Fix Docker runtime link failures, add smoke test

.dockerignore

@@ -1,3 +1,9 @@
 .scratch/
+.git/
 build/
 build-san/
+_build/
+deps/moxygen/.git/
+deps/moxygen/moxygen/
+deps/moxygen/standalone/
+install/

.github/workflows/ci-main.yml

@@ -5,9 +5,8 @@ name: ci main
 #
 # Job graph:
 #
-#   format ─────────────────────────────────────────────┐
-#   build (linux, asan debug) ── publish ── release ────┼── notify
-#                                                       │   (always)
+#   check-format ──────────────────────────────────────────────────────────────────┐
+#   build (linux, asan debug) ── publish (docker+smoke) ── release ────────────────┼── notify
 
 on:
   push:
@@ -27,7 +26,7 @@ jobs:
   # Verify: format + build/test matrix
   # ════════════════════════════════════════════════════════════════════════════
 
-  format:
+  check-format:
     runs-on: ubuntu-latest
     container: debian:trixie
     steps:
@@ -95,17 +94,12 @@ jobs:
           fail-on-empty: ${{ job.status == 'success' && 'true' || 'false' }}
 
   # ════════════════════════════════════════════════════════════════════════════
-  # Publish: build o-rly artifacts + Docker image (needs verify to pass)
+  # Publish: build o-rly, Docker image + smoke test, push
   # ════════════════════════════════════════════════════════════════════════════
 
   publish:
     needs: [build]
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: ubuntu-22.04-amd64
-    name: publish (${{ matrix.name }})
+    name: publish
     runs-on: ubuntu-22.04
     steps:
       - name: Generate app token
@@ -119,55 +113,70 @@ jobs:
         with:
           submodules: true
 
-      - name: Install system dependencies
-        run: bash deps/moxygen/standalone/install-system-deps.sh
-
-      - name: Download moxygen artifacts
+      - name: Download bookworm moxygen tarball
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ORLY_PLATFORM: bookworm-amd64
         run: bash scripts/setup-deps-tarball.sh
 
-      - name: Set up ccache
-        uses: hendrikmuhs/ccache-action@v1
-        with:
-          key: publish-${{ matrix.name }}
-          max-size: 500M
-
-      - name: Configure
+      - name: Stage tarball for Docker build
         run: |
-          cmake -S . -B _build --preset default \
-            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
-            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
-            -DCMAKE_PREFIX_PATH="$(cat .scratch/cmake_prefix_path.txt)" \
-            -DBUILD_TESTING=OFF
-
-      - name: Build
-        run: cmake --build _build -j$(getconf _NPROCESSORS_ONLN)
-
-      - name: Install
-        run: cmake --install _build --prefix "$GITHUB_WORKSPACE/install"
+          mkdir -p .docker-deps
+          cp -a .scratch/moxygen-install .docker-deps/moxygen
 
       - name: Log in to GHCR
-        if: runner.os == 'Linux'
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-      - name: Build and push Docker image
-        if: runner.os == 'Linux'
+      - name: Build Docker image
         run: |
           SHORT="${GITHUB_SHA:0:7}"
           IMAGE="ghcr.io/${{ github.repository }}"
           docker build -f docker/Dockerfile \
             -t "${IMAGE}:${SHORT}" \
             -t "${IMAGE}:latest" \
             .
+
+      - name: Smoke test Docker image
+        run: |
+          IMAGE="ghcr.io/${{ github.repository }}:latest"
+          echo "==> ldd check"
+          docker run --rm --entrypoint ldd "${IMAGE}" /usr/local/bin/o-rly
+          if docker run --rm --entrypoint ldd "${IMAGE}" /usr/local/bin/o-rly 2>&1 | grep -q "not found"; then
+            echo "ERROR: missing shared libraries"; exit 1
+          fi
+          echo "==> Start container with test config"
+          docker run -d --name orly-smoke --network host \
+            -v "$PWD/tests/test.config.yaml:/etc/o-rly/config.yaml:ro" \
+            "${IMAGE}" --config=/etc/o-rly/config.yaml
+          echo "==> Wait for admin /info"
+          for i in $(seq 1 50); do
+            if curl -sf http://[::1]:9669/info >/dev/null 2>&1; then break; fi
+            sleep 0.1
+            if [ "$i" -eq 50 ]; then
+              echo "ERROR: admin server did not start"; docker logs orly-smoke; exit 1
+            fi
+          done
+          RESP=$(curl -sf http://[::1]:9669/info)
+          echo "Response: $RESP"
+          echo "$RESP" | grep -q '"service":"o-rly"' || { echo "FAIL: bad /info response"; exit 1; }
+          docker stop orly-smoke && docker rm orly-smoke
+          echo "==> Smoke test passed"
+
+      - name: Push Docker image
+        run: |
+          SHORT="${GITHUB_SHA:0:7}"
+          IMAGE="ghcr.io/${{ github.repository }}"
           docker push "${IMAGE}:${SHORT}"
           docker push "${IMAGE}:latest"
 
