Skip to content
Continuous Integration

Ensure all test networks are within _with_ statements #4735

Sign in to view logs

Ensure all test networks are within _with_ statements

Ensure all test networks are within _with_ statements #4735

Workflow file for this run

.github/workflows/ci.yml at 39526bf
name: Continuous Integration
on:
schedule:
- cron: "0 0 * * 0"
pull_request:
workflow_dispatch:
merge_group:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ !contains(github.ref, 'main')}}
permissions: read-all
jobs:
checks:
name: "Format and License Checks"
runs-on:
[
self-hosted,
1ES.Pool=gha-vmss-d16av5-ci,
"JobId=ci_checks-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}",
]
container:
image: mcr.microsoft.com/azurelinux/base/core:3.0
options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
steps:
- name: "Checkout dependencies"
shell: bash
run: |
gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
tdnf -y update
tdnf -y install ca-certificates git
- uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Run CI checks
run: |
set -ex
git config --global --add safe.directory /__w/CCF/CCF
tdnf -y install tar npm build-essential
./scripts/setup-dev.sh
./scripts/ci-checks.sh
shell: bash
ci-docs-tidy-unit-partitions:
name: "Docs/clang-tidy/Unit/Partitions"
needs: checks
runs-on:
[
self-hosted,
1ES.Pool=gha-vmss-d16av5-ci,
"JobId=ci_build_tidy-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}",
]
container:
image: mcr.microsoft.com/azurelinux/base/core:3.0
options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
steps:
- name: "Checkout dependencies"
shell: bash
run: |
set -ex
gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
tdnf -y update
tdnf -y install ca-certificates git
- uses: actions/checkout@v5
with:
fetch-depth: 0
- name: "Install dependencies"
shell: bash
run: |
set -ex
./scripts/setup-ci.sh
- name: "Build Debug with clang-tidy"
run: |
set -ex
git config --global --add safe.directory /__w/CCF/CCF
mkdir build
cd build
cmake -GNinja -DCMAKE_BUILD_TYPE=Debug -DCLANG_TIDY=ON ..
ninja
shell: bash
- name: "Run tests for Python package"
run: |
set -ex
python3 -m venv env
source env/bin/activate
pip install -U -q pip pytest
pip install -q -U -e python
cd python
pytest
- name: "Check doc builds with no warnings"
run: |
set -ex
python3 -m venv env
source env/bin/activate
pip install -U pip
pip install -U -e ./python
pip install -U -r doc/requirements.txt
pip install -U -r doc/historical_ccf_requirements.txt
sphinx-build --fail-on-warning -b html doc doc/html
- name: "Run Unit tests"
run: |
set -ex
cd build
./tests.sh --output-on-failure -L unit -j$(nproc --all)
# Note that those are only run on the virtual CI, as they require enough
# privileges to configure iptables. ACI-based pools run unprivileged
# containers, and so cannot run these tests unfortunately.
- name: "Run partitions tests"
run: |
set -ex
cd build
./tests.sh --timeout 360 --output-on-failure -L partitions -C partitions
build_and_test_virtual:
name: "Virtual CI"
needs: checks
runs-on:
[
self-hosted,
1ES.Pool=gha-vmss-d16av5-ci,
"JobId=ci_build_test_virtual-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}",
]
container:
image: mcr.microsoft.com/azurelinux/base/core:3.0
options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
steps:
- name: "Checkout dependencies"
shell: bash
run: |
gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
tdnf -y update
tdnf -y install ca-certificates git
- uses: actions/checkout@v5
with:
fetch-depth: 0
- name: "cpuinfo"
run: |
cat /proc/cpuinfo
shell: bash
- name: "Install dependencies"
shell: bash
run: |
set -ex
./scripts/setup-ci.sh
- name: "Confirm running on Virtual"
run: |
set -ex
python3 tests/infra/platform_detection.py virtual
shell: bash
- name: "Build Debug"
run: |
set -ex
git config --global --add safe.directory /__w/CCF/CCF
mkdir build
cd build
cmake -GNinja -DCMAKE_BUILD_TYPE=Debug ..
ninja
shell: bash
- name: "Test virtual"
run: |
set -ex
cd build
rm -rf /github/home/.cache
mkdir -p /github/home/.cache
