mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-07 05:43:14 +00:00
Zhengchao An
6c99d4fe22
nix-flake-update opens a PR every Sunday that changes flake.lock and nothing else. flake.lock is consumed only by Nix packaging — cargo never reads it — yet it was in no paths filter, so each of those PRs ran the full Continuous Integration pipeline and the merge then ran Build and Release too. Added to all four lists that have to agree: ci.yml's push and pull_request paths-ignore, build.yml's push paths-ignore, and ci-docs-only.yml's paths. The cron stays. flake.lock still has consumers — anyone running `nix build` or `nix develop` — so stopping the updates would remove the workflow's output, not just its CI cost. Those four lists drifting is a silent failure, so scripts/check_ci_paths_sync.sh now asserts the pair that matters: ci.yml's pull_request paths-ignore must equal ci-docs-only.yml's paths. An entry present only in the first means a PR touching those files triggers neither workflow, nobody reports "Test and Lint" or "Quick Checks", and the PR waits on a required check forever. It also asserts both companion job names still exist, since renaming one produces the same hang. The push list is not compared: no required check is reported for push events. Also in this cleanup: - nix-flake-update's GITHUB_TOKEN drops to contents: read. The branch push and the pull request are both made by update-flake-lock with the FLAKE_UPDATE_TOKEN PAT, so the write scopes were an unused repo-write credential on an unattended weekly job. - build.yml's build_docker dispatch input is documented as advisory. docker.yml triggers on workflow_run and requires the triggering event to be a tag push, so a manual dispatch never reaches it whatever this input says. - The nine disabled workflow files get a banner saying so. Their disabled_manually state lives in GitHub's UI and is invisible when reading the file, which has already misled one audit into treating dead workflows as live. Refs: rustfs/backlog#1598, rustfs/backlog#1603
78 lines
3.1 KiB
YAML
78 lines
3.1 KiB
YAML
# Copyright 2024 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# MinIO on-disk interop: prove RustFS reads MinIO-written erasure-coded SSE
|
|
# objects with byte-identical data and correct logical size.
|
|
#
|
|
# This is NOT a PR gate. The fixtures are real MinIO backend trees generated on
|
|
# the fly (they are gitignored, never committed), so the job regenerates them
|
|
# each run with Docker and then runs the `#[ignore]` reader tests in
|
|
# crates/ecstore/tests/minio_generated_read_test.rs.
|
|
#
|
|
# Runner: GitHub-hosted `ubuntu-latest`. It reliably ships Docker + Python,
|
|
# unlike the self-hosted fleet, whose pods drift in Docker/pip availability
|
|
# (see the infra note in e2e-s3tests.yml). Nightly + manual only.
|
|
# DISABLED. This workflow is switched off in the repository's Actions settings
|
|
# (state: disabled_manually) and does not run on any trigger, including its cron
|
|
# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
|
|
# reading this file, which has already misled at least one audit — hence this
|
|
# banner. Re-enabling is a UI action; anyone doing so should first check that the
|
|
# workflow still matches the current CI layout. See rustfs/backlog#1603.
|
|
#
|
|
name: minio-interop
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
# Nightly at 03:17 UTC (offset from other nightly jobs).
|
|
- cron: "17 3 * * *"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
minio-interop:
|
|
name: MinIO interop (EC + SSE read parity)
|
|
# Skip on forks: needs the repo's runners and is not a contributor gate.
|
|
if: github.repository == 'rustfs/rustfs'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 40
|
|
env:
|
|
# Fixed 32-byte test KMS key baked into the fixture lab; not a secret.
|
|
RUSTFS_MINIO_STATIC_KMS_KEY_B64: IyqsU3kMFloCNup4BsZtf/rmfHVcTgznO2F25CkEH1g=
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
|
|
- name: Setup Rust environment
|
|
uses: ./.github/actions/setup
|
|
with:
|
|
rust-version: stable
|
|
cache-shared-key: ci-minio-interop
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
cache-save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
|
|
- name: Generate real MinIO fixtures via Docker
|
|
run: bash crates/rio-v2/tests/minio_fixture_lab/capture_via_docker.sh
|
|
|
|
- name: Run MinIO interop reader tests
|
|
run: |
|
|
cargo nextest run --run-ignored ignored-only \
|
|
-p rustfs-ecstore --features rio-v2 \
|
|
-E 'binary(minio_generated_read_test)'
|