gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-27 05:57:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
backcompat-validation
ziti/.github/workflows/main.yml
T
Paul Lorenz 2d6573eb30 Reclaim the AWS resources that cancelled CI fablab runs leave behind 
- adds a scheduled sweeper that terminates CI fablab instances (Name gh-*) launched more than 7 hours
  ago in every enabled region and deletes their VPCs; EC2 records no VPC creation time, so it ages
  each VPC from a tag it writes on first sight, and it reports every find as a workflow warning
- adds a stop-fablab action that interrupts the fablab command and terraform a cancelled step left
  running, and waits for terraform to save its state; the smoketest, validation, upgrade and
  backward compatibility jobs run it before they archive or tear down their environment
- moves the housekeeper's VPC teardown into a file the sweeper shares, and waits on instances already
  shutting down before deleting the subnet they hold
- fixes the HA smoketest teardown's skip condition, which named a job that doesn't exist
2026-10-16 18:20:30 -04:00

586 lines
21 KiB
YAML
Raw Permalink Blame History

name: build
on:
push:
branches:
- main
- release-v*
pull_request:
workflow_dispatch:
# cancel older, redundant runs of same workflow on same branch
concurrency:
group: ${{ github.workflow }}-${{github.event_name}}-${{ github.head_ref || github.ref_name }}
cancel-in-progress: true
env:
GOFLAGS: "-tags=pkcs11 -trimpath"
GOX_OUTPUT: "release/{{.Arch}}/{{.OS}}/{{.Dir}}"
GOX_TEST_OUTPUT: "test/{{.Arch}}/{{.OS}}/bin/{{.Dir}}"
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: "us-east-2"
gh_ci_key: ${{ secrets.GH_CI_KEY }}
CONSUL_ENCRYPTION_KEY: ${{ secrets.CONSUL_ENCRYPTION_KEY }}
ELASTIC_ENDPOINT: ${{ secrets.ELASTIC_ENDPOINT }}
ELASTIC_USERNAME: ${{ secrets.ELASTIC_USERNAME }}
ELASTIC_PASSWORD: ${{ secrets.ELASTIC_PASSWORD }}
CONSUL_ENDPOINT: ${{ secrets.CONSUL_ENDPOINT }}
CONSUL_AGENT_CERT: ${{ secrets.CONSUL_AGENT_CERT }}
BUILD_NUMBER: ${{ format('{0}-{1}-{2}', github.run_id, github.run_number, github.run_attempt) }}
ZITI_BASE_VERSION: ${{ vars.ZITI_BASE_VERSION || null }}
jobs:
mac-os-build:
name: Build Mac OS binaries
# allow fors to opt-out of time-consuming macOS builds
if: vars.ZITI_SKIP_MACOS_BUILD != 'true'
runs-on: macos-latest
steps:
- name: Git Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Install Go
uses: ./.github/actions/setup-go
- name: Install Ziti CI
uses: openziti/ziti-ci@v1
- name: Build and Test
shell: bash
run: |
set -o xtrace
go install github.com/mitchellh/gox@latest
$(go env GOPATH)/bin/gox -ldflags "$($(go env GOPATH)/bin/ziti-ci -q go-build-flags -n)" -cgo -os=darwin -arch=amd64 -output=$GOX_OUTPUT ./...
$(go env GOPATH)/bin/gox -ldflags "$($(go env GOPATH)/bin/ziti-ci -q go-build-flags -n)" -cgo -os=darwin -arch=arm64 -output=$GOX_OUTPUT ./...
- name: Upload artifacts
uses: actions/upload-artifact@v7
with:
name: darwin-release-${{ github.run_id }}
path: release/
retention-days: 5
windows-build:
name: Build Windows binaries
# allow fors to opt-out of time-consuming Windows builds
if: vars.ZITI_SKIP_WINDOWS_BUILD != 'true'
runs-on: windows-2022
steps:
- name: Git Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Install Go
uses: ./.github/actions/setup-go
- name: Install Ziti CI
uses: openziti/ziti-ci@v1
- name: Build and Test
shell: bash
run: |
set -o xtrace
go install github.com/mitchellh/gox@latest
$(go env GOPATH)/bin/gox -ldflags "$($(go env GOPATH)/bin/ziti-ci -q go-build-flags -n)" -cgo -os=windows -arch=amd64 -output=$GOX_OUTPUT ./...
