lading/.github/workflows/ci.yml at 1ddcdc6d2b65f3cc149eff2ecc04cf2a4301ab50 · DataDog/lading · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
name: Continuous integration

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: ci/shellcheck

  rust_actions:
    name: Rust Actions (Check/Fmt/Clippy)
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        tool: [check, fmt, clippy]
        include:
          - tool: check
            protobuf: true
            fuse: true
            components: ""
            command: ci/check
          - tool: fmt
            protobuf: true
            fuse: true
            components: "rustfmt"
            command: ci/fmt
          - tool: clippy
            protobuf: true
            fuse: true
            components: "clippy"
            command: ci/clippy
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1.10
        with:
          components: ${{matrix.components}}
      - name: Install Protobuf
        if: matrix.protobuf
        uses: ./.github/actions/install-protobuf
      - name: Install FUSE
        if: matrix.fuse
        uses: ./.github/actions/install-fuse
      - name: Run ${{ matrix.tool }}
        run: ${{ matrix.command }}

  cargo-deny: # only runs on Linux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1.10
      - name: Install Protobuf
        uses: ./.github/actions/install-protobuf
      - name: Install FUSE
        uses: ./.github/actions/install-fuse
      - run: ci/deny

  test:
    name: Test Suite
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1.10
      - name: Install Protobuf
        uses: ./.github/actions/install-protobuf
      - name: Install FUSE
        uses: ./.github/actions/install-fuse
      - name: Install nextest
        uses: taiki-e/install-action@3839ec485e8ef50e4a86e9cd116260b68a412c07 # v2.58.10
        with:
          tool: nextest@0.9
      - run: ci/test

  integration-test:
    name: Integration Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1.10
      - name: Install Protobuf
        uses: ./.github/actions/install-protobuf
      - name: Install FUSE
        uses: ./.github/actions/install-fuse
      - run: ci/integration-test
        timeout-minutes: 30

  kani:
    name: Kani Proofs
    runs-on: ubuntu-latest
    strategy:
      matrix:
        crate: [lading_throttle, lading_payload]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1.10
      - name: Install Protobuf
        uses: ./.github/actions/install-protobuf
      - name: Install FUSE
        uses: ./.github/actions/install-fuse
      - name: Install kani
        run: cargo install kani-verifier
      - run: ci/kani ${{ matrix.crate }}
        timeout-minutes: 30

  buf:
    runs-on: ubuntu-latest
    steps:
      # Check our protobufs for lint cleanliness and for lack of breaking
      # changes
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1.10
      - name: Install Protobuf
        uses: ./.github/actions/install-protobuf
      - name: Install FUSE
        uses: ./.github/actions/install-fuse
      - name: buf-setup
        uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
      - run: ci/buf

  actionlint:
    runs-on: ubuntu-latest
    steps:
      - name: set actionlint version & checksum
        id: version
        run: |
          export ACTIONLINT="1.7.3"
          export ACTIONLINT_CHECKSUM="37252b4d440b56374b0fc1726e05fd7452d30d6d774f6e9b52e65bb64475f9db"

          echo "actionlint version: ${ACTIONLINT}"
          echo "actionlint checksum: ${ACTIONLINT_CHECKSUM}"

          echo "ACTIONLINT=${ACTIONLINT}" >> $GITHUB_OUTPUT
          echo "ACTIONLINT_CHECKSUM=${ACTIONLINT_CHECKSUM}" >> $GITHUB_OUTPUT

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Download actionlint
        shell: bash
        run: |
          wget https://github.com/rhysd/actionlint/releases/download/v${{ steps.version.outputs.ACTIONLINT }}/actionlint_${{ steps.version.outputs.ACTIONLINT }}_linux_amd64.tar.gz

          echo "${{ steps.version.outputs.ACTIONLINT_CHECKSUM }}  actionlint_${{ steps.version.outputs.ACTIONLINT }}_linux_amd64.tar.gz" >> CHECKSUMS
          sha256sum -c CHECKSUMS

          tar -xvf actionlint_${{ steps.version.outputs.ACTIONLINT }}_linux_amd64.tar.gz
      - name: Check workflow files
        shell: bash
        run: |
          ./actionlint -color \
            -ignore 'Double quote to prevent globbing and word splitting' \
            -ignore 'Consider using { cmd1; cmd2; } >> file instead of individual redirects' \
            -ignore 'Declare and assign separately to avoid masking return values'

  action-sha-pin-check:
    runs-on: ubuntu-latest
    steps:
      - name: Check out branch
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Check all GitHub Actions in ".github/workflows" are pinned to SHAs
        uses: stacklok/frizbee-action@c7009cdb455a69ae0dab0c37f296e0f545b4211c # v0.0.5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          actions: ".github/workflows"
          dockerfiles: ""
          fail_on_unpinned: true
          open_pr: false
      - name: Check all GitHub Actions in ".github/actions" are pinned to SHAs
        uses: stacklok/frizbee-action@c7009cdb455a69ae0dab0c37f296e0f545b4211c # v0.0.5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          actions: ".github/actions"
          dockerfiles: ""
          fail_on_unpinned: true
          open_pr: false