors
- uses: dawidd6/action-download-artifact@e7466d1a7587ed14867642c2ca74b5bcc1e19a2d # v3.0.0
with:
repo: pyca/infra
workflow: build-macos-openssl.yml
branch: main
workflow_conclusion: success
name: openssl-macos-universal2
path: "../openssl-macos-universal2/"
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Build nox environment
run: |
OPENSSL_DIR=$(readlink -f ../openssl-macos-universal2/) \
OPENSSL_STATIC=1 \
CFLAGS="-Werror -Wno-error=deprecated-declarations -Wno-error=incompatible-pointer-types-discards-qualifiers -Wno-error=unused-function -mmacosx-version-min=10.12" \
nox -v --install-only
env:
NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
CARGO_TARGET_DIR: ${{ format('{0}/src/rust/target/', github.workspace) }}
- name: Tests
run: nox --no-install -- --color=yes --wycheproof-root=wycheproof --x509-limbo-root=x509-limbo
env:
NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
COLUMNS: 80
- uses: ./.github/actions/upload-coverage windows:
runs-on: windows-latest
strategy:
fail-fast: false
matrix:
WINDOWS:
- {ARCH: 'x86', WINDOWS: 'win32'}
- {ARCH: 'x64', WINDOWS: 'win64'}
PYTHON:
- {VERSION: "3.7", NOXSESSION: "tests-nocoverage"}
- {VERSION: "3.12", NOXSESSION: "tests"}
timeout-minutes: 15
steps:
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
timeout-minutes: 3
with:
persist-credentials: false
- name: Setup python
id: setup-python
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
python-version: ${{ matrix.PYTHON.VERSION }}
architecture: ${{ matrix.WINDOWS.ARCH }}
cache: pip
cache-dependency-path: ci-constraints-requirements.txt
timeout-minutes: 3
- run: rustup component add llvm-tools-preview
- name: Cache rust and pip
uses: ./.github/actions/cache
timeout-minutes: 2
with:
key: ${{ matrix.PYTHON.NOXSESSION }}-${{ matrix.WINDOWS.ARCH }}-${{ steps.setup-python.outputs.python-version }}
- run: python -m pip install -c ci-constraints-requirements.txt "nox" "tomli; python_version < '3.11'"
- uses: dawidd6/action-download-artifact@e7466d1a7587ed14867642c2ca74b5bcc1e19a2d # v3.0.0
with:
repo: pyca/infra
workflow: build-windows-openssl.yml
branch: main
workflow_conclusion: success
name: "openssl-${{ matrix.WINDOWS.WINDOWS }}"
path: "C:/openssl-${{ matrix.WINDOWS.WINDOWS }}/"
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Configure
run: |
echo "OPENSSL_DIR=C:/openssl-${{ matrix.WINDOWS.WINDOWS }}" >> $GITHUB_ENV
shell: bash
- name: Clone test vectors
timeout-minutes: 2
uses: ./.github/actions/fetch-vectors
- name: Build nox environment
run: nox -v --install-only
env:
NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
CARGO_TARGET_DIR: ${{ format('{0}/src/rust/target/', github.workspace) }}
- name: Tests
run: nox --no-install -- --color=yes --wycheproof-root=wycheproof --x509-limbo-root=x509-limbo
env:
NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
COLUMNS: 80
CARGO_TARGET_DIR: ${{ format('{0}/src/rust/target/', github.workspace) }}
- uses: ./.github/actions/upload-coverage linux-downstream:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
DOWNSTREAM:
- paramiko
- pyopenssl
- pyopenssl-release
- twisted
- aws-encryption-sdk
- dynamodb-encryption-sdk
- certbot
- certbot-josepy
- mitmproxy
- scapy
PYTHON:
- '3.12'
name: "Downstream tests for ${{ matrix.DOWNSTREAM }}"
timeout-minutes: 15
steps:
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
timeout-minutes: 3
with:
persist-credentials: false
- name: Cache rust and pip
uses: ./.github/actions/cache
timeout-minutes: 2
- name: Setup python
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
python-version: ${{ matrix.PYTHON }}
cache: pip
cache-dependency-path: ci-constraints-requirements.txt
timeout-minutes: 3
- run: ./.github/downstream.d/${{ matrix.DOWNSTREAM }}.sh install
- run: pip install . setuptools
env:
