mirror of
https://github.com/tailscale/tailscale.git
synced 2026-05-06 20:56:24 +02:00
44114b7f77
Change-Id: Ibecf993f4b08fd4a2727ae5d5de75470c68db886 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
484 lines
25 KiB
YAML
484 lines
25 KiB
YAML
# This is our main "CI tests" workflow. It runs everything that should run on
|
|
# both PRs and merged commits, and for the latter reports failures to slack.
|
|
name: CI
|
|
|
|
env:
|
|
# Our fuzz job, powered by OSS-Fuzz, fails periodically because we upgrade to
|
|
# new Go versions very eagerly. OSS-Fuzz is a little more conservative, and
|
|
# ends up being unable to compile our code.
|
|
#
|
|
# When this happens, we want to disable the fuzz target until OSS-Fuzz catches
|
|
# up. However, we also don't want to forget to turn it back on when OSS-Fuzz
|
|
# can once again build our code.
|
|
#
|
|
# This variable toggles the fuzz job between two modes:
|
|
# - false: we expect fuzzing to be happy, and should report failure if it's not.
|
|
# - true: we expect fuzzing is broken, and should report failure if it start working.
|
|
TS_FUZZ_CURRENTLY_BROKEN: false
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "main"
|
|
- "release-branch/*"
|
|
pull_request:
|
|
branches:
|
|
- "*"
|
|
merge_group:
|
|
branches:
|
|
- "main"
|
|
|
|
concurrency:
|
|
# For PRs, later CI runs preempt previous ones. e.g. a force push on a PR
|
|
# cancels running CI jobs and starts all new ones.
|
|
#
|
|
# For non-PR pushes, concurrency.group needs to be unique for every distinct
|
|
# CI run we want to have happen. Use run_id, which in practice means all
|
|
# non-PR CI runs will be allowed to run without preempting each other.
|
|
group: ${{ github.workflow }}-$${{ github.pull_request.number || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
test:
|
|
strategy:
|
|
fail-fast: false # don't abort the entire matrix if one element fails
|
|
matrix:
|
|
goarch: ["amd64", "386"]
|
|
# go list -json ./... | jq -c -s '[.[].ImportPath]'
|
|
#pkg: ["tailscale.com","tailscale.com/atomicfile","tailscale.com/chirp","tailscale.com/client/tailscale","tailscale.com/client/tailscale/apitype","tailscale.com/client/tailscale/example/servetls","tailscale.com/client/web","tailscale.com/clientupdate","tailscale.com/clientupdate/distsign","tailscale.com/cmd/addlicense","tailscale.com/cmd/cloner","tailscale.com/cmd/derper","tailscale.com/cmd/derpprobe","tailscale.com/cmd/dist","tailscale.com/cmd/get-authkey","tailscale.com/cmd/gitops-pusher","tailscale.com/cmd/hello","tailscale.com/cmd/k8s-operator","tailscale.com/cmd/mkmanifest","tailscale.com/cmd/mkpkg","tailscale.com/cmd/mkversion","tailscale.com/cmd/nardump","tailscale.com/cmd/netlogfmt","tailscale.com/cmd/pgproxy","tailscale.com/cmd/printdep","tailscale.com/cmd/proxy-to-grafana","tailscale.com/cmd/sniproxy","tailscale.com/cmd/speedtest","tailscale.com/cmd/ssh-auth-none-demo","tailscale.com/cmd/stunc","tailscale.com/cmd/sync-containers","tailscale.com/cmd/tailscale","tailscale.com/cmd/tailscale/cli","tailscale.com/cmd/tailscaled","tailscale.com/cmd/tailscaled/childproc","tailscale.com/cmd/testcontrol","tailscale.com/cmd/testwrapper","tailscale.com/cmd/testwrapper/flakytest","tailscale.com/cmd/tsconnect","tailscale.com/cmd/viewer","tailscale.com/cmd/viewer/tests","tailscale.com/control/controlbase","tailscale.com/control/controlclient","tailscale.com/control/controlhttp","tailscale.com/control/controlknobs","tailscale.com/derp","tailscale.com/derp/derphttp","tailscale.com/disco","tailscale.com/docs/webhooks","tailscale.com/doctor","