- name: Upload artifacts
uses: actions/upload-artifact@v7
with:
name: windows-release-${{ github.run_id }}
path: release/
retention-days: 5
linux-build:
name: Build Linux binaries
runs-on: ubuntu-22.04 # pin oldest available Docker host for ABI compatibility
container: openziti/ziti-builder:v2 # pin v2 (Ubuntu Focal) for glibc compatibility while leveraging Actions's Node.js
steps:
- name: Git Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Install Go
uses: ./.github/actions/setup-go
- name: Install Ziti CI
uses: openziti/ziti-ci@v1
- name: Build and Test
shell: bash
run: |
set -o xtrace
go install github.com/mitchellh/gox@latest
$(go env GOPATH)/bin/gox -ldflags "$($(go env GOPATH)/bin/ziti-ci -q go-build-flags -n)" -cgo -os=linux -arch=amd64 -output=$GOX_OUTPUT ./...
CC=arm-linux-gnueabihf-gcc \
$(go env GOPATH)/bin/gox -ldflags "$($(go env GOPATH)/bin/ziti-ci -q go-build-flags -n)" -cgo -os=linux -arch=arm -output=$GOX_OUTPUT ./...
CC=aarch64-linux-gnu-gcc \
$(go env GOPATH)/bin/gox -ldflags "$($(go env GOPATH)/bin/ziti-ci -q go-build-flags -n)" -cgo -os=linux -arch=arm64 -output=$GOX_OUTPUT ./...
- name: Upload artifacts
uses: actions/upload-artifact@v7
with:
name: linux-release-${{ github.run_id }}
path: release/
retention-days: 5
tests:
name: Run Unit and Integration Tests
runs-on: ubuntu-24.04
steps:
- name: Git Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Install Go
uses: ./.github/actions/setup-go
- name: Install Ziti CI
uses: openziti/ziti-ci@v1
- name: Run Go Quickstart Test
timeout-minutes: 5
shell: bash
run: |
go test -v -tags "quickstart automated" ./ziti/run/...;
- name: Run Unit and Integration Tests
if: ${{ vars.ZITI_SKIP_INTEGRATION_TESTS != 'true' }}
# The step limit must exceed the go test timeout plus compile time, otherwise the runner
# kills the test binary before go can print the goroutine dump for a hung test.
timeout-minutes: 18
shell: bash
run: |
go test ./... -timeout 14m --tags apitests,dataflow
- name: Run CLI tests and Integration Tests
if: ${{ vars.ZITI_SKIP_CLI_TESTS != 'true' }}
timeout-minutes: 10
shell: bash
run: |
mkdir cli_tests_bin
go build -o cli_tests_bin ./...
ZITI_CLI_TEST_ZITI_BIN="$PWD/cli_tests_bin/ziti" go test ./... --tags cli_tests
- name: Upload CLI test logs
uses: actions/upload-artifact@v7
if: failure() || steps.cli_tests.outcome == 'failure'
with:
name: cli-test-logs-${{ github.run_id }}
path: |
/tmp/cli-tests/**/*-ctrl-*.log
/tmp/cli-tests/**/ctrl-stdout.log
retention-days: 5
fablab-smoketest:
name: Fablab Smoketest
# not applicable to forks. shouldn't run on release build
if: github.repository_owner == 'openziti' && !startsWith(github.ref_name, 'release-v') && !contains(github.actor, 'dependabot')
runs-on: ubuntu-24.04
steps:
- name: Git Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Install Go
uses: ./.github/actions/setup-go
- name: Install Ziti CI
uses: openziti/ziti-ci@v1
- name: Install Terraform CLI
uses: hashicorp/setup-terraform@v4
with:
terraform_version: ~1.5
- name: Build and Test
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ziti_ci_gpg_key: ${{ secrets.ZITI_CI_GPG_KEY }}
ziti_ci_gpg_key_id: ${{ secrets.ZITI_CI_GPG_KEY_ID }}
shell: bash
run: |
$(go env GOPATH)/bin/ziti-ci configure-git
$(go env GOPATH)/bin/ziti-ci generate-build-info common/version/info_generated.go version
pushd zititest && go mod tidy && go install -tags all ./... && popd
go install -tags=all,tests ./...