CARGO_TARGET_DIR: ${{ format('{0}/src/rust/target/', github.workspace) }}
# cryptography main has a version of "(X+1).0.0.dev1" where X is the
# most recently released major version. A package used by a downstream
# may depend on cryptography <=X. If you use entrypoints stuff, this can
# lead to runtime errors due to version incompatibilities. Rename the
# dist-info directory to pretend to be an older version to "solve" this.
- run: |
import json
import pkg_resources
import shutil
import urllib.request
d = pkg_resources.get_distribution("cryptography")
with urllib.request.urlopen("https://pypi.org/pypi/cryptography/json") as r:
latest_version = json.load(r)["info"]["version"]
new_path = d.egg_info.replace(d.version, latest_version)
shutil.move(d.egg_info, new_path)
shell: python
- run: ./.github/downstream.d/${{ matrix.DOWNSTREAM }}.sh run all-green:
# https://github.community/t/is-it-possible-to-require-all-github-actions-tasks-to-pass-without-enumerating-them/117957/4?u=graingert
runs-on: ubuntu-latest
needs: [linux, distros, macos, windows, linux-downstream]
if: ${{ always() }}
timeout-minutes: 3
steps:
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
timeout-minutes: 3
with:
persist-credentials: false
- name: Decide whether the needed jobs succeeded or failed
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
with:
jobs: ${{ toJSON(needs) }}
- name: Setup python
if: ${{ always() }}
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
python-version: '3.12'
cache: pip
cache-dependency-path: ci-constraints-requirements.txt
timeout-minutes: 3
- run: pip install -c ci-constraints-requirements.txt coverage[toml]
if: ${{ always() }}
- name: Download coverage data
if: ${{ always() }}
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
with:
name: coverage-data
- name: Combine coverage and fail if it's <100%.
if: ${{ always() }}
id: combinecoverage
run: |
set +e
python -m coverage combine
echo "## Python Coverage" >> $GITHUB_STEP_SUMMARY
python -m coverage report -m --fail-under=100 > COV_REPORT
COV_EXIT_CODE=$?
cat COV_REPORT
if [ $COV_EXIT_CODE -ne 0 ]; then
echo "🚨 Python Coverage failed. Under 100" | tee -a $GITHUB_STEP_SUMMARY
fi
echo '' >> $GITHUB_STEP_SUMMARY cat COV_REPORT >> $GITHUB_STEP_SUMMARY echo '' >> $GITHUB_STEP_SUMMARY
exit $COV_EXIT_CODE
- name: Combine rust coverage and fail if it's <100%.
if: ${{ always() }}
id: combinerustcoverage
run: |
set +e
sudo apt-get install -y lcov
RUST_COVERAGE_OUTPUT=$(lcov $(for f in *.lcov; do echo --add-tracefile "$f"; done) -o combined.lcov | grep lines)
echo "## Rust Coverage" >> $GITHUB_STEP_SUMMARY
echo '' >> $GITHUB_STEP_SUMMARY echo $RUST_COVERAGE_OUTPUT >> $GITHUB_STEP_SUMMARY echo '' >> $GITHUB_STEP_SUMMARY
if ! echo "$RUST_COVERAGE_OUTPUT" | grep "100.0%"; then
echo "🚨 Rust Coverage failed. Under 100" | tee -a $GITHUB_STEP_SUMMARY
exit 1
fi
- name: Create rust coverage HTML
run: genhtml combined.lcov -o rust-coverage
if: ${{ failure() && steps.combinerustcoverage.outcome == 'failure' }}
- name: Create coverage HTML
run: python -m coverage html
if: ${{ failure() && steps.combinecoverage.outcome == 'failure' }}
- name: Upload HTML report.
