Isolate sanitizer soak from host PHP extensions #60
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: King Canonical Baseline | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: king-canonical-baseline-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| DEBIAN_FRONTEND: noninteractive | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| jobs: | |
| canonical-baseline: | |
| name: Audit, Build, Test, Go-Live | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Setup PHP 8.5 | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.5" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Verify toolchain | |
| run: | | |
| php -v | |
| phpize -v | |
| cargo --version | |
| - name: Lint public PHP stub surface | |
| run: php -l stubs/king.php | |
| - name: Run repo-local static checks | |
| working-directory: extension | |
| run: ./scripts/static-checks.sh | |
| - name: Audit active runtime surface | |
| working-directory: extension | |
| run: ./scripts/audit-runtime-surface.sh | |
| - name: Build canonical release profile | |
| working-directory: extension | |
| run: ./scripts/build-profile.sh release | |
| - name: Run canonical PHPT suite | |
| working-directory: extension | |
| run: ./scripts/test-extension.sh | |
| - name: Run final go-live readiness checks | |
| working-directory: extension | |
| run: ./scripts/go-live-readiness.sh --skip-baseline --output-dir ../dist --benchmark-iterations 5000 --benchmark-warmup 500 --benchmark-budget-file benchmarks/budgets/canonical-ci.json | |
| - name: Upload release package artifact | |
| if: github.event_name == 'workflow_dispatch' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-release-package | |
| if-no-files-found: error | |
| path: | | |
| dist/*.tar.gz | |
| dist/*.tar.gz.sha256 | |
| - name: Upload failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-canonical-baseline-failures | |
| if-no-files-found: ignore | |
| path: | | |
| extension/config.log | |
| extension/tests/*.diff | |
| extension/tests/*.exp | |
| extension/tests/*.log | |
| extension/tests/*.out | |
| profile-smoke: | |
| name: ${{ matrix.profile }} profile smoke | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| profile: | |
| - debug | |
| - asan | |
| - ubsan | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Setup PHP 8.5 | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.5" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Build profile | |
| working-directory: extension | |
| run: ./scripts/build-profile.sh "${{ matrix.profile }}" | |
| - name: Smoke profile artifact | |
| working-directory: extension | |
| run: ./scripts/smoke-profile.sh "${{ matrix.profile }}" | |
| - name: Upload profile failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-${{ matrix.profile }}-profile-failures | |
| if-no-files-found: ignore | |
| path: | | |
| extension/config.log | |
| extension/build/profiles/${{ matrix.profile }}/ | |
| extension/tests/*.diff | |
| extension/tests/*.exp | |
| extension/tests/*.log | |
| extension/tests/*.out | |
| install-package-matrix: | |
| name: Package Install Smoke PHP ${{ matrix.php-version }} | |
| needs: canonical-baseline | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php-version: | |
| - "8.1" | |
| - "8.2" | |
| - "8.3" | |
| - "8.4" | |
| - "8.5" | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Setup PHP ${{ matrix.php-version }} | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "${{ matrix.php-version }}" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Build canonical release profile | |
| working-directory: extension | |
| run: ./scripts/build-profile.sh release | |
| - name: Package canonical release archive | |
| id: package | |
| working-directory: extension | |
| run: | | |
| output="$(./scripts/package-release.sh --output-dir ../dist)" | |
| printf '%s\n' "${output}" | |
| archive_path="$(printf '%s\n' "${output}" | sed -n 's/^Package created: //p' | tail -n 1)" | |
| if [[ -z "${archive_path}" ]]; then | |
| echo "Failed to resolve packaged archive path." >&2 | |
| exit 1 | |
| fi | |
| echo "archive_path=${archive_path}" >> "${GITHUB_OUTPUT}" | |
| - name: Verify packaged clean-host install path | |
| working-directory: extension | |
| run: ./scripts/install-package-matrix.sh --archive "${{ steps.package.outputs.archive_path }}" --php-bins php | |
| - name: Upload package install failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-package-install-${{ matrix.php-version }}-failures | |
| if-no-files-found: ignore | |
| path: | | |
| dist/*.tar.gz | |
| dist/*.tar.gz.sha256 | |
| extension/config.log | |
| release-upgrade-compatibility: | |
| name: Release Upgrade Compatibility | |
| needs: canonical-baseline | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 90 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| submodules: recursive | |
| - name: Setup PHP 8.5 | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.5" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Resolve previous compatibility ref | |
| id: previous | |
| run: | | |
| previous_ref="" | |
| if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then | |
| previous_ref="${{ github.event.pull_request.base.sha }}" | |
| elif [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then | |
| previous_ref="${{ github.event.before }}" | |
| fi | |
| if [[ -z "${previous_ref}" || "${previous_ref}" =~ ^0+$ ]]; then | |
| previous_ref="$(git rev-parse HEAD^)" | |
| fi | |
| echo "ref=${previous_ref}" >> "${GITHUB_OUTPUT}" | |
| - name: Run release upgrade compatibility gate | |
| working-directory: extension | |
| run: ./scripts/check-release-upgrade.sh --from-ref "${{ steps.previous.outputs.ref }}" --artifacts-dir ../compat-artifacts/release-upgrade | |
| - name: Upload release upgrade failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-release-upgrade-failures | |