- name: Create Test Environment
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
shell: bash
run: |
echo "ZITI_ROOT=$(go env GOPATH)/bin" >> "$GITHUB_ENV"
$(go env GOPATH)/bin/smoketest create -d smoketest-${GITHUB_RUN_NUMBER} -n smoketest-${GITHUB_RUN_NUMBER} -l environment=gh-fablab-smoketest,ziti_version=$($(go env GOPATH)/bin/ziti-ci -q get-current-version)
$(go env GOPATH)/bin/smoketest up
- name: Test Ziti Command
shell: bash
run: |
echo "ZITI_ROOT=$(go env GOPATH)/bin" >> "$GITHUB_ENV"
pushd zititest && go test -timeout 30m -v ./tests/... 2>&1 | tee test.out && popd
- name: Stop Fablab
# a cancelled step leaves fablab and terraform running, and teardown needs terraform's final state
if: always()
timeout-minutes: 15
uses: ./.github/actions/stop-fablab
with:
model: smoketest
- name: Create fablab instance archive
# always create, even if cancelled, because the teardown job needs it to destroy the created test environment
if: always()
timeout-minutes: 30
env:
FABLAB_PASSPHRASE: ${{ secrets.FABLAB_PASSPHRASE }}
shell: bash
run: |
cp $(go env GOPATH)/bin/smoketest smoketest-${GITHUB_RUN_NUMBER}
cp ~/.fablab/config.yml smoketest-${GITHUB_RUN_NUMBER}/
tar --exclude *terraform-provider-aws* -czvf - smoketest-${GITHUB_RUN_NUMBER}/ | gpg --symmetric --cipher-algo aes256 --batch --quiet --passphrase ${FABLAB_PASSPHRASE} -o smoketest-${GITHUB_RUN_NUMBER}.tar.gz.gpg
aws s3 cp ./smoketest-${GITHUB_RUN_NUMBER}.tar.gz.gpg s3://ziti-smoketest-fablab-instances/
- name: Create Logs Archive
if: always()
run: |
$(go env GOPATH)/bin/smoketest get files '*' "./logs/{{ .Id }}/" ./logs
- name: Upload artifacts
uses: actions/upload-artifact@v7
if: always()
with:
name: logs-${{ github.run_id }}
path: logs/
compression-level: 7
retention-days: 5
- name: Test Report Generation
if: ${{ !cancelled() }}
shell: bash
run: |
go install github.com/jstemmer/go-junit-report/v2@latest
$(go env GOPATH)/bin/go-junit-report -in zititest/test.out -out test-report.xml
- name: Test Summary
uses: test-summary/action@v2
if: ${{ !cancelled() }}
with:
paths: |
test-report.xml
show: "fail, skip"
fablab-smoketest-teardown:
name: Teardown SmokeTest
# ensure reasonable timeout-minutes on steps in this un-cancellable job
if: always()
runs-on: ubuntu-24.04
needs: [ fablab-smoketest ]
steps:
# release cloud resources if the smoketest succeeded, failed, or was cancelled; unnecessary if skipped
- name: Install Terraform CLI
uses: hashicorp/setup-terraform@v4
with:
terraform_version: ~1.5
- name: Teardown Test Environment
if: needs.fablab-smoketest.result != 'skipped'
timeout-minutes: 30
env:
FABLAB_PASSPHRASE: ${{ secrets.FABLAB_PASSPHRASE }}
shell: bash
run: |
if aws s3api head-object \
--bucket ziti-smoketest-fablab-instances \
--key smoketest-${GITHUB_RUN_NUMBER}.tar.gz.gpg
then
aws s3 cp s3://ziti-smoketest-fablab-instances/smoketest-${GITHUB_RUN_NUMBER}.tar.gz.gpg .