tailscale.com/doctor/permissions","tailscale.com/doctor/routetable","tailscale.com/envknob","tailscale.com/envknob/logknob","tailscale.com/health","tailscale.com/health/healthmsg","tailscale.com/hostinfo","tailscale.com/ipn","tailscale.com/ipn/ipnauth","tailscale.com/ipn/ipnlocal","tailscale.com/ipn/ipnserver","tailscale.com/ipn/ipnstate","tailscale.com/ipn/localapi","tailscale.com/ipn/policy","tailscale.com/ipn/store","tailscale.com/ipn/store/awsstore","tailscale.com/ipn/store/kubestore","tailscale.com/ipn/store/mem","tailscale.com/jsondb","tailscale.com/kube","tailscale.com/licenses","tailscale.com/log/filelogger","tailscale.com/log/sockstatlog","tailscale.com/logpolicy","tailscale.com/logtail","tailscale.com/logtail/backoff","tailscale.com/logtail/example/logadopt","tailscale.com/logtail/example/logreprocess","tailscale.com/logtail/example/logtail","tailscale.com/logtail/filch","tailscale.com/metrics","tailscale.com/net/art","tailscale.com/net/connstats","tailscale.com/net/dns","tailscale.com/net/dns/publicdns","tailscale.com/net/dns/recursive","tailscale.com/net/dns/resolvconffile","tailscale.com/net/dns/resolver","tailscale.com/net/dnscache","tailscale.com/net/dnsfallback","tailscale.com/net/flowtrack","tailscale.com/net/interfaces","tailscale.com/net/memnet","tailscale.com/net/netaddr","tailscale.com/net/netcheck","tailscale.com/net/neterror","tailscale.com/net/netknob","tailscale.com/net/netmon","tailscale.com/net/netns","tailscale.com/net/netstat","tailscale.com/net/netutil","tailscale.com/net/packet","tailscale.com/net/ping","tailscale.com/net/portmapper","tailscale.com/net/proxymux","tailscale.com/net/routetable","tailscale.com/net/socks5","tailscale.com/net/sockstats","tailscale.com/net/speedtest","tailscale.com/net/stun","tailscale.com/net/stun/stuntest","tailscale.com/net/tcpinfo","tailscale.com/net/tlsdial","tailscale.com/net/tsaddr","tailscale.com/net/tsdial","tailscale.com/net/tshttpproxy","tailscale.com/net/tstun","tailscale.com/net/tstun/table","tailscale.com/net/wsconn","tailscale.com/packages/deb","tailscale.com/paths","tailscale.com/portlist","tailscale.com/prober","tailscale.com/release","tailscale.com/release/dist","tailscale.com/release/dist/cli","tailscale.com/release/dist/synology","tailscale.com/release/dist/unixpkgs","tailscale.com/safesocket","tailscale.com/smallzstd","tailscale.com/ssh/tailssh","tailscale.com/syncs","tailscale.com/tailcfg","tailscale.com/tempfork/device","tailscale.com/tempfork/gliderlabs/ssh","tailscale.com/tempfork/heap","tailscale.com/tempfork/pprof","tailscale.com/tka","tailscale.com/tool/gocross","tailscale.com/tsconst","tailscale.com/tsd","tailscale.com/tsnet","tailscale.com/tsnet/example/tshello","tailscale.com/tsnet/example/tsnet-funnel","tailscale.com/tsnet/example/tsnet-http-client","tailscale.com/tsnet/example/web-client","tailscale.com/tstest","tailscale.com/tstest/archtest","tailscale.com/tstest/deptest","tailscale.com/tstest/integration","tailscale.com/tstest/integration/testcontrol","tailscale.com/tstest/integration/vms","tailscale.com/tstest/integration/vms/gen","tailscale.com/tstest/iosdeps","tailscale.com/tstest/jsdeps","tailscale.com/tstest/natlab","tailscale.com/tstime","tailscale.com/tstime/mono","tailscale.com/tstime/rate","tailscale.com/tsweb","tailscale.com/tsweb/promvarz","tailscale.com/tsweb/varz","tailscale.com/types/dnstype","tailscale.com/types/empty","tailscale.com/types/flagtype","tailscale.com/types/ipproto","tailscale.com/types/key","tailscale.com/types/lazy","tailscale.com/types/logger","tailscale.com/types/logid","tailscale