mirror of
https://github.com/rustfs/rustfs.git
synced 2026-09-21 01:53:30 +00:00
Chris
193 lines
7.9 KiB
YAML
193 lines
7.9 KiB
YAML
# Copyright 2024 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
name: Connect top.api service-job acceptance
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
build_run_id:
|
|
description: Main-branch Build and Release workflow run ID
|
|
required: true
|
|
type: string
|
|
artifact_id:
|
|
description: Linux x86_64 GNU artifact ID from that run
|
|
required: true
|
|
type: string
|
|
source_sha:
|
|
description: Exact 40-character source commit
|
|
required: true
|
|
type: string
|
|
artifact_digest:
|
|
description: GitHub artifact digest including sha256 prefix
|
|
required: true
|
|
type: string
|
|
binary_sha256:
|
|
description: Expected rustfs binary SHA-256
|
|
required: true
|
|
type: string
|
|
connect_sha:
|
|
description: Exact 40-character RustFS Connect harness commit
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
|
|
jobs:
|
|
top-api:
|
|
name: Verify native Linux x86_64 top.api service job
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- name: Checkout acceptance harness
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Checkout exact RustFS source
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
with:
|
|
path: rustfs-source
|
|
persist-credentials: false
|
|
ref: ${{ inputs.source_sha }}
|
|
|
|
- name: Checkout exact Connect harness
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
with:
|
|
repository: rustfs/connect
|
|
path: connect-harness
|
|
persist-credentials: false
|
|
ref: ${{ inputs.connect_sha }}
|
|
token: ${{ secrets.PF_TESTING_GH_TOKEN }}
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 22.22.2
|
|
cache: npm
|
|
cache-dependency-path: connect-harness/web/package-lock.json
|
|
|
|
- name: Verify source run and artifact identity
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
BUILD_RUN_ID: ${{ inputs.build_run_id }}
|
|
ARTIFACT_ID: ${{ inputs.artifact_id }}
|
|
SOURCE_SHA: ${{ inputs.source_sha }}
|
|
ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
|
|
CONNECT_SHA: ${{ inputs.connect_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
|
|
[[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
|
|
[[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
|
|
[[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
|
|
[[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
|
|
[[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
|
|
[[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
|
|
[[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
|
|
[[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
|
|
|
|
run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
|
|
[[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
|
|
[[ $(jq -r '.head_branch' <<<"$run") == main ]]
|
|
[[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
|
|
[[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
|
|
|
|
expected_job='Build RustFS (linux-x86_64-gnu, sm-standard-2, x86_64-unknown-linux-gnu, false, linux, pyroscope)'
|
|
jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
|
|
jq -e --arg name "$expected_job" '
|
|
[.[].jobs[] | select(.name == $name)] as $matches
|
|
| (($matches | length) == 1 and $matches[0].conclusion == "success")
|
|
' <<<"$jobs" >/dev/null
|
|
|
|
artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
|
|
[[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
|
|
[[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
|
|
[[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
|
|
[[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
|
|
[[ $(jq -r '.expired' <<<"$artifact") == false ]]
|
|
|
|
- name: Download exact build artifact
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
|
|
with:
|
|
artifact-ids: ${{ inputs.artifact_id }}
|
|
path: artifact
|
|
run-id: ${{ inputs.build_run_id }}
|
|
github-token: ${{ github.token }}
|
|
|
|
- name: Extract exact RustFS binary
|
|
shell: bash
|
|
env:
|
|
BINARY_SHA256: ${{ inputs.binary_sha256 }}
|
|
SOURCE_SHA: ${{ inputs.source_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
short_sha=${SOURCE_SHA:0:7}
|
|
package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
|
|
[[ -n "$package" ]]
|
|
mkdir -p binary
|
|
unzip -qq "$package" rustfs -d binary
|
|
chmod +x binary/rustfs
|
|
printf '%s %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
|
|
|
|
- name: Run signed service job acceptance
|
|
shell: bash
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
|
|
npm --prefix connect-harness/web ci
|
|
connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
|
|
make -C connect-harness e2e-connected-dispatch-check
|
|
RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
|
|
RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
|
|
CONNECT_E2E_TOP_API_EVIDENCE="$GITHUB_WORKSPACE/top-api-service-job-evidence.json" \
|
|
make -C connect-harness e2e-connected E2E_SCENARIO=top-api
|
|
|
|
- name: Bind workflow and artifact provenance
|
|
if: ${{ always() && hashFiles('top-api-service-job-evidence.json') != '' }}
|
|
shell: bash
|
|
env:
|
|
BUILD_RUN_ID: ${{ inputs.build_run_id }}
|
|
ARTIFACT_ID: ${{ inputs.artifact_id }}
|
|
ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
|
|
CONNECT_SHA: ${{ inputs.connect_sha }}
|
|
SOURCE_SHA: ${{ inputs.source_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
jq \
|
|
--arg workflowRunId "$GITHUB_RUN_ID" \
|
|
--arg buildRunId "$BUILD_RUN_ID" \
|
|
--arg artifactId "$ARTIFACT_ID" \
|
|
--arg artifactDigest "$ARTIFACT_DIGEST" \
|
|
--arg connectSha "$CONNECT_SHA" \
|
|
--arg sourceSha "$SOURCE_SHA" \
|
|
'. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
|
|
top-api-service-job-evidence.json >top-api-service-job-evidence.bound.json
|
|
mv top-api-service-job-evidence.bound.json top-api-service-job-evidence.json
|
|
|
|
- name: Upload acceptance evidence
|
|
if: ${{ always() && hashFiles('top-api-service-job-evidence.json') != '' }}
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
|
with:
|
|
name: connect-top-api-evidence-${{ github.run_id }}
|
|
path: |
|
|
top-api-service-job-evidence.json
|
|
retention-days: 14
|
|
if-no-files-found: error
|