| if-no-files-found: ignore | |
| path: | | |
| compat-artifacts/release-upgrade/ | |
| extension/config.log | |
| extension/tests/*.diff | |
| extension/tests/*.exp | |
| extension/tests/*.log | |
| extension/tests/*.out | |
| release-downgrade-compatibility: | |
| name: Release Downgrade Compatibility | |
| needs: canonical-baseline | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 90 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| submodules: recursive | |
| - name: Setup PHP 8.5 | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.5" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Resolve previous compatibility ref | |
| id: previous | |
| run: | | |
| previous_ref="" | |
| if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then | |
| previous_ref="${{ github.event.pull_request.base.sha }}" | |
| elif [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then | |
| previous_ref="${{ github.event.before }}" | |
| fi | |
| if [[ -z "${previous_ref}" || "${previous_ref}" =~ ^0+$ ]]; then | |
| previous_ref="$(git rev-parse HEAD^)" | |
| fi | |
| echo "ref=${previous_ref}" >> "${GITHUB_OUTPUT}" | |
| - name: Run release downgrade compatibility gate | |
| working-directory: extension | |
| run: ./scripts/check-release-downgrade.sh --from-ref "${{ steps.previous.outputs.ref }}" --artifacts-dir ../compat-artifacts/release-downgrade | |
| - name: Upload release downgrade failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-release-downgrade-failures | |
| if-no-files-found: ignore | |
| path: | | |
| compat-artifacts/release-downgrade/ | |
| extension/config.log | |
| extension/tests/*.diff | |
| extension/tests/*.exp | |
| extension/tests/*.log | |
| extension/tests/*.out | |
| release-persistence-migration: | |
| name: Release Persistence Migration | |
| needs: canonical-baseline | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 90 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| submodules: recursive | |
| - name: Setup PHP 8.5 | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.5" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Resolve previous compatibility ref | |
| id: previous | |
| run: | | |
| previous_ref="" | |
| if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then | |
| previous_ref="${{ github.event.pull_request.base.sha }}" | |
| elif [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then | |
| previous_ref="${{ github.event.before }}" | |
| fi | |
| if [[ -z "${previous_ref}" || "${previous_ref}" =~ ^0+$ ]]; then | |
| previous_ref="$(git rev-parse HEAD^)" | |
| fi | |
| echo "ref=${previous_ref}" >> "${GITHUB_OUTPUT}" | |
| - name: Run release persistence migration gate | |
| working-directory: extension | |
| run: ./scripts/check-persistence-migration.sh --from-ref "${{ steps.previous.outputs.ref }}" --artifacts-dir ../compat-artifacts/release-persistence-migration | |
| - name: Upload release persistence migration failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-release-persistence-migration-failures | |
| if-no-files-found: ignore | |
| path: | | |
| compat-artifacts/release-persistence-migration/ | |
| extension/config.log | |
| extension/tests/*.diff | |
| extension/tests/*.exp | |
| extension/tests/*.log | |
| extension/tests/*.out | |
| release-config-state-compatibility: | |
| name: Release Config-State Compatibility | |
| needs: canonical-baseline | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 90 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Setup PHP 8.5 | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.5" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Run release config-state compatibility matrix | |
| working-directory: extension | |
| run: ./scripts/check-config-compatibility-matrix.sh --artifacts-dir ../compat-artifacts/release-config-state | |
| - name: Upload release config-state failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-release-config-state-failures | |
| if-no-files-found: ignore | |
| path: | | |
| compat-artifacts/release-config-state/ | |
| extension/config.log | |
| extension/tests/*.diff | |
| extension/tests/*.exp | |
| extension/tests/*.log | |
| extension/tests/*.out | |
| sanitizer-soak: | |
| name: ${{ matrix.mode }} sanitizer soak | |
| needs: canonical-baseline | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - mode: asan | |
| profile: asan | |
| iterations: 5 | |
| - mode: ubsan | |
| profile: ubsan | |
| iterations: 5 | |
| - mode: leak | |
| profile: asan | |
| iterations: 3 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Setup PHP 8.5 | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.5" | |
| coverage: none | |
| extensions: curl, mbstring, openssl, sockets | |
| - name: Setup Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('extension/scripts/quiche-bootstrap.lock', 'extension/scripts/bootstrap-quiche.sh', 'extension/scripts/build-profile.sh') }} | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| autoconf \ | |
| automake \ | |
| bison \ | |
| build-essential \ | |
| clang \ | |
| cmake \ | |
| libssl-dev \ | |
| libcurl4-openssl-dev \ | |
| libtool \ | |
| ninja-build \ | |
| pkg-config \ | |
| re2c | |
| - name: Build sanitizer profile | |
| working-directory: extension | |
| run: ./scripts/build-profile.sh "${{ matrix.profile }}" | |
| - name: Run sanitizer soak | |
| working-directory: extension | |
| run: ./scripts/soak-runtime.sh "${{ matrix.mode }}" --iterations "${{ matrix.iterations }}" --artifacts-dir ../soak-artifacts/${{ matrix.mode }} | |
| - name: Upload sanitizer soak failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: king-${{ matrix.mode }}-soak-diagnostics | |
| if-no-files-found: ignore | |
| path: | | |
| soak-artifacts/${{ matrix.mode }}/ | |
| extension/config.log | |
| extension/tests/*.diff | |
| extension/tests/*.exp | |
| extension/tests/*.log | |
| extension/tests/*.out |