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
with:
name: _html-report
path: htmlcov
if-no-files-found: ignore
if: ${{ failure() && steps.combinecoverage.outcome == 'failure' }}
- name: Upload rust HTML report.
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
with:
name: _html-rust-report
path: rust-coverage
if-no-files-found: ignore
if: ${{ failure() && steps.combinerustcoverage.outcome == 'failure' }}
File: tests/sample-workflows/pypi-attestations-release.yml
https://github.com/trailofbits/pypi-attestations/blob/b5920dee025c93b2bfefbcccc6acc7eab7b8a18e/.github/workflows/release.yml
Copyright 2024 Trail of Bits
License: Apache-2.0
on:
release:
types:
- published
name: release
permissions:
Trusted Publishing + attestations
id-token: write
attestations: write
jobs:
pypi:
name: upload release to PyPI
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version-file: pyproject.toml
cache: "pip"
cache-dependency-path: pyproject.toml
- name: deps
run: python -m pip install -U setuptools build wheel
- name: build
run: python -m build
- name: publish
uses: pypa/gh-action-pypi-publish@release/v1
- name: attest
uses: actions/attest@v1
with:
subject-path: |
./dist/*.tar.gz
./dist/*.whl
predicate-type: "https://docs.pypi.org/attestations/publish/v1"
predicate: "{}"File: tests/sample-workflows/reusable-workflow-unpinned.yml
see https://github.com/woodruffw/zizmor/issues/431
name: "reusable-workflow-unpinned"
on:
push:
jobs:
testcase:
name: "testcase"
uses: ./.github/workflows/reusable.yml
File: tests/sample-workflows/rnpgp-rnp-centos-and-fedora.yml
https://github.com/rnpgp/rnp/blob/ddcbaa932f01a349969e9689de5bccd485090d02/.github/workflows/centos-and-fedora.yml
Copyright:
2017-2024, Ribose Inc.
2009-2010, The NetBSD Foundation, Inc.
License: BSD-2-clause
name: centos-and-fedora
on:
push:
branches:
- main
- "release/"
paths-ignore:
- "/.sh"
- "/."
- "/_*"
- "Brewfile"
- "docs/"
- ".adoc"
- ".md"
- ".nix"
- "flake.lock"
- "version.txt"
- ".github/workflows/.yml"
- "!.github/workflows/centos-and-fedora.yml"
pull_request:
paths-ignore:
- "/.sh"
- "/."
- "/_"
- "Brewfile"
- "docs/"
- ".adoc"
- ".md"
- "**.nix"
- "flake.lock"
- "version.txt"
concurrency:
group: "${{ github.workflow }}-${{ github.job }}-${{ github.head_ref || github.ref_name }}"
cancel-in-progress: true
env:
CORES: 2
RNP_LOG_CONSOLE: 1
CODECOV_TOKEN: dbecf176-ea3f-4832-b743-295fd71d0fad
jobs:
tests:
name: ${{ matrix.image.name }} [CC ${{ matrix.env.CC }}; backend ${{ matrix.image.backend }} ${{ matrix.image.botan_ver }}; gpg ${{ matrix.image.gpg_ver }}; build ${{ matrix.env.BUILD_MODE }}; SM2 ${{ matrix.image.sm2 }}; IDEA ${{ matrix.image.idea }}]
runs-on: ubuntu-latest
timeout-minutes: 120
strategy:
fail-fast: false
matrix:
env:
- { CC: gcc, CXX: g++, BUILD_MODE: normal, SHARED_LIBS: on }
# normal --> Release build; sanitize --> Debug build so theoretically test conditions are different
# - { CC: clang, CXX: clang++, BUILD_MODE: normal }
- { CC: clang, CXX: clang++, BUILD_MODE: sanitize, SHARED_LIBS: on }
# All cotainers have gpg stable and lts installed
# centos-9-amd64 has botan 2.19.3 installed
# fedora-39-amd64 has botan 2.19.4 installed
# Any other version has to be built explicitly !
# Pls refer to https://github.com/rnpgp/rnp-ci-containers#readme for more image details
image:
- {
name: "CentOS 9",
container: "centos-9-amd64",
backend: "Botan",
botan_ver: "system",
gpg_ver: "system",
}
- {
name: "CentOS 9",
container: "centos-9-amd64",
backend: "Botan",
botan_ver: "system",
sm2: Off,
gpg_ver: "lts",
}
- {
name: "Fedora 39",
container: "fedora-39-amd64",
backend: "Botan",
botan_ver: "system",
gpg_ver: "system",
}
- {
name: "Fedora 40",
container: "fedora-40-amd64",
backend: "Botan",
botan_ver: "system",
gpg_ver: "system",
}
- {
name: "Fedora 40",
container: "fedora-40-amd64",
backend: "Botan",
botan_ver: "3.1.1",
gpg_ver: "system",
}
- {
name: "Fedora 40",
container: "fedora-40-amd64",
backend: "Botan",
botan_ver: "head",
gpg_ver: "system",
}
- {
name: "Fedora 40",
container: "fedora-40-amd64",
backend: "Botan",
botan_ver: "3.3.0",
pqc: On,
gpg_ver: "system",
}
- {
name: "CentOS 9",
container: "centos-9-amd64",
backend: "OpenSSL",
gpg_ver: "lts",
}
- {
name: "Fedora 39",
container: "fedora-39-amd64",
backend: "OpenSSL",
gpg_ver: "system",
}
- {
name: "Fedora 40",
container: "fedora-40-amd64",
backend: "OpenSSL",
gpg_ver: "system",
}
- {
name: "RHEL 8",
container: "redhat-8-ubi",
backend: "OpenSSL",
gpg_ver: "system",
}
- {
name: "RHEL 9",
container: "redhat-9-ubi",
backend: "OpenSSL",
gpg_ver: "system",
}
include:
# Coverage report for Botan 2.x backend
- image:
{
name: "CentOS 9 Coverage",
container: "centos-9-amd64",
gpg_ver: stable,
backend: Botan,
botan_ver: "system",
}
env: { CC: gcc, CXX: g++, BUILD_MODE: coverage, SHARED_LIBS: on }
# Coverage report for Botan 3.x backend
- image:
{
name: "Fedora 40 Coverage",
container: "fedora-40-amd64",
gpg_ver: stable,
backend: Botan,
botan_ver: "3.3.0",
}
env: { CC: gcc, CXX: g++, BUILD_MODE: coverage, SHARED_LIBS: on }
# Coverage report for OpenSSL 3.0 backend
- image:
{
name: "Fedora 40 Coverage",
container: "fedora-40-amd64",
gpg_ver: stable,
backend: OpenSSL,
}
env: { CC: gcc, CXX: g++, BUILD_MODE: coverage, SHARED_LIBS: on }
# Coverage report for OpenSSL 3.0 backend with disabled algos
- image:
{
name: "Fedora 40 Coverage",
container: "fedora-40-amd64",
gpg_ver: stable,
backend: OpenSSL,
idea: Off,
sm2: Off,
two: Off,
blow: Off,
rmd: Off,
bp: Off,
}
env: { CC: gcc, CXX: g++, BUILD_MODE: coverage, SHARED_LIBS: on }
# Coverage report for Botan backend with disabled algos
- image:
{
name: "Fedora 40 Coverage",
container: "fedora-40-amd64",
gpg_ver: stable,
backend: Botan,
idea: Off,
sm2: Off,
two: Off,
blow: Off,
rmd: Off,
bp: Off,
}
env: { CC: gcc, CXX: g++, BUILD_MODE: coverage, SHARED_LIBS: on }
