Merge pull request #11 from DefGuard/sync/upstream-release-2.1 #77
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Continuous integration | |
| on: | |
| push: | |
| branches: | |
| - dev | |
| - "release/**" | |
| - "stable/**" | |
| paths-ignore: | |
| - "*.md" | |
| - "LICENSE" | |
| pull_request: | |
| branches: | |
| - dev | |
| - "release/**" | |
| - "stable/**" | |
| paths-ignore: | |
| - "*.md" | |
| - "LICENSE" | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| lint: | |
| runs-on: | |
| - self-hosted | |
| - Linux | |
| - X64 | |
| container: public.ecr.aws/docker/library/rust:1 | |
| env: | |
| CARGO_TERM_COLOR: always | |
| SQLX_OFFLINE: true | |
| RUSTC_WRAPPER: sccache | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| - name: Export workspace-relative cache paths | |
| run: | | |
| echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo" >> $GITHUB_ENV | |
| echo "$GITHUB_WORKSPACE/.cargo/bin" >> $GITHUB_PATH | |
| - name: Cache cargo registry | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| ${{ env.CARGO_HOME }}/registry/index | |
| ${{ env.CARGO_HOME }}/registry/cache | |
| ${{ env.CARGO_HOME }}/git/db | |
| key: cargo-registry-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: cargo-registry- | |
| - name: Run sccache-cache | |
| uses: mozilla-actions/sccache-action@1583d6b38d7be47f593cb472781bbb21cab4321e # v0.0.10 | |
| - name: Scan code with Trivy | |
| uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 | |
| env: | |
| TRIVY_SHOW_SUPPRESSED: 1 | |
| TRIVY_IGNOREFILE: "./.trivyignore.yaml" | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "." | |
| exit-code: "1" | |
| ignore-unfixed: true | |
| severity: "CRITICAL,HIGH,MEDIUM" | |
| scanners: "vuln" | |
| - name: Trust repository directory | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Install protoc | |
| run: apt-get update && apt-get -y install protobuf-compiler | |
| - name: Check format | |
| run: | | |
| rustup component add rustfmt | |
| cargo fmt -- --check | |
| - name: Run clippy linter | |
| run: | | |
| rustup component add clippy | |
| cargo clippy --all-targets --all-features -- -D warnings | |
| - name: Install cargo-deny | |
| uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2.82.2 | |
| with: | |
| tool: cargo-deny | |
| - name: Run cargo deny | |
| run: cargo deny check | |
| - name: Show sccache stats | |
| if: always() | |
| run: sccache --show-stats | |
| build: | |
| runs-on: | |
| - self-hosted | |
| - Linux | |
| - X64 | |
| container: public.ecr.aws/docker/library/rust:1 | |
| env: | |
| CARGO_TERM_COLOR: always | |
| SQLX_OFFLINE: true | |
| RUSTC_WRAPPER: sccache | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| - name: Export workspace-relative cache paths | |
| run: | | |
| echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo" >> $GITHUB_ENV | |
| echo "$GITHUB_WORKSPACE/.cargo/bin" >> $GITHUB_PATH | |
| - name: Cache cargo registry | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| ${{ env.CARGO_HOME }}/registry/index | |
| ${{ env.CARGO_HOME }}/registry/cache | |
| ${{ env.CARGO_HOME }}/git/db | |
| key: cargo-registry-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: cargo-registry- | |
| - name: Run sccache-cache | |
| uses: mozilla-actions/sccache-action@1583d6b38d7be47f593cb472781bbb21cab4321e # v0.0.10 | |
| - name: Install protoc | |
| run: apt-get update && apt-get -y install protobuf-compiler | |
| - name: Install cargo-nextest | |
| uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2.82.2 | |
| with: | |
| tool: cargo-nextest | |
| - name: Mark workspace as safe for git | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Build and archive tests | |
| run: | | |
| cargo nextest archive \ | |
| --locked \ | |
| --all-features \ | |
| --archive-file nextest-archive.tar.zst \ | |
| --config 'profile.test.debug=false' \ | |
| --config 'profile.test.strip="debuginfo"' | |
| - name: Show sccache stats | |
| if: always() | |
| run: sccache --show-stats | |
| - name: Upload test archive | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: nextest-archive | |
| path: nextest-archive.tar.zst | |
| retention-days: 1 | |
| test: | |
