Skip to content

fix grpc tests port toctou #6001

fix grpc tests port toctou

fix grpc tests port toctou #6001

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
name: main jdk17 build
on:
pull_request:
branches: [ main ]
paths-ignore:
- 'docs/**'
push:
branches: [ main ]
paths-ignore:
- 'docs/**'
# Superseded PR runs are dead work: cancel them. Never cancel a main build --
# that run is the record for a commit that is already merged.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
env:
# Single source of truth for the build/integration-tests shard split: the
# `integration-tests` job runs exactly these modules and the `build` job
# excludes exactly these modules, both derived from this one list.
#
# Do NOT split this into two hand-maintained lists. The dangerous direction is
# silent: a module excluded from `build` but missing from the shard runs
# nowhere, and CI stays green while the tests stop existing.
#
# These six are ~15 of the build's 37 minutes -- five are testcontainers-backed
# (Elasticsearch/OpenSearch/Solr/Kafka/MinIO) and tika-pipes-integration-tests
# forks JVMs. Adding a slow IT module here is the intended way to rebalance.
IT_MODULES: ':tika-pipes-integration-tests,:tika-pipes-es-integration-tests,:tika-pipes-opensearch-integration-tests,:tika-pipes-solr-integration-tests,:tika-pipes-kafka-integration-tests,:tika-pipes-s3-integration-tests'
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 60
strategy:
matrix:
java: [ '17' ]
steps:
- uses: actions/checkout@v6
- name: Set up JDK ${{ matrix.java }}
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
cache: 'maven'
- name: Install external tools
run: sudo apt-get update && sudo apt-get install -y ffmpeg libimage-exiftool-perl
# Everything except $IT_MODULES, which the integration-tests job owns.
# sed turns each ':artifactId' into the '!:artifactId' exclusion form.
# rat runs in its own SERIAL invocation: apache-rat-plugin 0.18 is not
# thread-safe (ConcurrentModificationException / corrupted counters under
# -T), so it must never share a -T1C command line.
- name: License check (apache-rat, serial)
run: |
mvn apache-rat:check -Pci \
-pl "$(echo "$IT_MODULES" | sed 's/:/!:/g')" \
-B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
# Pre-install tika-annotation-processor before any -T1C invocation:
# annotationProcessorPaths resolves from the LOCAL REPO, not the reactor,
# so parallel Maven schedules consumers before the processor's install
# and the build races to "Could not find artifact tika-annotation-processor".
# javadoc:aggregate is push-only: it is an aggregate-docs artifact, is
# single-threaded, and javadoc breakage is caught on main within the hour;
# PR pushes should not wait on it.
- name: Build with Maven
run: |
mvn install -Pfast -pl :tika-annotation-processor -am -B -q
mvn clean test install ${{ github.event_name == 'push' && 'javadoc:aggregate' || '' }} -Pci -T1C \
-pl "$(echo "$IT_MODULES" | sed 's/:/!:/g')" \
-B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
integration-tests:
runs-on: ubuntu-latest
timeout-minutes: 45
# No `needs: build`, same reasoning as e2e-tests below: this job installs the
# reactor itself, so gating on build would only serialize it.
strategy:
matrix:
java: [ '17' ]
steps:
- uses: actions/checkout@v6
- name: Set up JDK ${{ matrix.java }}
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
cache: 'maven'
- name: Install external tools
run: sudo apt-get update && sudo apt-get install -y ffmpeg libimage-exiftool-perl
# Full reactor for the same reason as the e2e job: these modules depend on
# the tika-pipes plugin zips, and a zip-type dependency never matches a
# jar-packaging reactor module, so -am cannot supply them. -Pfast keeps it
# to ~3 min; the tests themselves run in the next step.
- name: Install all modules (produces the plugin zips)
run: mvn install -Pfast -pl :tika-annotation-processor -am -B -q && mvn clean install -Pfast -T1C -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
# apache-rat:check here too -- the build job no longer sees these modules,
# so without this they would drop out of license checking entirely.
- name: Run integration tests
run: |
mvn clean apache-rat:check test -Pci \
-pl "$IT_MODULES" \
-B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
e2e-tests:
runs-on: ubuntu-latest
# full-reactor install added; 30 was tight for it
timeout-minutes: 45
# No `needs: build` on purpose: this job checks out and installs the reactor
# itself, so it consumes nothing from `build`. Gating on it only serialized
# ~5 min onto the critical path.
strategy:
matrix:
java: [ '17' ]
steps:
- uses: actions/checkout@v6
- name: Set up JDK ${{ matrix.java }}
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
cache: 'maven'
# Full reactor, not -pl ... -am: the e2e modules need tika-pipes-plugins zips, and a
# zip-type dependency never matches a jar-packaging reactor module, so -am treats every
# plugin zip as external and skips building those modules entirely. install (not verify)
# because the assembly sets attach=false (TIKA-4723) and an install-phase install-file is
# what puts each zip in the local repo. -Pfast (skipTests + rat/checkstyle/spotless
# off) because the build job owns all of that; this job only needs the artifacts.
- name: Install all modules (produces the plugin zips)
run: mvn install -Pfast -pl :tika-annotation-processor -am -B -q && mvn clean install -Pfast -T1C -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
# -pl must name the leaf modules: tika-e2e-tests is an aggregator pom, and Maven does
# not pull in a selected aggregator's children, so this job built two pom-only modules
# and ran zero tests while reporting green.
- name: Run E2E Tests
run: mvn -pl :tika-e2e-tests-server,:tika-grpc-e2e-test clean verify -Pe2e -B "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"