# Coverage report for OpenSSL 1.1.1 backend within RHEL 8
- image:
{
name: "RHEL 8 Coverage",
container: "redhat-8-ubi",
gpg_ver: stable,
backend: OpenSSL,
}
env: { CC: gcc, CXX: g++, BUILD_MODE: coverage, SHARED_LIBS: on }
# Coverage report for PQC - not running yet due to very low coverage
#- image: { name: 'Fedora 40 PQC Coverage', container: 'fedora-40-amd64', gpg_ver: stable, backend: Botan, botan_ver: '3.3.0', pqc: On }
# env: { CC: gcc, CXX: g++, BUILD_MODE: coverage, SHARED_LIBS: off }
container: ghcr.io/rnpgp/ci-rnp-${{ matrix.image.container }}
env: ${{ matrix.env }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
submodules: true
- name: Setup environment
run: |
set -o errexit -o pipefail -o noclobber -o nounset
/opt/tools/tools.sh select_crypto_backend_for_gha ${{ matrix.image.backend }}
/opt/tools/tools.sh select_gpg_version_for_gha ${{ matrix.image.gpg_ver }}
/opt/tools/tools.sh select_botan_version_for_gha ${{ matrix.image.botan_ver }}
echo "ENABLE_SM2=${{ matrix.image.sm2 }}" >> $GITHUB_ENV
echo "ENABLE_IDEA=${{ matrix.image.idea }}" >> $GITHUB_ENV
echo "ENABLE_TWOFISH=${{ matrix.image.two }}" >> $GITHUB_ENV
echo "ENABLE_BLOWFISH=${{ matrix.image.blow }}" >> $GITHUB_ENV
echo "ENABLE_RIPEMD160=${{ matrix.image.rmd }}" >> $GITHUB_ENV
echo "ENABLE_BRAINPOOL=${{ matrix.image.bp }}" >> $GITHUB_ENV
echo "ENABLE_PQC=${{ matrix.image.pqc }}" >> $GITHUB_ENV
echo CORES="$(nproc --all)" >> $GITHUB_ENV
useradd rnpuser
printf "\nrnpuser\tALL=(ALL)\tNOPASSWD:\tALL" > /etc/sudoers.d/rnpuser
printf "\nrnpuser\tsoft\tnproc\tunlimited\n" > /etc/security/limits.d/30-rnpuser.conf
# Need to build HEAD version since it is always different
- name: Build gpg head
if: matrix.image.gpg_ver == 'head'
run: /opt/tools/tools.sh build_and_install_gpg head
- name: Build botan head
if: matrix.image.botan_ver == 'head'
# Botan's head renamed curve25519 module to x25519, however this didn't get to 3.5.0 release yet
run: |
sed -i 's/curve25519/x25519/g' /opt/tools/botan3-modules /opt/tools/botan3-pqc-modules
/opt/tools/tools.sh build_and_install_botan head
- name: Configure
run: |
set -o errexit -o pipefail -o noclobber -o nounset
[[ "${{ env.BUILD_MODE }}" = "coverage" ]] && cov_opt=(-DENABLE_COVERAGE=yes)
[[ "${{ env.BUILD_MODE }}" = "sanitize" ]] && san_opt=(-DENABLE_SANITIZERS=yes)
[ -n "$ENABLE_SM2" ] && sm2_opt=(-DENABLE_SM2="$ENABLE_SM2")
[ -n "$ENABLE_IDEA" ] && idea_opt=(-DENABLE_IDEA="$ENABLE_IDEA")
[ -n "$ENABLE_TWOFISH" ] && two_opt=(-DENABLE_TWOFISH="$ENABLE_TWOFISH")
[ -n "$ENABLE_BLOWFISH" ] && blow_opt=(-DENABLE_BLOWFISH="$ENABLE_BLOWFISH")
[ -n "$ENABLE_RIPEMD160" ] && rmd_opt=(-DENABLE_RIPEMD160="$ENABLE_RIPEMD160")
[ -n "$ENABLE_BRAINPOOL" ] && bp_opt=(-DENABLE_BRAINPOOL="$ENABLE_BRAINPOOL")
[ -n "$ENABLE_PQC" ] && pqc_opt=(-DENABLE_PQC="$ENABLE_PQC" -DENABLE_CRYPTO_REFRESH="$ENABLE_PQC")
cmake -B build \
-DBUILD_SHARED_LIBS=${{ env.SHARED_LIBS }} \
-DDOWNLOAD_GTEST=ON \
-DCMAKE_BUILD_TYPE=Release \
-DCRYPTO_BACKEND=${{ matrix.image.backend }} \
${sm2_opt:-} ${idea_opt:-} ${two_opt:-} ${blow_opt:-} ${rmd_opt:-} ${bp_opt:-} ${pqc_opt[@]:-} ${cov_opt:-} ${san_opt:-} .