# End to end tests
./tests.sh --timeout 360 --output-on-failure -LE "benchmark|suite|unit"
shell: bash
- name: "Upload logs for virtual"
uses: actions/upload-artifact@v4
with:
name: logs-azurelinux-virtual
path: |
build/workspace/*/*.config.json
build/workspace/*/out
build/workspace/*/err
build/workspace/*/*.ledger/*
build/workspace/*/stack_trace
if-no-files-found: ignore
if: success() || failure()
build_and_test_caci:
name: "Confidential Container CI"
runs-on:
[
self-hosted,
1ES.Pool=gha-c-aci-ci,
"JobId=ci_caci_milan-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}",
]
needs: checks
steps:
- uses: actions/checkout@v5
with:
fetch-depth: 0
- name: "Dump environment"
run: |
set -ex
# Dump environment variables, extract Fabric_NodeIPOrFQDN
# and save it to a file for reconfiguration test using THIM.
cat /proc/*/environ | tr '\000' '\n' | sort -u | grep Fabric_NodeIPOrFQDN > /Fabric_NodeIPOrFQDN
echo "::group::Disk usage"
df -kh
echo "::endgroup::"
echo "::group::Mounts"
mount
echo "::endgroup::"
echo "::group::CPU Info"
cat /proc/cpuinfo
echo "::endgroup::"
shell: bash
- name: "Confirm running on SEV-SNP"
run: |
set -ex
python3 tests/infra/platform_detection.py snp
shell: bash
- name: "Build Debug"
run: |
set -ex
git config --global --add safe.directory /__w/CCF/CCF
mkdir build
cd build
cmake -GNinja -DCMAKE_BUILD_TYPE=Debug ..
ninja
shell: bash
- name: "Tests"
run: |
set -ex
cd build
rm -rf /github/home/.cache
mkdir -p /github/home/.cache
# Unit tests
./tests.sh --output-on-failure -L unit -j$(nproc --all)
# End to end tests
./tests.sh --timeout 360 --output-on-failure -LE "benchmark|suite|unit"
shell: bash
- name: "Capture dmesg"
run: |
set -ex
echo "::group::Disk usage"
df -kh
echo "::endgroup::"
dmesg > dmesg.log
shell: bash
if: success() || failure()
- name: "Upload logs"
uses: actions/upload-artifact@v4
with:
name: logs-caci-snp
path: |
dmesg.log
build/workspace/*/*.config.json
build/workspace/*/out
build/workspace/*/err
build/workspace/*/*.ledger/*
build/workspace/*/stack_trace
if-no-files-found: ignore
if: success() || failure()
build_and_test_caci_genoa:
name: "Confidential Container CI on Genoa"
runs-on:
[
self-hosted,
1ES.Pool=gha-c-caci-ci-south-central-us,
"JobId=ci_caci_genoa-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}",
]
needs: checks
steps:
- uses: actions/checkout@v5
with:
fetch-depth: 0
- name: "Ensure running on Genoa hardware"
run: |
cat /proc/cpuinfo | grep "model.*: 17"
shell: bash
- name: "Dump environment"
run: |
set -ex
# Dump environment variables, extract Fabric_NodeIPOrFQDN
# and save it to a file for reconfiguration test using THIM.
cat /proc/*/environ | tr '\000' '\n' | sort -u | grep Fabric_NodeIPOrFQDN > /Fabric_NodeIPOrFQDN
echo "::group::Disk usage"
df -kh
echo "::endgroup::"
echo "::group::Mounts"
mount
echo "::endgroup::"
echo "::group::CPU Info"
cat /proc/cpuinfo
echo "::endgroup::"
shell: bash
- name: "Confirm running on SEV-SNP"
run: |
set -ex
python3 tests/infra/platform_detection.py snp
shell: bash
- name: "Build Debug"
run: |
set -ex
git config --global --add safe.directory /__w/CCF/CCF
mkdir build
cd build
cmake -GNinja -DCMAKE_BUILD_TYPE=Debug ..
ninja
shell: bash
- name: "Tests"
run: |
set -ex
cd build
rm -rf /github/home/.cache
mkdir -p /github/home/.cache
# Limited set of tests because Genoa pools have limited resources
# focusing on architecture-specific functionality.
# Unit test for sealing
./tests.sh --output-on-failure -R snp_ioctl_test
# End to end tests for code update (attestation verification)
./tests.sh --timeout 360 --output-on-failure -R code_update
shell: bash
- name: "Capture dmesg"
run: |
set -ex
echo "::group::Disk usage"
df -kh
echo "::endgroup::"
dmesg > dmesg.log
shell: bash
if: success() || failure()
- name: "Upload logs"
uses: actions/upload-artifact@v4
with:
name: logs-caci-snp-genoa
path: |
dmesg.log
build/workspace/*/*.config.json
build/workspace/*/out
build/workspace/*/err
build/workspace/*/*.ledger/*
build/workspace/*/stack_trace
if-no-files-found: ignore
if: success() || failure()