.com/types/netlogtype","tailscale.com/types/netmap","tailscale.com/types/nettype","tailscale.com/types/opt","tailscale.com/types/persist","tailscale.com/types/preftype","tailscale.com/types/ptr","tailscale.com/types/structs","tailscale.com/types/tkatype","tailscale.com/types/views","tailscale.com/util/cibuild","tailscale.com/util/clientmetric","tailscale.com/util/cloudenv","tailscale.com/util/cmpver","tailscale.com/util/cmpx","tailscale.com/util/codegen","tailscale.com/util/cstruct","tailscale.com/util/deephash","tailscale.com/util/deephash/testtype","tailscale.com/util/dirwalk","tailscale.com/util/dnsname","tailscale.com/util/goroutines","tailscale.com/util/groupmember","tailscale.com/util/hashx","tailscale.com/util/httpm","tailscale.com/util/jsonutil","tailscale.com/util/lineread","tailscale.com/util/linuxfw","tailscale.com/util/linuxfw/linuxfwtest","tailscale.com/util/lru","tailscale.com/util/mak","tailscale.com/util/multierr","tailscale.com/util/must","tailscale.com/util/osdiag","tailscale.com/util/osshare","tailscale.com/util/pidowner","tailscale.com/util/precompress","tailscale.com/util/quarantine","tailscale.com/util/racebuild","tailscale.com/util/ringbuffer","tailscale.com/util/set","tailscale.com/util/singleflight","tailscale.com/util/slicesx","tailscale.com/util/sysresources","tailscale.com/util/systemd","tailscale.com/util/testenv","tailscale.com/util/truncate","tailscale.com/util/uniq","tailscale.com/util/vizerror","tailscale.com/util/winutil","tailscale.com/util/winutil/authenticode","tailscale.com/version","tailscale.com/version/distro","tailscale.com/version/mkversion","tailscale.com/wgengine","tailscale.com/wgengine/bench","tailscale.com/wgengine/capture","tailscale.com/wgengine/filter","tailscale.com/wgengine/magicsock","tailscale.com/wgengine/netlog","tailscale.com/wgengine/netstack","tailscale.com/wgengine/router","tailscale.com/wgengine/wgcfg","tailscale.com/wgengine/wgcfg/nmcfg","tailscale.com/wgengine/wgint","tailscale.com/wgengine/wglog","tailscale.com/words"]
|
|
pkg: ["tailscale.com","tailscale.com/atomicfile","tailscale.com/chirp","tailscale.com/client/tailscale"]
|
|
buildflags: ["-race=false"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: Restore Cache
|
|
uses: actions/cache@v3
|
|
with:
|
|
# Note: unlike the other setups, this is only grabbing the mod download
|
|
# cache, rather than the whole mod directory, as the download cache
|
|
# contains zips that can be unpacked in parallel faster than they can be
|
|
# fetched and extracted by tar
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod/cache
|
|
~\AppData\Local\go-build
|
|
# The -2- here should be incremented when the scheme of data to be
|
|
# cached changes (e.g. path above changes).
|
|
key: ${{ github.job }}-${{ runner.os }}-${{ matrix.pkg }}-${{ matrix.goarch }}-${{ matrix.buildflags }}-go-2-${{ hashFiles('**/go.sum') }}-${{ github.run_id }}
|
|
restore-keys: |
|
|
${{ github.job }}-${{ runner.os }}-${{ matrix.pkg }}-${{ matrix.goarch }}-${{ matrix.buildflags }}-go-2-${{ hashFiles('**/go.sum') }}
|
|
${{ github.job }}-${{ runner.os }}-${{ matrix.pkg }}-${{ matrix.goarch }}-${{ matrix.buildflags }}-go-2-
|
|
- name: build test wrapper
|
|
run: ./tool/go build -o /tmp/testwrapper ./cmd/testwrapper
|
|
- name: test all
|
|
run: PATH=$PWD/tool:$PATH /tmp/testwrapper ${{matrix.pkg}} ${{matrix.buildflags}}
|
|
env:
|
|
GOARCH: ${{ matrix.goarch }}
|
|
- name: check that no tracked files changed
|
|
run: git diff --no-ext-diff --name-only --exit-code || (echo "Build/test modified the files above."; exit 1)