- name: Build
run: cmake --build build --parallel ${{ env.CORES }}
- name: Test
run: |
mkdir -p "build/Testing/Temporary"
cp "cmake/CTestCostData.txt" "build/Testing/Temporary"
export PATH="$PWD/build/src/lib:$PATH"
chown -R rnpuser:rnpuser $PWD
exec su rnpuser -c "ctest --parallel ${{ env.CORES }} --test-dir build --output-on-failure"
- name: Coverage
if: env.BUILD_MODE == 'coverage'
run: |
curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --keyring trustedkeys.gpg --import # One-time step
curl -Os https://uploader.codecov.io/latest/linux/codecov
curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
gpgv codecov.SHA256SUM.sig codecov.SHA256SUM
shasum -a 256 -c codecov.SHA256SUM
chmod +x codecov
find "build" -type f -name '*.gcno' -exec gcov -p {} +
./codecov
- name: Install
if: env.BUILD_MODE != 'coverage' && env.SHARED_LIBS == 'on'
run: cmake --install build
- name: Checkout shell test framework
if: env.BUILD_MODE != 'coverage' && env.SHARED_LIBS == 'on'
uses: actions/checkout@v4
with:
path: ci/tests/shunit2
- name: Run additional ci tests
if: env.BUILD_MODE != 'coverage' && env.SHARED_LIBS == 'on'
run: RNP_INSTALL=/usr/local ci/tests/ci-tests.sh package-source:
runs-on: ubuntu-latest
container: ghcr.io/rnpgp/ci-rnp-${{ matrix.image.container }}
timeout-minutes: 30
# needs: tests
strategy:
fail-fast: false
matrix:
image:
- { name: "CentOS 9", container: "centos-9-amd64" }
- { name: "Fedora 39", container: "fedora-39-amd64" }
- { name: "Fedora 40", container: "fedora-40-amd64" }
name: Package ${{ matrix.image.name }} SRPM
steps:
- name: Install rpm tools
run: yum -y install rpm-build
- name: Checkout
uses: actions/checkout@v4
with:
submodules: true
- name: Configure
run: cmake -B build -DBUILD_SHARED_LIBS=ON -DBUILD_TESTING=OFF
- name: Package SRPM
run: cpack -B build/SRPM -G RPM --config build/CPackSourceConfig.cmake
- name: Upload SRPM
uses: actions/upload-artifact@v4
with:
name: "SRPM ${{ matrix.image.name }}"
path: "build/SRPM/*.src.rpm"
retention-days: 5
- name: Stash packaging tests
uses: actions/upload-artifact@v4
with:
name: "tests-${{ matrix.image.name }}"
path: "ci/tests/**"
retention-days: 1 package:
runs-on: ubuntu-latest
container: ghcr.io/rnpgp/ci-rnp-${{ matrix.image.container }}
timeout-minutes: 30
needs: package-source
strategy:
fail-fast: false
matrix:
image:
- { name: "CentOS 9", container: "centos-9-amd64" }
- { name: "Fedora 39", container: "fedora-39-amd64" }
- { name: "Fedora 40", container: "fedora-40-amd64" }
name: Package ${{ matrix.image.name }} RPM
steps:
- name: Install rpm tools
run: yum -y install rpm-build
- name: Download SRPM
uses: actions/download-artifact@v4
with:
name: "SRPM ${{ matrix.image.name }}"
path: ~/rpmbuild/SRPMS
- name: Extract SRPM
run: |
rpm -i -v ~/rpmbuild/SRPMS/*.src.rpm
tar xzf ~/rpmbuild/SOURCES/*.tar.gz --strip 1 -C ~/rpmbuild/SOURCES
- name: Build rnp
run: |
cmake ~/rpmbuild/SOURCES -B ~/rpmbuild/SOURCES/BUILD -DBUILD_SHARED_LIBS=ON -DBUILD_TESTING=OFF \
-DCMAKE_INSTALL_PREFIX=/usr
cmake --build ~/rpmbuild/SOURCES/BUILD --config Release
- name: Package rpm
run: cpack -G RPM -B ~/rpmbuild/SOURCES/RPMS --config ~/rpmbuild/SOURCES/BUILD/CPackConfig.cmake
- name: Upload Artifact
uses: actions/upload-artifact@v4
with:
name: "RPM ${{ matrix.image.name}}"
path: "~/rpmbuild/SOURCES/RPMS/*.rpm"
retention-days: 5The main purpose of this step is to test the RPMS in a pristine environment (as for the end user).
