Skip to content
CI

feat(datagen): environment foundations for simulated host identity (PIPE-1036) #1863

Sign in to view logs

feat(datagen): environment foundations for simulated host identity (PIPE-1036)

feat(datagen): environment foundations for simulated host identity (PIPE-1036) #1863

Workflow file for this run

.github/workflows/ci.yml at 8a8a893
name: CI
on:
push:
branches:
- main
pull_request:
merge_group:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
# Graphite CI optimization: skip redundant CI runs for stacked PRs.
# See https://graphite.com/docs/stacking-and-ci
optimize_ci:
runs-on: ubuntu-latest
continue-on-error: true
outputs:
skip: ${{ steps.check_skip.outputs.skip }}
steps:
- name: Optimize CI
id: check_skip
uses: withgraphite/graphite-ci-action@26bc0dcdeaba101794931d67a464ecbb21a76a8b # v0.0.9 tag (no formal releases)
with:
graphite_token: ${{ secrets.GRAPHITE_CI_OPTIMIZER_TOKEN }}
shellcheck:
name: ShellCheck
runs-on: ubuntu-latest
needs: optimize_ci
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Run ShellCheck (package/scripts)
run: |
find package/scripts -type f -name "*.sh" -exec shellcheck {} +
- name: Run ShellCheck (scripts)
run: |
find scripts -type f -name "*.sh" -exec shellcheck {} +
setup:
name: Setup environment
runs-on: ubuntu-latest
needs: optimize_ci
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Download dependencies
run: |
go env
bash .github/scripts/retry.sh go mod download
- name: Install tools
run: |
bash .github/scripts/retry.sh make install-tools
test:
name: Test
runs-on: ubuntu-latest
needs: [optimize_ci, setup]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Run tests (race detector)
env:
CGO_ENABLED: "1"
run: |
make test-race
- name: Run embedded-library tests
run: |
make test-embedded
gosec:
name: Gosec
runs-on: ubuntu-latest
needs: [optimize_ci, setup]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Run gosec
run: |
make security
revive:
name: Revive
runs-on: ubuntu-latest
needs: [optimize_ci, setup]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Run revive
run: |
make lint
- name: Check for global-logger usage
run: |
make lint-global-logger
build:
name: Build - ${{ matrix.goos }}/${{ matrix.goarch }}
runs-on: ubuntu-latest
needs: [optimize_ci, setup]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
strategy:
fail-fast: false
matrix:
include:
- goos: freebsd
goarch: amd64
- goos: freebsd
goarch: arm64
- goos: linux
goarch: amd64
- goos: linux
goarch: arm64
- goos: darwin
goarch: amd64
- goos: darwin
goarch: arm64
- goos: windows
goarch: amd64
- goos: windows
goarch: arm64
steps:
- name: Checkout
uses: actions/checkout@v7
# Only the linux legs build container images (the goreleaser dockers are
# linux/amd64 and linux/arm64), so QEMU/buildx are set up only there. The
# freebsd/darwin/windows legs cross-compile binaries only, so they no
# longer pull from Docker Hub at all, which removes the transient-pull
# failure they used to hit (PIPE-1092). On the linux legs the QEMU and
# buildkit images are pre-pulled with retry and pinned, so a transient
# Docker Hub blip during setup no longer fails the build.
- name: Pre-pull buildx base images (retry transient Docker Hub pulls)
if: matrix.goos == 'linux'
run: |
bash .github/scripts/retry.sh docker pull tonistiigi/binfmt:latest
bash .github/scripts/retry.sh docker pull moby/buildkit:buildx-stable-1
- name: Set up Docker Buildx
if: matrix.goos == 'linux'
id: buildx
uses: docker/setup-buildx-action@v4
with:
driver-opts: image=moby/buildkit:buildx-stable-1
- name: Set up QEMU
if: matrix.goos == 'linux'
uses: docker/setup-qemu-action@v4
with:
image: tonistiigi/binfmt:latest
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Set build host platform
run: |
echo "BUILD_HOST_OS=$(go env GOHOSTOS)" >> $GITHUB_ENV