| needs: build | |
| runs-on: | |
| - self-hosted | |
| - Linux | |
| - X64 | |
| container: public.ecr.aws/docker/library/rust:1 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| partition: [1, 2, 3, 4, 5, 6, 7, 8] | |
| services: | |
| postgres: | |
| image: public.ecr.aws/docker/library/postgres:17-alpine | |
| env: | |
| POSTGRES_DB: defguard | |
| POSTGRES_USER: defguard | |
| POSTGRES_PASSWORD: defguard | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| command: postgres -c max_connections=400 | |
| env: | |
| CARGO_TERM_COLOR: always | |
| DEFGUARD_DB_HOST: postgres | |
| DEFGUARD_DB_PORT: 5432 | |
| DEFGUARD_DB_NAME: defguard | |
| DEFGUARD_DB_USER: defguard | |
| DEFGUARD_DB_PASSWORD: defguard | |
| DATABASE_URL: "postgresql://defguard:defguard@postgres/defguard" | |
| SQLX_OFFLINE: true | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 1 | |
| - name: Download test archive | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: nextest-archive | |
| - name: Install cargo-nextest | |
| uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2.82.2 | |
| with: | |
| tool: cargo-nextest | |
| - name: Run tests (shard ${{ matrix.partition }}/8) | |
| run: | | |
| cargo nextest run \ | |
| --no-fail-fast \ | |
| --archive-file nextest-archive.tar.zst \ | |
| --partition hash:${{ matrix.partition }}/8 | |
| # skip for defguard-demo | |
| # test-ldap: | |
| # needs: build | |
| # runs-on: | |
| # - self-hosted | |
| # - Linux | |
| # - X64 | |
| # steps: | |
| # - name: Checkout | |
| # uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| # with: | |
| # submodules: recursive | |
| # fetch-depth: 1 | |
| # - name: Download test archive | |
| # uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| # with: | |
| # name: nextest-archive | |
| # - name: Download cargo-nextest binary | |
| # run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - | |
| # - name: Log in to ghcr.io | |
| # uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3 | |
| # with: | |
| # registry: ghcr.io | |
| # username: ${{ github.actor }} | |
| # password: ${{ secrets.GITHUB_TOKEN }} | |
| # - name: Start Postgres and OpenLDAP | |
| # run: docker compose -p defguard-ldap -f docker-compose.ldap-test.yaml up -d --wait db openldap | |
| # - name: Run LDAP integration tests | |
| # run: | | |
| # docker run --rm \ | |
| # --network defguard-ldap_default \ | |
| # -v "$PWD:/src" -w /src \ | |
| # -v "$PWD/cargo-nextest:/usr/local/cargo/bin/cargo-nextest:ro" \ | |
| # -e CARGO_TERM_COLOR=always \ | |
| # -e SQLX_OFFLINE=true \ | |
| # -e DATABASE_URL=postgres://defguard:defguard@db:5432/defguard \ | |
| # -e LDAP_URL=ldap://openldap:1389 \ | |
| # -e LDAP_BIND_USERNAME=cn=admin,dc=example,dc=org \ | |
| # -e LDAP_BIND_PASSWORD=pass123 \ | |
| # -e LDAP_USER_SEARCH_BASE=ou=users,dc=example,dc=org \ | |
| # -e LDAP_GROUP_SEARCH_BASE=ou=groups,dc=example,dc=org \ | |
| # -e LDAP_USER_CLASS=inetOrgPerson \ | |
| # -e LDAP_GROUP_CLASS=groupOfUniqueNames \ | |
| # -e LDAP_USERNAME_ATTR=cn \ | |
| # -e LDAP_GROUPNAME_ATTR=cn \ | |
| # -e LDAP_MEMBER_ATTR=memberOf \ | |
| # -e LDAP_GROUP_MEMBER_ATTR=uniqueMember \ | |
| # public.ecr.aws/docker/library/rust:1 \ | |
| # cargo nextest run --archive-file nextest-archive.tar.zst --workspace-remap . --run-ignored only -E 'package(defguard_core) and test(/^ldap::/)' | |
| # - name: Stop compose | |
| # if: always() | |
| # run: docker compose -p defguard-ldap -f docker-compose.ldap-test.yaml down -v | |
| cleanup: | |
| needs: [test] | |
| if: needs.test.result == 'success' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: write | |
| steps: | |
| - name: Delete test archive artifact | |
| uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 | |
| with: | |
| script: | | |
| const artifacts = await github.rest.actions.listWorkflowRunArtifacts({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| run_id: context.runId, | |
| }); | |
| const artifact = artifacts.data.artifacts.find(a => a.name === 'nextest-archive'); | |
| if (artifact) { | |
| await github.rest.actions.deleteArtifact({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| artifact_id: artifact.id, | |
| }); | |
| } |