ci-scripts are deliberately not used, as they recreate the development environment,
and this is something we proudly reject here
rpm-tests:
runs-on: ubuntu-latest
needs: package
container: ${{ matrix.image.container }}
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
image:
- { name: "CentOS 9", container: "quay.io/centos/centos:stream9" }
# Fedora 39 is disabled since it has cmake issue which prevents man pages to be packaged.
# Please see package step for error message.
#- { name: 'Fedora 39', container: 'fedora:39' }
- { name: "Fedora 40", container: "fedora:40" }
name: RPM test on ${{ matrix.image.name }}
steps:
- name: Install prerequisites
run: yum -y install sudo wget binutils
# Fedora 39/40 packages depend on botan.so.19 that comes Fedora package, that is available by default
# CentOS 9 depend on botan.so.19 and needs EPEL9 repo that needs to be installed
- name: Install epel-release
if: matrix.image.container == 'quay.io/centos/centos:stream9'
run: |
sudo dnf -y install 'dnf-command(config-manager)'
sudo dnf config-manager --set-enabled crb
sudo dnf -y install epel-release
- name: Install xargs
if: matrix.image.container == 'fedora:39'
run: sudo yum -y install findutils
- name: Download rnp rpms
uses: actions/download-artifact@v4
with:
name: "RPM ${{ matrix.image.name}}"
- name: Checkout shell test framework
uses: actions/checkout@v4
with:
path: ci/tests/shunit2
- name: Unstash tests
if: matrix.image.container != 'centos:7'
uses: actions/download-artifact@v4
with:
name: tests-${{ matrix.image.name }}
path: ci/tests
- name: Run rpm tests
# RPM tests
# - no source checkout or upload [we get only test scripts from the previous step using GHA artifacts]
# - no environment set up with rnp scripts
# - no dependencies setup, we test that yum can install whatever is required
run: |
chmod +x ci/tests/rpm-tests.sh
ci/tests/rpm-tests.sh
- name: Run symbol visibility tests
run: |
chmod +x ci/tests/ci-tests.sh
sudo yum -y localinstall librnp0-0*.*.rpm librnp0-devel-0*.*.rpm rnp0-0*.*.rpm
ci/tests/ci-tests.sh
sudo yum -y erase $(rpm -qa | grep rnp)
- name: Setup minimalistic build environment
run: |
sudo yum -y install make gcc gcc-c++ zlib-devel bzip2-devel botan2-devel
mkdir cmake
wget https://github.com/Kitware/CMake/releases/download/v3.12.0/cmake-3.12.0-Linux-x86_64.sh -O cmake/cmake.sh
sudo sh cmake/cmake.sh --skip-license --prefix=/usr/local
# el8, el9, fr35, fr36 provide json-c-devel (version 12+)
- name: Setup json-c
run: sudo yum -y install json-c-devel
- name: Run packaging tests
run: |
chmod +x ci/tests/pk-tests.sh
ci/tests/pk-tests.shFile: tests/sample-workflows/runs-on-expr.yml
name: runs-on-expr
on: [push]
jobs:
check-bats-version:
runs-on: ${{ matrix.runner }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "14"
- run: npm install bats
- run: bats -v
File: tests/sample-workflows/runs-on-group-only.yml
https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#choosing-runners-in-a-group
Copyright: 2024 GitHub, Inc.