|
|
- name: check that no new files were added
|
|
run: |
|
|
# Note: The "error: pathspec..." you see below is normal!
|
|
# In the success case in which there are no new untracked files,
|
|
# git ls-files complains about the pathspec not matching anything.
|
|
# That's OK. It's not worth the effort to suppress. Please ignore it.
|
|
if git ls-files --others --exclude-standard --directory --no-empty-directory --error-unmatch -- ':/*'
|
|
then
|
|
echo "Build/test created untracked files in the repo (file names above)."
|
|
exit 1
|
|
fi
|
|
|
|
windows:
|
|
runs-on: windows-2022
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@v4
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false
|
|
|
|
- name: Restore Cache
|
|
uses: actions/cache@v3
|
|
with:
|
|
# Note: unlike the other setups, this is only grabbing the mod download
|
|
# cache, rather than the whole mod directory, as the download cache
|
|
# contains zips that can be unpacked in parallel faster than they can be
|
|
# fetched and extracted by tar
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod/cache
|
|
~\AppData\Local\go-build
|
|
# The -2- here should be incremented when the scheme of data to be
|
|
# cached changes (e.g. path above changes).
|
|
key: ${{ github.job }}-${{ runner.os }}-go-2-${{ hashFiles('**/go.sum') }}-${{ github.run_id }}
|
|
restore-keys: |
|
|
${{ github.job }}-${{ runner.os }}-go-2-${{ hashFiles('**/go.sum') }}
|
|
${{ github.job }}-${{ runner.os }}-go-2-
|
|
- name: test
|
|
run: go run ./cmd/testwrapper ./...
|
|
- name: bench all
|
|
# Don't use -bench=. -benchtime=1x.
|
|
# Somewhere in the layers (powershell?)
|
|
# the equals signs cause great confusion.
|
|
run: go test ./... -bench . -benchtime 1x -run "^$"
|
|
|
|
vm:
|
|
runs-on: ["self-hosted", "linux", "vm"]
|
|
# VM tests run with some privileges, don't let them run on 3p PRs.
|
|
if: github.repository == 'tailscale/tailscale'
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: Run VM tests
|
|
run: ./tool/go test ./tstest/integration/vms -v -no-s3 -run-vm-tests -run=TestRunUbuntu2004
|
|
env:
|
|
HOME: "/tmp"
|
|
TMPDIR: "/tmp"
|
|
XDB_CACHE_HOME: "/var/lib/ghrunner/cache"
|
|
|
|
cross: # cross-compile checks, build only.
|
|
strategy:
|
|
fail-fast: false # don't abort the entire matrix if one element fails
|
|
matrix:
|
|
include:
|
|
# Note: linux/amd64 is not in this matrix, because that goos/goarch is
|
|
# tested more exhaustively in the 'test' job above.
|
|
- goos: linux
|
|
goarch: arm64
|
|
- goos: linux
|
|
goarch: "386" # thanks yaml
|
|
- goos: linux
|
|
goarch: loong64
|
|
- goos: linux
|
|
goarch: arm
|
|
goarm: "5"
|
|
- goos: linux
|
|
goarch: arm
|
|
goarm: "7"
|
|
# macOS
|
|
- goos: darwin
|
|
goarch: amd64
|
|
- goos: darwin
|
|
goarch: arm64
|
|
# Windows
|
|
- goos: windows
|
|
goarch: amd64
|
|
- goos: windows
|
|
goarch: arm64
|
|
# BSDs
|
|
- goos: freebsd
|
|
goarch: amd64
|
|
- goos: openbsd
|
|
goarch: amd64
|
|
# Plan9
|
|
- goos: plan9
|
|
goarch: amd64
|
|
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: Restore Cache
|
|
uses: actions/cache@v3
|
|
with:
|
|
# Note: unlike the other setups, this is only grabbing the mod download
|
|
# cache, rather than the whole mod directory, as the download cache
|
|
# contains zips that can be unpacked in parallel faster than they can be
|
|
# fetched and extracted by tar
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod/cache
|
|
~\AppData\Local\go-build
|
|
# The -2- here should be incremented when the scheme of data to be
|
|
# cached changes (e.g. path above changes).
|
|
key: ${{ github.job }}-${{ runner.os }}-${{ matrix.goos }}-${{ matrix.goarch }}-go-2-${{ hashFiles('**/go.sum') }}-${{ github.run_id }}
|
|
restore-keys: |
|
|
${{ github.job }}-${{ runner.os }}-${{ matrix.goos }}-${{ matrix.goarch }}-go-2-${{ hashFiles('**/go.sum') }}
|
|
${{ github.job }}-${{ runner.os }}-${{ matrix.goos }}-${{ matrix.goarch }}-go-2-
|
|
- name: build all
|
|
run: ./tool/go build ./cmd/...
|
|
env:
|
|
GOOS: ${{ matrix.goos }}
|
|
GOARCH: ${{ matrix.goarch }}
|
|
GOARM: ${{ matrix.goarm }}
|
|
CGO_ENABLED: "0"
|
|
- name: build tests
|
|
run: ./tool/go test -exec=true ./...
|
|
env:
|
|
GOOS: ${{ matrix.goos }}
|
|
GOARCH: ${{ matrix.goarch }}
|
|
CGO_ENABLED: "0"
|
|
|
|
ios: # similar to cross above, but iOS can't build most of the repo. So, just
|
|
#make it build a few smoke packages.
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: build some
|
|
run: ./tool/go build ./ipn/... ./wgengine/ ./types/... ./control/controlclient
|
|
env:
|
|
GOOS: ios
|
|
GOARCH: arm64
|
|
|
|
android:
|
|
# similar to cross above, but android fails to build a few pieces of the
|
|
# repo. We should fix those pieces, they're small, but as a stepping stone,
|
|
# only test the subset of android that our past smoke test checked.
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
# Super minimal Android build that doesn't even use CGO and doesn't build everything that's needed
|
|
# and is only arm64. But it's a smoke build: it's not meant to catch everything. But it'll catch
|
|
# some Android breakages early.
|
|
# TODO(bradfitz): better; see https://github.com/tailscale/tailscale/issues/4482
|
|
- name: build some
|
|
run: ./tool/go install ./net/netns ./ipn/ipnlocal ./wgengine/magicsock/ ./wgengine/ ./wgengine/router/ ./wgengine/netstack ./util/dnsname/ ./ipn/ ./net/interfaces ./wgengine/router/ ./tailcfg/ ./types/logger/ ./net/dns ./hostinfo ./version
|
|
env:
|
|
GOOS: android
|
|
GOARCH: arm64
|
|
|
|
wasm: # builds tsconnect, which is the only wasm build we support
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: Restore Cache
|
|
uses: actions/cache@v3
|
|
with:
|
|
# Note: unlike the other setups, this is only grabbing the mod download
|
|
# cache, rather than the whole mod directory, as the download cache
|
|
# contains zips that can be unpacked in parallel faster than they can be
|
|
# fetched and extracted by tar
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod/cache
|
|
~\AppData\Local\go-build
|
|
# The -2- here should be incremented when the scheme of data to be
|
|
# cached changes (e.g. path above changes).
|
|
key: ${{ github.job }}-${{ runner.os }}-go-2-${{ hashFiles('**/go.sum') }}-${{ github.run_id }}
|
|
restore-keys: |
|
|
${{ github.job }}-${{ runner.os }}-go-2-${{ hashFiles('**/go.sum') }}
|
|
${{ github.job }}-${{ runner.os }}-go-2-
|
|
- name: build tsconnect client
|
|
run: ./tool/go build ./cmd/tsconnect/wasm ./cmd/tailscale/cli
|
|
env:
|
|
GOOS: js
|
|
GOARCH: wasm
|
|
- name: build tsconnect server
|
|
# Note, no GOOS/GOARCH in env on this build step, we're running a build
|
|
# tool that handles the build itself.
|
|
run: |
|
|
./tool/go run ./cmd/tsconnect --fast-compression build
|
|
./tool/go run ./cmd/tsconnect --fast-compression build-pkg
|
|
|
|
tailscale_go: # Subset of tests that depend on our custom Go toolchain.
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: test tailscale_go
|
|
run: ./tool/go test -tags=tailscale_go,ts_enable_sockstats ./net/sockstats/...
|
|
|
|
|
|
fuzz:
|
|
# This target periodically breaks (see TS_FUZZ_CURRENTLY_BROKEN at the top
|
|
# of the file), so it's more complex than usual: the 'build fuzzers' step
|
|
# might fail, and depending on the value of 'TS_FUZZ_CURRENTLY_BROKEN', that
|
|
# might or might not be fine. The steps after the build figure out whether
|
|
# the success/failure is expected, and appropriately pass/fail the job
|
|
# overall accordingly.
|
|
#
|
|
# Practically, this means that all steps after 'build fuzzers' must have an
|
|
# explicit 'if' condition, because the default condition for steps is
|
|
# 'success()', meaning "only run this if no previous steps failed".
|
|
if: github.event_name == 'pull_request'
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: build fuzzers
|
|
id: build
|
|
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
|
|
# continue-on-error makes steps.build.conclusion be 'success' even if
|
|
# steps.build.outcome is 'failure'. This means this step does not
|
|
# contribute to the job's overall pass/fail evaluation.
|
|
continue-on-error: true
|
|
with:
|
|
oss-fuzz-project-name: 'tailscale'
|
|
dry-run: false
|
|
language: go
|
|
- name: report unexpectedly broken fuzz build
|
|
if: steps.build.outcome == 'failure' && env.TS_FUZZ_CURRENTLY_BROKEN != 'true'
|
|
run: |
|
|
echo "fuzzer build failed, see above for why"
|
|
echo "if the failure is due to OSS-Fuzz not being on the latest Go yet,"
|
|
echo "set TS_FUZZ_CURRENTLY_BROKEN=true in .github/workflows/test.yml"
|
|
echo "to temporarily disable fuzzing until OSS-Fuzz works again."
|
|
exit 1
|
|
- name: report unexpectedly working fuzz build
|
|
if: steps.build.outcome == 'success' && env.TS_FUZZ_CURRENTLY_BROKEN == 'true'
|
|
run: |
|
|
echo "fuzzer build succeeded, but we expect it to be broken"
|
|
echo "please set TS_FUZZ_CURRENTLY_BROKEN=false in .github/workflows/test.yml"
|
|
echo "to reenable fuzz testing"
|
|
exit 1
|
|
- name: run fuzzers
|
|
id: run
|
|
# Run the fuzzers whenever they're able to build, even if we're going to
|
|
# report a failure because TS_FUZZ_CURRENTLY_BROKEN is set to the wrong
|
|
# value.
|
|
if: steps.build.outcome == 'success'
|
|
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
|
|
with:
|
|
oss-fuzz-project-name: 'tailscale'
|
|
fuzz-seconds: 300
|
|
dry-run: false
|
|
language: go
|
|
- name: upload crash
|
|
uses: actions/upload-artifact@v3
|
|
if: steps.run.outcome != 'success' && steps.build.outcome == 'success'
|
|
with:
|
|
name: artifacts
|
|
path: ./out/artifacts
|
|
|
|
depaware:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: check depaware
|
|
run: |
|
|
export PATH=$(./tool/go env GOROOT)/bin:$PATH
|
|
find . -name 'depaware.txt' | xargs -n1 dirname | xargs ./tool/go run github.com/tailscale/depaware --check
|
|
|
|
go_generate:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: check that 'go generate' is clean
|
|
run: |
|
|
pkgs=$(./tool/go list ./... | grep -v dnsfallback)
|
|
./tool/go generate $pkgs
|
|
echo
|
|
echo
|
|
git diff --name-only --exit-code || (echo "The files above need updating. Please run 'go generate'."; exit 1)
|
|
|
|
go_mod_tidy:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: check that 'go mod tidy' is clean
|
|
run: |
|
|
./tool/go mod tidy
|
|
echo
|
|
echo
|
|
git diff --name-only --exit-code || (echo "Please run 'go mod tidy'."; exit 1)
|
|
|
|
licenses:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: check licenses
|
|
run: ./scripts/check_license_headers.sh .
