fix grpc tests port toctou #6001
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Licensed to the Apache Software Foundation (ASF) under one or more | |
| # contributor license agreements. See the NOTICE file distributed with | |
| # this work for additional information regarding copyright ownership. | |
| # The ASF licenses this file to You under the Apache License, Version 2.0 | |
| # (the "License"); you may not use this file except in compliance with | |
| # the License. You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| # | |
| name: main jdk17 build | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| paths-ignore: | |
| - 'docs/**' | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - 'docs/**' | |
| # Superseded PR runs are dead work: cancel them. Never cancel a main build -- | |
| # that run is the record for a commit that is already merged. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| # Single source of truth for the build/integration-tests shard split: the | |
| # `integration-tests` job runs exactly these modules and the `build` job | |
| # excludes exactly these modules, both derived from this one list. | |
| # | |
| # Do NOT split this into two hand-maintained lists. The dangerous direction is | |
| # silent: a module excluded from `build` but missing from the shard runs | |
| # nowhere, and CI stays green while the tests stop existing. | |
| # | |
| # These six are ~15 of the build's 37 minutes -- five are testcontainers-backed | |
| # (Elasticsearch/OpenSearch/Solr/Kafka/MinIO) and tika-pipes-integration-tests | |
| # forks JVMs. Adding a slow IT module here is the intended way to rebalance. | |
| IT_MODULES: ':tika-pipes-integration-tests,:tika-pipes-es-integration-tests,:tika-pipes-opensearch-integration-tests,:tika-pipes-solr-integration-tests,:tika-pipes-kafka-integration-tests,:tika-pipes-s3-integration-tests' | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| strategy: | |
| matrix: | |
| java: [ '17' ] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up JDK ${{ matrix.java }} | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: ${{ matrix.java }} | |
| cache: 'maven' | |
| - name: Install external tools | |
| run: sudo apt-get update && sudo apt-get install -y ffmpeg libimage-exiftool-perl | |
| # Everything except $IT_MODULES, which the integration-tests job owns. | |
| # sed turns each ':artifactId' into the '!:artifactId' exclusion form. | |
| # rat runs in its own SERIAL invocation: apache-rat-plugin 0.18 is not | |
| # thread-safe (ConcurrentModificationException / corrupted counters under | |
| # -T), so it must never share a -T1C command line. | |
| - name: License check (apache-rat, serial) | |
| run: | | |
| mvn apache-rat:check -Pci \ | |
| -pl "$(echo "$IT_MODULES" | sed 's/:/!:/g')" \ | |
| -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" | |
| # Pre-install tika-annotation-processor before any -T1C invocation: | |
| # annotationProcessorPaths resolves from the LOCAL REPO, not the reactor, | |
| # so parallel Maven schedules consumers before the processor's install | |
| # and the build races to "Could not find artifact tika-annotation-processor". | |
| # javadoc:aggregate is push-only: it is an aggregate-docs artifact, is | |
| # single-threaded, and javadoc breakage is caught on main within the hour; | |
| # PR pushes should not wait on it. | |
| - name: Build with Maven | |
| run: | | |
| mvn install -Pfast -pl :tika-annotation-processor -am -B -q | |
| mvn clean test install ${{ github.event_name == 'push' && 'javadoc:aggregate' || '' }} -Pci -T1C \ | |
| -pl "$(echo "$IT_MODULES" | sed 's/:/!:/g')" \ | |
| -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" | |
| integration-tests: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| # No `needs: build`, same reasoning as e2e-tests below: this job installs the | |
| # reactor itself, so gating on build would only serialize it. | |
| strategy: | |
| matrix: | |
| java: [ '17' ] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up JDK ${{ matrix.java }} | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: ${{ matrix.java }} | |
| cache: 'maven' | |
| - name: Install external tools | |
| run: sudo apt-get update && sudo apt-get install -y ffmpeg libimage-exiftool-perl | |
| # Full reactor for the same reason as the e2e job: these modules depend on | |
| # the tika-pipes plugin zips, and a zip-type dependency never matches a | |
| # jar-packaging reactor module, so -am cannot supply them. -Pfast keeps it | |
| # to ~3 min; the tests themselves run in the next step. | |
| - name: Install all modules (produces the plugin zips) | |
| run: mvn install -Pfast -pl :tika-annotation-processor -am -B -q && mvn clean install -Pfast -T1C -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" | |
| # apache-rat:check here too -- the build job no longer sees these modules, | |
| # so without this they would drop out of license checking entirely. | |
| - name: Run integration tests | |
| run: | | |
| mvn clean apache-rat:check test -Pci \ | |
| -pl "$IT_MODULES" \ | |
| -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" | |
| e2e-tests: | |
| runs-on: ubuntu-latest | |
| # full-reactor install added; 30 was tight for it | |
| timeout-minutes: 45 | |
| # No `needs: build` on purpose: this job checks out and installs the reactor | |
| # itself, so it consumes nothing from `build`. Gating on it only serialized | |
| # ~5 min onto the critical path. | |
| strategy: | |
| matrix: | |
| java: [ '17' ] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up JDK ${{ matrix.java }} | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: ${{ matrix.java }} | |
| cache: 'maven' | |
| # Full reactor, not -pl ... -am: the e2e modules need tika-pipes-plugins zips, and a | |
| # zip-type dependency never matches a jar-packaging reactor module, so -am treats every | |
| # plugin zip as external and skips building those modules entirely. install (not verify) | |
| # because the assembly sets attach=false (TIKA-4723) and an install-phase install-file is | |
| # what puts each zip in the local repo. -Pfast (skipTests + rat/checkstyle/spotless | |
| # off) because the build job owns all of that; this job only needs the artifacts. | |
| - name: Install all modules (produces the plugin zips) | |
| run: mvn install -Pfast -pl :tika-annotation-processor -am -B -q && mvn clean install -Pfast -T1C -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" | |
| # -pl must name the leaf modules: tika-e2e-tests is an aggregator pom, and Maven does | |
| # not pull in a selected aggregator's children, so this job built two pom-only modules | |
| # and ran zero tests while reporting green. | |
| - name: Run E2E Tests | |
| run: mvn -pl :tika-e2e-tests-server,:tika-grpc-e2e-test clean verify -Pe2e -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" |