License: Creative Commons Attribution 4.0 International
name: learn-github-actions
on: [push]
jobs:
check-bats-version:
runs-on:
group: ubuntu-runners
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "14"
- run: npm install bats
- run: bats -v
File: tests/sample-workflows/scalar-trigger-type.yml
repro case for https://github.com/zizmorcore/github-actions-models/issues/12
name: issue-12
on:
repository_dispatch:
types: some-external-type
jobs:
dummy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
File: tests/sample-workflows/vil02-puzzle_generator-check_examples.yml
https://raw.githubusercontent.com/vil02/puzzle_generator/e2c864ef2985743a648a35b2313eb9dd4592bd18/.github/workflows/check_examples.yml
MIT License
Copyright (c) 2024 Piotr Idzik
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
name: check_examples
'on':
workflow_dispatch:
workflow_run:
workflows: [publish]
types:
- completed
schedule:
- cron: '33 */9 * * *'
jobs:
check_examples:
runs-on: ${{matrix.os}}
strategy:
fail-fast: false
matrix:
os:
- ubuntu-latest
python-version: ['3.10', 3.11, 3.12]
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up Python ${{matrix.python-version}}
uses: actions/setup-python@v5
with:
python-version: ${{matrix.python-version}}
- name: Install puzzle-generator
run: |
pip install puzzle-generator
- name: Run examples
run: |
./run_all_examples.sh --no-poetry...
File: tests/sample-workflows/zizmor-issue-646.yml
https://github.com/woodruffw/zizmor/issues/646
name: Test
on:
workflow_call:
secrets:
my-secret:
jobs:
job:
runs-on: ubuntu-latest
steps:
- run: echo ${{ secrets.my-secret }}
File: tests/sample-workflows/zizmor-issue-650.yml
See https://github.com/woodruffw/zizmor/issues/650
Copyright © Michal Čihař
SPDX-License-Identifier: CC0-1.0
This file is maintained in https://github.com/WeblateOrg/meta/
name: Pull request automation
on:
pull_request_target:
types: opened
permissions:
contents: read
jobs:
weblate_automerge:
permissions:
pull-requests: write
contents: write
runs-on: ubuntu-24.04
name: Weblate automerge
if: github.actor == 'weblate'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Enable Pull Request Automerge
run: gh pr merge --rebase --auto "${{ github.event.pull_request.number }}"
env:
GH_TOKEN: ${{ secrets.WEBLATE_CI_TOKEN }}
File: .github/dependabot.yml
version: 2
updates:
package-ecosystem: cargo
directory: "/"
schedule:
interval: weekly
groups:
cargo:
patterns:
- "*"package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
groups:
github-actions:
patterns:
- "*"
File: .github/workflows/ci.yml
name: CI
on:
push:
branches:
- main
pull_request:
permissions: {}
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Format
run: cargo fmt && git diff --exit-code
- name: Lint
run: |
rustup component add clippy
cargo clippy -- -D warnings test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Test
run: cargo testFile: .github/workflows/release.yml
on:
release:
types:
- published
name: release
permissions: {}
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: publish to crates.io
run: cargo publish
env:
CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}"File: .github/workflows/zizmor.yml
name: GitHub Actions Security Analysis with zizmor 🌈
on:
push:
branches: ["main"]
pull_request:
branches: ["**"]
permissions: {}
jobs:
zizmor:
name: zizmor latest via Cargo
runs-on: ubuntu-latest
permissions:
security-events: write
# required for workflows in private repositories
contents: read
actions: read
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Install the latest version of uv
uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
- name: Run zizmor 🌈
run: uvx zizmor --format sarif . > results.sarif
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
with:
sarif_file: results.sarif
category: zizmor