ci(arm): arm-cargo-host concurrency + full src/ purge (DAK-7483) #294
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - '**.md' | |
| - 'CHANGELOG*' | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - '**.md' | |
| - 'CHANGELOG*' | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| audit: | |
| name: Security Audit | |
| runs-on: [self-hosted, linux, x64] | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: audit | |
| - name: Install cargo-audit | |
| run: which cargo-audit >/dev/null 2>&1 || cargo install cargo-audit --locked | |
| - name: Run cargo audit | |
| run: cargo audit 2>&1 || true | |
| - name: Fail on HIGH/CRITICAL CVEs (CVSS >= 7.0) | |
| run: | | |
| cargo audit --json 2>/dev/null | python3 -c " | |
| import sys, json | |
| try: | |
| data = json.load(sys.stdin) | |
| except Exception: | |
| print('WARNING: could not parse audit JSON — skipping CVSS gate') | |
| sys.exit(0) | |
| vulns = data.get('vulnerabilities', {}).get('list', []) | |
| high = [ | |
| v for v in vulns | |
| if (v.get('advisory', {}).get('cvss') or {}).get('score', 0.0) >= 7.0 | |
| ] | |
| if high: | |
| print(f'ERROR: {len(high)} HIGH/CRITICAL CVE(s) detected (CVSS >= 7.0):') | |
| for v in high: | |
| adv = v.get('advisory', {}) | |
| score = (adv.get('cvss') or {}).get('score', '?') | |
| print(f' [{adv.get(\"id\", \"?\")}] CVSS={score} — {adv.get(\"title\", \"?\")}') | |
| sys.exit(1) | |
| print('No HIGH/CRITICAL CVEs (CVSS >= 7.0) found') | |
| " | |
| check: | |
| name: Check | |
| runs-on: [self-hosted, linux, arm64] | |
| # Serialize ARM cargo-build jobs org-wide (cli-arm, mcp-arm, dakera-arm share the host). | |
| # Concurrent builds race on ~/.cargo/registry/src extraction (DAK-7483). | |
| concurrency: | |
| group: arm-cargo-host | |
| cancel-in-progress: false | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: arm64-ci-v2 | |
| - name: Purge stale build artifacts | |
| run: | | |
| rm -rf target/ | |
| rm -rf ~/.cargo/registry/src/ | |
| - run: cargo check | |
| clippy: | |
| name: Clippy | |
| runs-on: [self-hosted, linux, arm64] | |
| concurrency: | |
| group: arm-cargo-host | |
| cancel-in-progress: false | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: arm64-ci-v2 | |
| - name: Purge stale build artifacts | |
| run: | | |
| rm -rf target/ | |
| rm -rf ~/.cargo/registry/src/ | |
| - run: cargo clippy -- -D warnings | |
| fmt: | |
| name: Format | |
| runs-on: [self-hosted, linux, arm64] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - run: cargo fmt --check | |
| test: | |
| name: Test | |
| runs-on: [self-hosted, linux, arm64] | |
| concurrency: | |
| group: arm-cargo-host | |
| cancel-in-progress: false | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: arm64-ci-v2 | |
| - name: Purge stale build artifacts | |
| run: | | |
| rm -rf target/ | |
| rm -rf ~/.cargo/registry/src/ | |
| - run: cargo test | |
| integration-test: | |
| name: Integration Test (Container) | |
| needs: [check, clippy, fmt, test] | |
| runs-on: [self-hosted, linux, arm64] | |
| concurrency: | |
| group: arm-cargo-host | |
| cancel-in-progress: false | |
| services: | |
| dakera: | |
| image: ghcr.io/dakera-ai/dakera:latest | |
| ports: | |
| - 13300:3000 | |
| env: | |
| DAKERA_ROOT_API_KEY: test-integration-key | |
| DAKERA_AUTH_ENABLED: 'false' | |
| options: >- | |
| --health-cmd "curl -sf http://localhost:3000/health || exit 1" | |
| --health-interval 5s | |
| --health-timeout 3s | |
| --health-retries 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: integration-test | |
| cache-all-crates: "true" | |
| - name: Purge stale build artifacts | |
| run: | | |
| rm -rf target/ | |
| rm -rf ~/.cargo/registry/src/ | |
| - name: Build dk binary | |
| run: cargo build --release | |
| - name: Wait for dakera server | |
| run: | | |
| for i in $(seq 1 30); do | |
| curl -sf http://localhost:13300/health && break || true | |
| echo "Waiting for dakera server... attempt $i/30" | |
| sleep 2 | |
| done | |
| curl -sf http://localhost:13300/health || (echo "ERROR: dakera server failed to start" && exit 1) | |
| - name: Run container integration tests | |
| env: | |
| DAKERA_TEST_URL: http://localhost:13300 | |
| DAKERA_TEST_KEY: test-integration-key | |
| run: cargo test --test integration -- --ignored --nocapture |