       - name: Package
         id: package
         run: |
-          ARTIFACT="${{ github.event.repository.name }}-${{ matrix.name }}.tar.gz"
-          tar czf "$ARTIFACT" -C "$GITHUB_WORKSPACE/install" .
+          ARTIFACT="o-rly-bookworm-amd64.tar.gz"
+          docker cp "$(docker create --name extract ghcr.io/${{ github.repository }}:latest):/usr/local/bin/o-rly" .
+          docker rm extract
+          mkdir -p install/bin && mv o-rly install/bin/
+          tar czf "$ARTIFACT" -C install .
           echo "artifact=$ARTIFACT" >> "$GITHUB_OUTPUT"
 
       - name: Upload artifact
@@ -190,6 +199,7 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v4
         with:
+          pattern: "*.tar.gz"
           path: artifacts/
 
       - name: Publish snapshot
@@ -222,7 +232,7 @@ jobs:
   # ════════════════════════════════════════════════════════════════════════════
 
   notify:
-    needs: [format, build, publish, release]
+    needs: [check-format, build, publish, release]
     if: always()
     runs-on: ubuntu-22.04
     steps:
@@ -244,12 +254,21 @@ jobs:
             esac
           }
 
-          FMT=$(fmt_status "${{ needs.format.result }}")
-          VER=$(fmt_status "${{ needs.build.result }}")
+          # verify = worst of check-format + build
+          if [ "${{ needs.check-format.result }}" = "failure" ] || [ "${{ needs.build.result }}" = "failure" ]; then
+            VER_RESULT="failure"
+          elif [ "${{ needs.check-format.result }}" = "cancelled" ] || [ "${{ needs.build.result }}" = "cancelled" ]; then
+            VER_RESULT="cancelled"
+          elif [ "${{ needs.check-format.result }}" = "success" ] && [ "${{ needs.build.result }}" = "success" ]; then
+            VER_RESULT="success"
+          else
+            VER_RESULT="skipped"
+          fi
+          VER=$(fmt_status "$VER_RESULT")
           PUB=$(fmt_status "${{ needs.publish.result }}")
           REL=$(fmt_status "${{ needs.release.result }}")
 
-          STATUS="format:${FMT} verify:${VER} publish:${PUB} release:${REL}"
+          STATUS="verify:${VER} publish:${PUB} release:${REL}"
 
           if [ "${{ needs.release.result }}" = "success" ]; then
             REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"
@@ -272,12 +291,22 @@ jobs:
           SHORT="${GITHUB_SHA:0:7}"
           RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
 
-          FMT="${{ needs.format.result }}"
-          VER="${{ needs.build.result }}"
+          # verify = worst of check-format + build
+          CF="${{ needs.check-format.result }}"
+          BLD="${{ needs.build.result }}"
+          if [ "$CF" = "failure" ] || [ "$BLD" = "failure" ]; then
+            VER="failure"
+          elif [ "$CF" = "cancelled" ] || [ "$BLD" = "cancelled" ]; then
+            VER="cancelled"
+          elif [ "$CF" = "success" ] && [ "$BLD" = "success" ]; then
+            VER="success"
+          else
+            VER="skipped"
+          fi
           PUB="${{ needs.publish.result }}"
           REL="${{ needs.release.result }}"
 
-          STATUS="format:${FMT} verify:${VER} publish:${PUB} release:${REL}"
+          STATUS="verify:${VER} publish:${PUB} release:${REL}"
 
           if [ "${{ needs.release.result }}" = "success" ]; then
             REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"

.github/workflows/ci-pr.yml

@@ -16,7 +16,7 @@ permissions:
   checks: write
 
 jobs:
-  format:
+  check-format:
     runs-on: ubuntu-latest
     container: debian:trixie
     steps:

.github/workflows/update-moxygen-submodule.yml

@@ -0,0 +1,37 @@
+name: update moxygen submodule
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Update moxygen submodule
+        run: |
+          cd deps/moxygen
+          git fetch origin main
+          git checkout origin/main
+          cd ../..
+          echo "MOXYGEN_SHA=$(cd deps/moxygen && git rev-parse --short HEAD)" >> "$GITHUB_ENV"
+
+      - name: Create PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="update-moxygen-${MOXYGEN_SHA}"
+          git checkout -b "$BRANCH"
+          git add deps/moxygen
+          git commit -m "Update moxygen submodule to ${MOXYGEN_SHA}"
+          git push -u origin "$BRANCH"
+          gh pr create \
+            --title "Update moxygen submodule to ${MOXYGEN_SHA}" \
+            --body "Updates \`deps/moxygen\` to latest main (\`${MOXYGEN_SHA}\`)."

CMakePresets.json

@@ -26,7 +26,6 @@
       "cacheVariables": {
         "CMAKE_BUILD_TYPE": "Debug",
         "ORLY_ENABLE_SANITIZERS": "ON",
-        "CMAKE_FIND_LIBRARY_SUFFIXES": ".a",
         "CMAKE_MODULE_PATH": "${sourceDir}/cmake",
         "CMAKE_POLICY_VERSION_MINIMUM": "3.5"
       }