mirror of
https://github.com/vhaudiquet/ecrou.git
synced 2026-11-12 22:22:44 +00:00
vhaudiquet
0347309eea
Same dlopen as the snap stages for: the runner has e2fsprogs but not the lib, and the first cold pull would fail. The t64 name with a fallback keeps it honest if the runner image changes base.
90 lines
2.8 KiB
YAML
90 lines
2.8 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
test:
|
|
name: fmt, clippy, test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: clippy, rustfmt
|
|
|
|
- uses: Swatinem/rust-cache@v2
|
|
|
|
# Same order as the pre-commit list in AGENTS.md.
|
|
- name: cargo fmt
|
|
run: cargo fmt --all -- --check
|
|
|
|
- name: cargo clippy
|
|
run: cargo clippy --all-targets -- -D warnings
|
|
|
|
- name: cargo test
|
|
run: cargo test
|
|
|
|
t6:
|
|
name: T6 strace audit
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
|
|
- uses: Swatinem/rust-cache@v2
|
|
|
|
- name: Install strace and the image tooling
|
|
run: |
|
|
sudo apt-get update -qq
|
|
# mke2fs populates from a tarball through a runtime dlopen of
|
|
# libarchive; the runner has e2fsprogs but not the lib.
|
|
sudo apt-get install -y -qq strace libarchive13t64 \
|
|
|| sudo apt-get install -y -qq strace libarchive13
|
|
|
|
# The runner exposes nested KVM; the runner user needs rw on the
|
|
# device node for the probe to pass.
|
|
- name: Open /dev/kvm
|
|
run: |
|
|
test -c /dev/kvm || { echo "::error::no /dev/kvm on this runner"; exit 1; }
|
|
test -w /dev/kvm || sudo chmod 666 /dev/kvm
|
|
|
|
# The engine is dlopen'd at runtime: build libkrun from the same
|
|
# tag the snap bundles, and take libkrunfw from the pool the way
|
|
# the snap's libkrunfw part does.
|
|
- name: Build the engine
|
|
run: |
|
|
curl -fsSL -o /tmp/libkrunfw5.deb \
|
|
https://archive.ubuntu.com/ubuntu/pool/universe/libk/libkrunfw/libkrunfw5_5.5.0+ds-1_amd64.deb
|
|
echo "924cd545080aaf5da66740d12a51b7a5cbd9a5c0b502d21cbef9bc82bf1c8b6b /tmp/libkrunfw5.deb" | sha256sum -c
|
|
dpkg -x /tmp/libkrunfw5.deb /tmp/libkrunfw
|
|
git clone --depth 1 --branch v1.19.7 https://github.com/containers/libkrun /tmp/libkrun
|
|
cargo build --release --manifest-path /tmp/libkrun/Cargo.toml -p libkrun --features net,blk
|
|
mkdir /tmp/engine
|
|
cp /tmp/libkrun/target/release/libkrun.so /tmp/engine/libkrun.so.1
|
|
cp /tmp/libkrunfw/usr/lib/x86_64-linux-gnu/libkrunfw.so.5.5.0 /tmp/engine/
|
|
ln -s libkrunfw.so.5.5.0 /tmp/engine/libkrunfw.so.5
|
|
|
|
- name: Build the CLI
|
|
run: cargo build --release -p ecrou-cli
|
|
|
|
- name: T6 — no denied syscalls in the host process tree
|
|
env:
|
|
ECROU_BIN: ${{ github.workspace }}/target/release/ecrou
|
|
LD_LIBRARY_PATH: /tmp/engine
|
|
run: cargo test -p ecrou-cli -- --ignored
|