fix(deps): update rust crate libc to v0.2.189 #1475
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: stagex-build CI # build check for PR and main; push PR images to GHCR/ECR | |
| # Cancel superseded runs for a given PR or branch | |
| concurrency: | |
| cancel-in-progress: true | |
| group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}" | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| jobs: | |
| build: | |
| name: build ${{ matrix.name }} | |
| runs-on: ubicloud-standard-16 | |
| strategy: | |
| # One job per image so builds/pushes run in parallel. Don't cancel the | |
| # other images if one fails. | |
| fail-fast: false | |
| matrix: | |
| name: | |
| - qos_client | |
| - qos_host | |
| - qos_host_qemu | |
| - qos_enclave | |
| - qos_enclave_egress | |
| - qos_bridge | |
| - qos_bridge_qemu | |
| - qos_bridge_egress | |
| - signed_echo | |
| include: | |
| - name: qos_client | |
| ghcr: ghcr.io/tkhq/qos_client | |
| ecr: true | |
| - name: qos_host | |
| ghcr: ghcr.io/tkhq/qos_host | |
| ecr: true | |
| - name: qos_host_qemu | |
| ghcr: ghcr.io/tkhq/qos_host_qemu | |
| ecr: false | |
| - name: qos_enclave | |
| ghcr: ghcr.io/tkhq/qos_enclave | |
| ecr: true | |
| - name: qos_enclave_egress | |
| ghcr: ghcr.io/tkhq/qos_enclave_egress | |
| ecr: true | |
| - name: qos_bridge | |
| ghcr: ghcr.io/tkhq/qos_bridge | |
| ecr: true | |
| - name: qos_bridge_qemu | |
| ghcr: ghcr.io/tkhq/qos_bridge_qemu | |
| ecr: false | |
| - name: qos_bridge_egress | |
| ghcr: ghcr.io/tkhq/qos_bridge_egress | |
| ecr: true | |
| # signed_echo is an example image with no ECR repository; GHCR only. | |
| - name: signed_echo | |
| ghcr: ghcr.io/tkhq/qos/examples/signed_echo | |
| ecr: false | |
| permissions: | |
| contents: read | |
| packages: write # needed for pushing PR images to GHCR | |
| id-token: write # needed for OIDC auth to assume the AWS role for ECR | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| # Only authenticate to GHCR/ECR for PRs, since main is build-only. | |
| - name: Setup Docker | |
| uses: ./.github/actions/docker-setup | |
| with: | |
| ghcr: ${{ github.event_name == 'pull_request' && secrets.GITHUB_TOKEN || '' }} | |
| awsRegion: us-east-1 | |
| awsRole: ${{ github.event_name == 'pull_request' && 'arn:aws:iam::799078726966:role/github-qos' || '' }} | |
| # Build only this matrix image (the `common` base is built as a dependency). | |
| - name: Run `make` | |
| shell: 'script -q -e -c "bash {0}"' | |
| run: make -j$(nproc) "out/${{ matrix.name }}/index.json" | |
| # Publish PR images so they can be deployed for testing; main is build-only. | |
| - name: Push PR image to GHCR and ECR | |
| if: github.event_name == 'pull_request' | |
| env: | |
| name: ${{ matrix.name }} | |
| ghcr_image: ${{ matrix.ghcr }} | |
| push_ecr: ${{ matrix.ecr }} | |
| run: | | |
| set -euo pipefail | |
| tag="pr-${{ github.event.number }}" | |
| ecr_registry="799078726966.dkr.ecr.us-east-1.amazonaws.com" | |
| # Load the freshly built OCI image into the local docker daemon. | |
| env -C "out/${name}" tar -cf - . | docker load | |
| pushed=() | |
| push_image() { | |
| # Push image:tag, stream the output, and record the immutable | |
| # registry URL (ref@sha256:digest). | |
| local ref="$1" | |
| docker push "${ref}" | tee /tmp/push.out | |
| local digest | |
| digest="$(sed -n 's/.*digest: \(sha256:[0-9a-f]\{64\}\).*/\1/p' /tmp/push.out | tail -1)" | |
| pushed+=("${ref}@${digest}") | |
| } | |
| # Push to GHCR | |
| docker tag "qos-local/${name}:latest" "${ghcr_image}:${tag}" | |
| push_image "${ghcr_image}:${tag}" | |
| # Push to ECR | |
| if [ "${push_ecr}" = "true" ]; then | |
| ecr_image="${ecr_registry}/tkhq/${name}" | |
| docker tag "qos-local/${name}:latest" "${ecr_image}:${tag}" | |
| push_image "${ecr_image}:${tag}" | |
| fi | |
| # Print the full image URL (with digest) for every repository pushed to. | |
| { | |
| echo "### Pushed \`${name}\` images" | |
| echo "" | |
| for ref in "${pushed[@]}"; do | |
| echo "- \`${ref}\`" | |
| done | |
| } | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}" | |
| # Single aggregate check that branch protection can require (the matrix above | |
| # produces one check per image). Passes only if every image job succeeded. | |
| build-artifacts: | |
| name: build artifacts | |
| needs: build | |
| if: always() | |
| runs-on: ubicloud-standard-2 | |
| steps: | |
| - name: Verify all image builds succeeded | |
| run: | | |
| result="${{ needs.build.result }}" | |
| if [ "${result}" != "success" ]; then | |
| echo "One or more image build jobs did not succeed (result: ${result})" >&2 | |
| exit 1 | |
| fi | |
| qemu-e2e: | |
| name: QEMU e2e with PR images | |
| if: github.event_name == 'pull_request' | |
| needs: build-artifacts | |
| uses: ./.github/workflows/qemu-e2e.yml | |
| with: | |
| enclave_image: ghcr.io/tkhq/qos_enclave_egress:pr-${{ github.event.number }} | |
| host_image: ghcr.io/tkhq/qos_host_qemu:pr-${{ github.event.number }} | |
| bridge_image: ghcr.io/tkhq/qos_bridge_qemu:pr-${{ github.event.number }} | |
| client_image: ghcr.io/tkhq/qos_client:pr-${{ github.event.number }} | |
| pivot_image: ghcr.io/tkhq/qos/examples/signed_echo:pr-${{ github.event.number }} | |
| secrets: inherit |