190 lines
9.8 KiB
YAML
190 lines
9.8 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
cold_cache:
|
|
description: Deliberately clear the required dependency/native cache before validation
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
|
|
concurrency:
|
|
# The runner-persistent Cargo cache is shared across refs. Queue complete CI
|
|
# runs instead of trying to kill one while it owns or mutates that cache.
|
|
group: ci-${{ github.workflow }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
rust-skia:
|
|
name: rust-skia (Rust only)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
env:
|
|
CARGO_BUILD_JOBS: "1"
|
|
CARGO_INCREMENTAL: "0"
|
|
CARGO_PROFILE_DEV_DEBUG: "0"
|
|
CARGO_PROFILE_TEST_DEBUG: "0"
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Deliberately do not install CMake, Clang, pkg-config, Skia, WebP, or
|
|
# any other native codec prerequisite in this job.
|
|
- name: Install pinned Rust
|
|
uses: dtolnay/rust-toolchain@master
|
|
with:
|
|
toolchain: 1.97.1
|
|
targets: wasm32-unknown-unknown
|
|
|
|
- name: Test the pure-Rust Skia-compatible extension
|
|
run: cargo test --locked -j 1 -p libremetaverse-imaging-skia --no-default-features --features rust-skia
|
|
|
|
- name: Audit the normal and build dependency graph
|
|
run: cargo tree --locked -p libremetaverse-imaging-skia --no-default-features --features rust-skia -e normal,build
|
|
|
|
- name: Compile the same Rust codec for WASM
|
|
run: cargo check --locked -j 1 -p libremetaverse-imaging-skia --no-default-features --features rust-skia --target wasm32-unknown-unknown
|
|
|
|
required:
|
|
name: required
|
|
runs-on: ubuntu-latest
|
|
# A source edit rebuilds the monolithic compatibility crate under several
|
|
# feature/profile graphs. Serialized compilation is required by the ARM64
|
|
# runner's memory ceiling, so retain a small margin above the measured
|
|
# 25-minute full gate instead of aborting a healthy graph at 12 minutes.
|
|
timeout-minutes: 30
|
|
env:
|
|
# The all-features graph includes Skia, OpenJPEG, and the pure-Rust J2K
|
|
# codec. Serialize rustc/clippy on the memory-constrained ARM64 runner so
|
|
# the umbrella crate cannot overlap with another peak-memory compile.
|
|
CARGO_BUILD_JOBS: "1"
|
|
CARGO_INCREMENTAL: "0"
|
|
CARGO_PROFILE_DEV_DEBUG: "0"
|
|
CARGO_PROFILE_TEST_DEBUG: "0"
|
|
RUSTDOCFLAGS: "-D warnings"
|
|
CARGO_HOME: ${{ runner.tool_cache }}/metacrate/cargo/home-rust-1.97.1-aarch64-unknown-linux-gnu
|
|
METACRATE_EXPECTED_HOST: aarch64-unknown-linux-gnu
|
|
METACRATE_PROVENANCE_DIAGNOSTICS_DIR: artifacts/ci/provenance-candidates
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Inspect the runner-persistent, architecture-keyed cache
|
|
run: |
|
|
cargo_cache_root="${{ runner.tool_cache }}/metacrate/cargo"
|
|
cache_key="$(git ls-files -z 'Cargo.lock' 'Cargo.toml' '**/Cargo.toml' 'ci/ci-coverage.json' 'ci/dependency-policy.json' 'deny.toml' 'tools/install_openjpeg_2_5_4.sh' 'tools/normalize_git_mtimes.py' | sort -z | xargs -0 sha256sum | sha256sum | cut -d ' ' -f 1)"
|
|
cargo_target="$cargo_cache_root/target-rust-1.97.1-aarch64-unknown-linux-gnu-$cache_key"
|
|
openjpeg_prefix="${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}"
|
|
skia_dir="${{ runner.tool_cache }}/metacrate/native/skia-0.99.0-aarch64-unknown-linux-gnu"
|
|
skia_archive="$skia_dir/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz"
|
|
mkdir -p "$CARGO_HOME" "$cargo_cache_root" "$skia_dir"
|
|
(
|
|
flock --exclusive 9
|
|
|
|
if test "${{ github.event_name }}" = workflow_dispatch && test "${{ inputs.cold_cache }}" = true; then
|
|
rm -rf -- "$CARGO_HOME/registry/cache" "$CARGO_HOME/registry/index" "$CARGO_HOME/git/db" "$openjpeg_prefix" "$skia_dir"
|
|
rm -f -- "$CARGO_HOME/bin/cargo-deny" "$CARGO_HOME/bin/cargo-machete"
|
|
fi
|
|
if ! test -d "$cargo_target"; then
|
|
previous_target="$(find "$cargo_cache_root" -mindepth 1 -maxdepth 1 -type d -name 'target-rust-1.97.1-aarch64-unknown-linux-gnu-*' -printf '%T@ %p\n' | sort -nr | head -n 1 | cut -d ' ' -f 2-)"
|
|
if test -n "$previous_target"; then
|
|
cp -al "$previous_target" "$cargo_target"
|
|
rm -f -- "$cargo_target/.metacrate-ready"
|
|
else
|
|
mkdir -p "$cargo_target"
|
|
fi
|
|
fi
|
|
while IFS= read -r -d '' stale_target; do
|
|
if test "$stale_target" != "$cargo_target"; then
|
|
rm -rf -- "$stale_target"
|
|
fi
|
|
