Sebastiaan van Stijn
b43eb80ada
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication. Codecov supports tokenless uploads for public repositories, but authenticated uploads are still needed to protect coverage results on protected branches from unauthorized uploads. Grant `id-token: write` at the job level to allow Codecov to request a short-lived OIDC token. This permission does not grant repository write access, and scoping it to the job avoids granting it to other jobs added to the workflow in the future. Coverage uploads from forked pull requests continue to use Codecov's tokenless upload mechanism. See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
284 lines
9.0 KiB
YAML
284 lines
9.0 KiB
YAML
name: test
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
# Cancel stale PR runs without interrupting push, tag, scheduled, or
|
|
# manually dispatched validation.
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- '[0-9]+.[0-9]+'
|
|
- '[0-9]+.x'
|
|
pull_request:
|
|
|
|
env:
|
|
GO_VERSION: "1.26.10"
|
|
GIT_PAGER: "cat"
|
|
PAGER: "cat"
|
|
SETUP_BUILDX_VERSION: edge
|
|
SETUP_BUILDKIT_IMAGE: moby/buildkit:latest
|
|
|
|
jobs:
|
|
validate-dco:
|
|
permissions:
|
|
pull-requests: read
|
|
uses: ./.github/workflows/.dco.yml
|
|
|
|
build-dev:
|
|
runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-26.04-arm' || 'ubuntu-26.04' }}
|
|
timeout-minutes: 120 # guardrails timeout for the whole job
|
|
needs:
|
|
- validate-dco
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch:
|
|
- amd64
|
|
- arm64
|
|
mode:
|
|
- ""
|
|
- systemd
|
|
- firewalld
|
|
steps:
|
|
-
|
|
name: Prepare
|
|
env:
|
|
MODE: ${{ matrix.mode }}
|
|
run: |
|
|
if [ "$MODE" = "systemd" ]; then
|
|
echo "SYSTEMD=true" >> $GITHUB_ENV
|
|
fi
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
with:
|
|
version: ${{ env.SETUP_BUILDX_VERSION }}
|
|
driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
|
|
buildkitd-flags: --debug
|
|
-
|
|
name: Build dev image
|
|
uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
|
|
with:
|
|
targets: dev
|
|
set: |
|
|
*.cache-from=type=gha,scope=${{ matrix.mode == '' && format('dev-{0}', matrix.arch) || format('dev-{0}-{1}', matrix.mode, matrix.arch) }}
|
|
*.cache-to=type=gha,scope=${{ matrix.mode == '' && format('dev-{0}', matrix.arch) || format('dev-{0}-{1}', matrix.mode, matrix.arch) }}
|
|
${{ matrix.mode == '' && format('*.output=type=docker,dest=/tmp/dev-image-{0}.tar', matrix.arch) || '*.output=type=cacheonly' }}
|
|
-
|
|
name: Cache dev image
|
|
if: matrix.mode == ''
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
key: dev-image-${{ matrix.arch }}-${{ github.run_id }}
|
|
path: /tmp/dev-image-${{ matrix.arch }}.tar
|
|
|
|
test:
|
|
permissions:
|
|
contents: read
|
|
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
|
name: test (${{ matrix.arch }}, ${{ matrix.storage }})
|
|
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
|
needs:
|
|
- build-dev
|
|
- validate-dco
|
|
uses: ./.github/workflows/.test.yml
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# Only amd64 gets the full matrix
|
|
- arch: amd64
|
|
storage: snapshotter
|
|
runnerSuffix: ""
|
|
extraModes: '["rootless", "systemd", "rootless-systemd", "iptables+firewalld", "nftables", "nftables+firewalld", "embedded"]'
|
|
- arch: amd64
|
|
storage: graphdriver
|
|
runnerSuffix: ""
|
|
extraModes: '["rootless", "systemd", "userns"]'
|
|
- arch: arm64
|
|
storage: snapshotter
|
|
runnerSuffix: "-arm"
|
|
extraModes: '[]'
|
|
with:
|
|
arch: ${{ matrix.arch }}
|
|
storage: ${{ matrix.storage }}
|
|
runnerSuffix: ${{ matrix.runnerSuffix }}
|
|
extraModes: ${{ matrix.extraModes }}
|
|
|
|
test-unit:
|
|
permissions:
|
|
contents: read
|
|
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
|
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
|
needs:
|
|
- build-dev
|
|
- validate-dco
|
|
uses: ./.github/workflows/.test-unit.yml
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- arch: amd64
|
|
runnerSuffix: ""
|
|
- arch: arm64
|
|
runnerSuffix: "-arm"
|
|
with:
|
|
arch: ${{ matrix.arch }}
|
|
runnerSuffix: ${{ matrix.runnerSuffix }}
|
|
|
|
validate-prepare:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 10 # guardrails timeout for the whole job
|
|
needs:
|
|
- validate-dco
|
|
outputs:
|
|
matrix: ${{ steps.scripts.outputs.matrix }}
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
-
|
|
name: Create matrix
|
|
id: scripts
|
|
run: |
|
|
# Select all validate scripts, excluding checks that are already run
|
|
# elsewhere and/or require pull-request metadata (dco, pr-gh-references).
|
|
scripts=$(cd ./hack/validate && jq -nc '$ARGS.positional - ["all", "default", "dco", "pr-gh-references"] | map(select(test("[.]")|not)) + ["generate-files"]' --args *)
|
|
echo "matrix=$scripts" >> $GITHUB_OUTPUT
|
|
echo "$scripts"
|
|
|
|
validate:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 30 # guardrails timeout for the whole job
|
|
needs:
|
|
- validate-prepare
|
|
- build-dev
|
|
strategy:
|
|
matrix:
|
|
script: ${{ fromJson(needs.validate-prepare.outputs.matrix) }}
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
-
|
|
name: Set up runner
|
|
uses: ./.github/actions/setup-runner
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
with:
|
|
version: ${{ env.SETUP_BUILDX_VERSION }}
|
|
driver: docker
|
|
buildkitd-flags: --debug
|
|
-
|
|
name: Restore dev image
|
|
id: restore-dev-image
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
key: dev-image-amd64-${{ github.run_id }}
|
|
path: /tmp/dev-image-amd64.tar
|
|
-
|
|
name: Load dev image
|
|
if: steps.restore-dev-image.outputs.cache-hit == 'true'
|
|
run: |
|
|
docker load -i /tmp/dev-image-amd64.tar
|
|
-
|
|
# Fall back to building the dev image if the cache could not be
|
|
# restored (e.g. cache miss or a rate-limited download).
|
|
name: Build dev image
|
|
if: steps.restore-dev-image.outputs.cache-hit != 'true'
|
|
uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
|
|
with:
|
|
targets: dev
|
|
set: |
|
|
dev.cache-from=type=gha,scope=dev-amd64
|
|
-
|
|
name: Validate
|
|
env:
|
|
SCRIPT: ${{ matrix.script }}
|
|
run: |
|
|
make -o build "validate-${SCRIPT}"
|
|
|
|
validate-api-swagger:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 10 # guardrails timeout for the whole job
|
|
defaults:
|
|
run:
|
|
working-directory: api
|
|
needs:
|
|
- validate-dco
|
|
name: validate (api-swagger)
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
-
|
|
name: Validate swagger
|
|
run: |
|
|
make validate-swagger
|
|
make validate-swagger-gen
|
|
|
|
smoke-prepare:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 10 # guardrails timeout for the whole job
|
|
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
|
needs:
|
|
- validate-dco
|
|
outputs:
|
|
includes: ${{ steps.gen.outputs.matrix }}
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
-
|
|
name: Create matrix
|
|
id: gen
|
|
uses: docker/bake-action/subaction/matrix@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
|
|
with:
|
|
target: binary-smoketest
|
|
fields: platforms
|
|
|
|
smoke:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 20 # guardrails timeout for the whole job
|
|
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
|
needs:
|
|
- smoke-prepare
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include: ${{ fromJson(needs.smoke-prepare.outputs.includes) }}
|
|
steps:
|
|
-
|
|
name: Prepare
|
|
env:
|
|
PLATFORM: ${{ matrix.platforms }}
|
|
run: |
|
|
echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> $GITHUB_ENV
|
|
-
|
|
name: Set up QEMU
|
|
uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
with:
|
|
version: ${{ env.SETUP_BUILDX_VERSION }}
|
|
driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
|
|
buildkitd-flags: --debug
|
|
-
|
|
name: Test
|
|
uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
set: |
|
|
*.platform=${{ matrix.platforms }}
|