echo "BUILD_HOST_ARCH=$(go env GOHOSTARCH)" >> $GITHUB_ENV
- name: Run GoReleaser (split)
uses: goreleaser/goreleaser-action@v7
with:
distribution: goreleaser-pro
version: "v2.12.5"
args: release --clean --skip=publish --skip=sign --skip=validate --snapshot --split
env:
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
BUILD_HOST_OS: ${{ env.BUILD_HOST_OS }}
BUILD_HOST_ARCH: ${{ env.BUILD_HOST_ARCH }}
GGOOS: ${{ matrix.goos }}
GGOARCH: ${{ matrix.goarch }}
- name: Upload dist artifacts
uses: actions/upload-artifact@v7
with:
name: dist-${{ matrix.goos }}-${{ matrix.goarch }}
path: dist/
retention-days: 1
merge-build:
name: Merge Build
runs-on: ubuntu-latest
needs: [optimize_ci, setup, build]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
env:
cinc_package: https://packages.cinc.sh/files/stable/cinc-auditor/4.56.58/ubuntu/22.04/cinc-auditor_4.56.58-1_amd64.deb
steps:
- name: Checkout
uses: actions/checkout@v7
# Pre-pull the QEMU/buildkit images with retry so a transient Docker Hub
# blip during buildx/QEMU setup doesn't fail the merge build (PIPE-1092).
# The images are pinned to match what the setup actions request below.
- name: Pre-pull buildx base images (retry transient Docker Hub pulls)
run: |
bash .github/scripts/retry.sh docker pull tonistiigi/binfmt:latest
bash .github/scripts/retry.sh docker pull moby/buildkit:buildx-stable-1
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v4
with:
driver-opts: image=moby/buildkit:buildx-stable-1
- name: Set up QEMU
uses: docker/setup-qemu-action@v4
with:
image: tonistiigi/binfmt:latest
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Set build host platform
run: |
echo "BUILD_HOST_OS=$(go env GOHOSTOS)" >> $GITHUB_ENV
echo "BUILD_HOST_ARCH=$(go env GOHOSTARCH)" >> $GITHUB_ENV
- name: Download dist artifacts
uses: actions/download-artifact@v8
with:
pattern: dist-*
merge-multiple: true
path: dist/
- name: Run GoReleaser (merge)
uses: goreleaser/goreleaser-action@v7
with:
distribution: goreleaser-pro
version: "v2.12.5"
args: continue --merge --skip=publish --skip=sign --skip=validate
env:
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
BUILD_HOST_OS: ${{ env.BUILD_HOST_OS }}
BUILD_HOST_ARCH: ${{ env.BUILD_HOST_ARCH }}
- name: Prepare CINC directory
run: mkdir -p /tmp/cinc
- name: Cache CINC package
id: cache-cinc
uses: actions/cache@v6
with:
path: /tmp/cinc/cinc.deb
key: cinc-auditor-4.56.58
- name: Download CINC (Inspec)
if: steps.cache-cinc.outputs.cache-hit != 'true'
run: |
curl -fsSL --retry 3 --retry-delay 5 --retry-connrefused -o /tmp/cinc/cinc.deb "$cinc_package"
- name: Install CINC
run: |
sudo apt-get -o Acquire::Retries=3 update
sudo apt-get -o Acquire::Retries=3 install -y -f /tmp/cinc/cinc.deb
- name: Install package
run: sudo apt-get install -y -f ./dist/linux_amd64/blitz_amd64.deb
- name: Start service
run: sudo systemctl start blitz
- name: Run install tests
run: |
sudo cinc-auditor exec package/inspec/install/package.rb
- name: Uninstall package
run: |
sudo apt-get remove -y blitz
- name: Run uninstall tests
run: |
sudo cinc-auditor exec package/inspec/remove/package.rb
man-check:
name: Man pages
runs-on: ubuntu-latest
needs: [optimize_ci, setup]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Generate and verify man pages
run: |
make man-check
completion-check:
name: Shell completion (bash, zsh)
runs-on: ubuntu-latest
needs: [optimize_ci, setup]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Generate and verify completion scripts
run: |
make completion-check
generate-o11y-check:
name: Generated metrics
runs-on: ubuntu-latest
needs: [optimize_ci, setup]
if: ${{ needs.optimize_ci.outputs.skip != 'true' }}
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Setup Go
uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: true
- name: Generate and verify metric code
run: |
make generate-o11y-check