done < <(find "$cargo_cache_root" -mindepth 1 -maxdepth 1 -type d -name 'target-rust-1.97.1-aarch64-unknown-linux-gnu-*' -print0)
|
|
) 9>"$cargo_cache_root/required-target.lock"
|
|
test -f "$cargo_target/.metacrate-ready" && cargo_hit=true || cargo_hit=false
|
|
test -d "$CARGO_HOME/registry/cache" && dependency_hit=true || dependency_hit=false
|
|
test -f "$openjpeg_prefix/metacrate-openjpeg.identity" && test -f "$skia_archive" && native_hit=true || native_hit=false
|
|
test -x "$CARGO_HOME/bin/cargo-deny" && test -x "$CARGO_HOME/bin/cargo-machete" && tools_hit=true || tools_hit=false
|
|
echo "CARGO_TARGET_DIR=$cargo_target" >> "$GITHUB_ENV"
|
|
echo "OPENJPEG_PREFIX=$openjpeg_prefix" >> "$GITHUB_ENV"
|
|
echo "PKG_CONFIG_PATH=$openjpeg_prefix/lib/pkgconfig" >> "$GITHUB_ENV"
|
|
echo "LD_LIBRARY_PATH=$openjpeg_prefix/lib" >> "$GITHUB_ENV"
|
|
echo "METACRATE_SKIA_ARCHIVE=$skia_archive" >> "$GITHUB_ENV"
|
|
echo "METACRATE_CARGO_CACHE_HIT=$cargo_hit" >> "$GITHUB_ENV"
|
|
echo "METACRATE_DEPENDENCY_CACHE_HIT=$dependency_hit" >> "$GITHUB_ENV"
|
|
echo "METACRATE_NATIVE_CACHE_HIT=$native_hit" >> "$GITHUB_ENV"
|
|
echo "METACRATE_TOOLS_CACHE_HIT=$tools_hit" >> "$GITHUB_ENV"
|
|
|
|
- name: Install the single native prerequisite set
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --yes build-essential clang cmake curl git ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
|
|
|
|
- name: Install pinned Rust and audit tools
|
|
uses: dtolnay/rust-toolchain@master
|
|
with:
|
|
toolchain: 1.97.1
|
|
components: clippy,rustfmt
|
|
- uses: taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-deny@0.20.2,cargo-machete@0.9.2
|
|
|
|
- name: Verify pinned audit tool versions
|
|
run: |
|
|
cargo deny --version | grep '0.20.2'
|
|
cargo machete --version | grep '0.9.2'
|
|
|
|
- name: Validate and populate the exact native cache
|
|
run: |
|
|
test "$(uname -m)" = aarch64
|
|
rustc -vV | grep '^host: aarch64-unknown-linux-gnu$'
|
|
tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
|
|
pkg-config --exact-version 2.5.4 libopenjp2
|
|
mkdir -p "$(dirname "$METACRATE_SKIA_ARCHIVE")"
|
|
if ! echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check --status; then
|
|
curl --fail --location --proto '=https' --tlsv1.2 --output "$METACRATE_SKIA_ARCHIVE" \
|
|
https://github.com/rust-skia/skia-binaries/releases/download/0.99.0/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz
|
|
fi
|
|
echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check
|
|
|
|
- name: Run the authoritative code-ready graph with exclusive cache ownership
|
|
run: |
|
|
cargo_cache_root="${{ runner.tool_cache }}/metacrate/cargo"
|
|
cache_lock="$cargo_cache_root/required-target.lock"
|
|
(
|
|
flock --exclusive 9
|
|
rm -f -- "$CARGO_TARGET_DIR/.metacrate-ready"
|
|
python3 tools/normalize_git_mtimes.py --self-test
|
|
python3 tools/normalize_git_mtimes.py --state "$CARGO_TARGET_DIR/.metacrate-mtimes.json"
|
|
python3 tools/normalize_git_mtimes.py --state "$CARGO_TARGET_DIR/.metacrate-mtimes.json" --check
|
|
# Cargo does not fingerprint CARGO_TARGET_DIR in integration-test
|
|
# binaries. After a clone, interruption, or failed gate, invalidate
|
|
# only those fingerprints so CARGO_BIN_EXE_* cannot stay poisoned.
|
|
if test "$METACRATE_CARGO_CACHE_HIT" != true; then
|
|
fingerprint_root="$CARGO_TARGET_DIR/debug/.fingerprint"
|
|
fingerprint_list="$CARGO_TARGET_DIR/.metacrate-relocated-fingerprints"
|
|
if test -d "$fingerprint_root"; then
|
|
find "$fingerprint_root" -mindepth 2 -maxdepth 2 -type f \
|
|
-path '*/libremetaverse-programs-*/*' \
|
|
-name 'test-integration-test-*' -printf '%h\0' > "$fingerprint_list"
|
|
while IFS= read -r -d '' integration_fingerprint; do
|
|
rm -rf -- "$integration_fingerprint"
|
|
done < "$fingerprint_list"
|
|
fi
|
|
rm -f -- "$fingerprint_list"
|
|
fi
|
|
cargo run --locked -p metacrate-ci-matrix -- required-gate --evidence artifacts/ci/required-gate.json
|
|
test ! -e artifacts/ci/grid-agent-acceptance.jsonl
|
|
cargo test --locked -p metacrate-grid-agent --test acceptance_gate --all-features
|
|
METACRATE_SOURCE_COMMIT="${{ github.sha }}" cargo run --locked -p metacrate-grid-agent -- --acceptance-evidence artifacts/ci/grid-agent-acceptance.jsonl
|
|
touch "$CARGO_TARGET_DIR/.metacrate-ready"
|
|
) 9>"$cache_lock"
|
|
|
|
- name: Upload stage timing and audit evidence
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: required-ci-evidence
|
|
path: artifacts/ci/
|
|
if-no-files-found: error
|