|
|
|
|
staticcheck:
|
|
runs-on: ubuntu-22.04
|
|
strategy:
|
|
fail-fast: false # don't abort the entire matrix if one element fails
|
|
matrix:
|
|
goos: ["linux", "windows", "darwin"]
|
|
goarch: ["amd64"]
|
|
include:
|
|
- goos: "windows"
|
|
goarch: "386"
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v3
|
|
- name: install staticcheck
|
|
run: GOBIN=~/.local/bin ./tool/go install honnef.co/go/tools/cmd/staticcheck
|
|
- name: run staticcheck
|
|
run: |
|
|
export GOROOT=$(./tool/go env GOROOT)
|
|
export PATH=$GOROOT/bin:$PATH
|
|
staticcheck -- $(./tool/go list ./... | grep -v tempfork)
|
|
env:
|
|
GOOS: ${{ matrix.goos }}
|
|
GOARCH: ${{ matrix.goarch }}
|
|
|
|
notify_slack:
|
|
if: always()
|
|
# Any of these jobs failing causes a slack notification.
|
|
needs:
|
|
- android
|
|
- test
|
|
- windows
|
|
- vm
|
|
- cross
|
|
- ios
|
|
- wasm
|
|
- tailscale_go
|
|
- fuzz
|
|
- depaware
|
|
- go_generate
|
|
- go_mod_tidy
|
|
- licenses
|
|
- staticcheck
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: notify
|
|
# Only notify slack for merged commits, not PR failures.
|
|
#
|
|
# It may be tempting to move this condition into the job's 'if' block, but
|
|
# don't: Github only collapses the test list into "everything is OK" if
|
|
# all jobs succeeded. A skipped job results in the list staying expanded.
|
|
# By having the job always run, but skipping its only step as needed, we
|
|
# let the CI output collapse nicely in PRs.
|
|
if: failure() && github.event_name == 'push'
|
|
uses: ruby/action-slack@v3.2.1
|
|
with:
|
|
payload: |
|
|
{
|
|
"attachments": [{
|
|
"title": "Failure: ${{ github.workflow }}",
|
|
"title_link": "https://github.com/${{ github.repository }}/commit/${{ github.sha }}/checks",
|
|
"text": "${{ github.repository }}@${{ github.ref_name }}: <https://github.com/${{ github.repository }}/commit/${{ github.sha }}|${{ github.sha }}>",
|
|
"fields": [{ "value": ${{ toJson(github.event.head_commit.message) }}, "short": false }],
|
|
"footer": "${{ github.event.head_commit.committer.name }} at ${{ github.event.head_commit.timestamp }}",
|
|
"color": "danger"
|
|
}]
|
|
}
|
|
env:
|
|
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
|
|
|
|
check_mergeability:
|
|
if: always()
|
|
runs-on: ubuntu-22.04
|
|
needs:
|
|
- android
|
|
- test
|
|
- windows
|
|
- vm
|
|
- cross
|
|
- ios
|
|
- wasm
|
|
- tailscale_go
|
|
- fuzz
|
|
- depaware
|
|
- go_generate
|
|
- go_mod_tidy
|
|
- licenses
|
|
- staticcheck
|
|
steps:
|
|
- name: Decide if change is okay to merge
|
|
if: github.event_name != 'push'
|
|
uses: re-actors/alls-green@release/v1
|
|
with:
|
|
jobs: ${{ toJSON(needs) }}
|