Cherrypicking from master #1096
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build_and_test | |
| on: [push, pull_request, workflow_dispatch] | |
| env: | |
| CCACHE_DIR: ${{ github.workspace }}/.ccache" | |
| jobs: | |
| build_and_test: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: true | |
| - name: generate deps cache key | |
| id: deps-cache-key | |
| run: | | |
| # Generate a hash based on all submodule SHAs | |
| DEPS_HASH=$(git submodule status | sha256sum | cut -d' ' -f1) | |
| echo "hash=$DEPS_HASH" >> $GITHUB_OUTPUT | |
| - name: cache deps build artifacts | |
| id: deps-cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps/llvm-build | |
| deps/boringssl/build | |
| deps/libsodium/build | |
| deps/ekam/bin | |
| tmp/.deps | |
| key: deps-${{ runner.os }}-${{ steps.deps-cache-key.outputs.hash }} | |
| - name: setup python 3.10 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.10' | |
| - name: install dependencies | |
| run: | | |
| export DEBIAN_FRONTEND=noninteractive | |
| echo "The build of boringssl requires golang." | |
| echo "The github runner seems to have some version of golang already; installing golang-go breaks." | |
| which go || (sudo apt-get update && sudo apt-get install golang-go) | |
| sudo apt-get update && sudo apt-get install -y --no-install-recommends \ | |
| build-essential libcap-dev xz-utils zip unzip strace curl discount git python3 zlib1g-dev cmake ccache apparmor | |
| # Install OpenSSL 1.1 (required for Meteor/Node compatibility) | |
| # Ubuntu 24.04 only ships OpenSSL 3.x, so we need to install 1.1 from older release | |
| wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb | |
| sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb | |
| rm libssl1.1_1.1.1f-1ubuntu2_amd64.deb | |
| # Ubuntu 24.04 restricts unprivileged user namespaces by default via AppArmor. | |
| # Sandstorm requires user namespaces for sandboxing, so grant that permission | |
| # to the binaries used by this CI run. | |
| cat > /tmp/sandstorm-ci-apparmor <<EOF | |
| profile sandstorm-ci-bin $GITHUB_WORKSPACE/bin/sandstorm flags=(unconfined) { | |
| userns, | |
| } | |
| profile spk-ci-bin $GITHUB_WORKSPACE/bin/spk flags=(unconfined) { | |
| userns, | |
| } | |
| profile sandstorm-ci-bundle $GITHUB_WORKSPACE/bundle/sandstorm flags=(unconfined) { | |
| userns, | |
| } | |
| profile sandstorm-ci-test $GITHUB_WORKSPACE/tests/tmp-sandstorm/sandstorm flags=(unconfined) { | |
| userns, | |
| } | |
| profile sandstorm-ci-test-latest $GITHUB_WORKSPACE/tests/tmp-sandstorm/latest/sandstorm flags=(unconfined) { | |
| userns, | |
| } | |
| profile sandstorm-ci-test-build $GITHUB_WORKSPACE/tests/tmp-sandstorm/sandstorm-*/sandstorm flags=(unconfined) { | |
| userns, | |
| } | |
| profile sandstorm-ci-test-custom-build $GITHUB_WORKSPACE/tests/tmp-sandstorm/sandstorm-custom.*/sandstorm flags=(unconfined) { | |
| userns, | |
| } | |
| EOF | |
| sudo mv /tmp/sandstorm-ci-apparmor /etc/apparmor.d/sandstorm-ci | |
| sudo apparmor_parser -r /etc/apparmor.d/sandstorm-ci | |
| - name: install meteor | |
| run: | | |
| curl https://install.meteor.com/ | sh | |
| - name: cache ccache files | |
| uses: actions/cache@v4 | |
| with: | |
| path: ${{ env.CCACHE_DIR }} | |
| key: ccache-${{ github.run_number }} | |
| restore-keys: ccache- | |
| - name: print and zero ccache stats | |
| run: | | |
| mkdir -p "$CCACHE_DIR" | |
| ccache -s | |
| ccache -z | |
| - name: make fast | |
| run: | | |
| set -x | |
| export CCACHE_COMPRESS="true" | |
| export CCACHE_COMPRESSLEVEL="6" | |
| export CCACHE_MAXSIZE="1G" | |
| # export CCACHE_DEBUG=1 | |
| export CCACHE_SLOPPINESS="time_macros" | |
| export PATH=/usr/lib/ccache:$CLANGDIR:$PATH | |
| # Use Python 3.10 for node-gyp (3.11+ removed 'rU' mode) | |
| export npm_config_python=$(which python) | |
| make \ | |
| CC="$(which clang)" \ | |
| CXX="$(which clang++)" \ | |
| fast | |
| - name: print ccache stats | |
| run: | | |
| ccache -s | |
| # # for debugging ccache misses | |
| # find . -iname *ccache* | tar -czf ccache-debug.tar.gz -T /dev/stdin | |
| #- name: upload ccache debug tarball | |
| # uses: actions/upload-artifact@v1 | |
| # with: | |
| # name: ccache-debug.tar.gz | |
| # path: ccache-debug.tar.gz | |
| - name: upload sandstorm tarball | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sandstorm-0-fast.tar.xz | |
| path: sandstorm-0-fast.tar.xz | |
| - name: typecheck-ts | |
| run: make typecheck-ts | |
| - name: lint | |
| run: | | |
| # In addition to making sure the linting step doesn't flag any errors, | |
| # we also want to make sure the number of warnings doesn't increase. | |
| # We check for equality; if the number decreases, great! But then update | |
| # the constant below. | |
| make lint | tee lint.log | |
| num_problems=$(cat lint.log | grep ' problems (0 errors, ' | awk '{print $2}') | |
| [ "$num_problems" = 774 ] | |
| - name: setup java 11 | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '11' | |
| - name: setup chrome | |
| uses: browser-actions/setup-chrome@v1 | |
| with: | |
| chrome-version: 144 | |
| - name: remove system chrome | |
| run: | | |
| sudo rm -f /usr/bin/google-chrome /usr/bin/google-chrome-stable | |
| sudo rm -rf /opt/google/chrome | |
| - name: test | |
| run: | | |
| set -o pipefail | |
| (make test |& tee testlog.txt; echo "Result: $?") | |
| - name: upload test log | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: testlog.txt | |
| path: testlog.txt | |
| - name: upload screenshots | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: screenshots | |
| path: tests/screenshots |