gpg --quiet --batch --yes --decrypt --passphrase=${FABLAB_PASSPHRASE} --output smoketest-${GITHUB_RUN_NUMBER}.tar.gz smoketest-${GITHUB_RUN_NUMBER}.tar.gz.gpg
tar -xzf smoketest-${GITHUB_RUN_NUMBER}.tar.gz
./smoketest-${GITHUB_RUN_NUMBER}/smoketest import smoketest-${GITHUB_RUN_NUMBER}
./smoketest-${GITHUB_RUN_NUMBER}/smoketest dispose
aws s3 rm s3://ziti-smoketest-fablab-instances/smoketest-${GITHUB_RUN_NUMBER}.tar.gz.gpg
else
echo "WARN: No instance archive found for smoketest-${GITHUB_RUN_NUMBER}.tar.gz.gpg" >&2
fi
fablab-ha-smoketest:
name: Fablab HA Smoketest
# not applicable to forks. shouldn't run on release build
if: github.repository_owner == 'openziti' && !startsWith(github.ref_name, 'release-v') && !contains(github.actor, 'dependabot')
runs-on: ubuntu-24.04
steps:
- name: Git Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Install Go
uses: ./.github/actions/setup-go
- name: Install Ziti CI
uses: openziti/ziti-ci@v1
- name: Install Terraform CLI
uses: hashicorp/setup-terraform@v4
with:
terraform_version: ~1.5
- name: Build and Test
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ziti_ci_gpg_key: ${{ secrets.ZITI_CI_GPG_KEY }}
ziti_ci_gpg_key_id: ${{ secrets.ZITI_CI_GPG_KEY_ID }}
shell: bash
run: |
$(go env GOPATH)/bin/ziti-ci configure-git
$(go env GOPATH)/bin/ziti-ci generate-build-info common/version/info_generated.go version ${ZITI_BASE_VERSION:+--base-version $ZITI_BASE_VERSION}
pushd zititest && go mod tidy && go install -tags all ./... && popd
go install -tags=all,tests ./...
- name: Create Test Environment
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
shell: bash
run: |
echo "ZITI_ROOT=$(go env GOPATH)/bin" >> "$GITHUB_ENV"
$(go env GOPATH)/bin/smoketest create -d smoketest-ha-${GITHUB_RUN_NUMBER} -n smoketest-ha-${GITHUB_RUN_NUMBER} -l ha=true,environment=gh-fablab-ha-smoketest,ziti_version=$($(go env GOPATH)/bin/ziti-ci -q get-current-version)
$(go env GOPATH)/bin/smoketest up
- name: Test Ziti Command
shell: bash
run: |
echo "ZITI_ROOT=$(go env GOPATH)/bin" >> "$GITHUB_ENV"
pushd zititest && go test -timeout 30m -v ./tests/... 2>&1 | tee test.out && popd
- name: Stop Fablab
# a cancelled step leaves fablab and terraform running, and teardown needs terraform's final state
if: always()
timeout-minutes: 15
uses: ./.github/actions/stop-fablab
with:
model: smoketest
- name: Create fablab instance archive
if: always()
timeout-minutes: 30
env:
FABLAB_PASSPHRASE: ${{ secrets.FABLAB_PASSPHRASE }}
shell: bash
run: |
cp $(go env GOPATH)/bin/smoketest smoketest-ha-${GITHUB_RUN_NUMBER}
cp ~/.fablab/config.yml smoketest-ha-${GITHUB_RUN_NUMBER}/
tar --exclude *terraform-provider-aws* -czvf - smoketest-ha-${GITHUB_RUN_NUMBER}/ | gpg --symmetric --cipher-algo aes256 --batch --quiet --passphrase ${FABLAB_PASSPHRASE} -o smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz.gpg
aws s3 cp ./smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz.gpg s3://ziti-smoketest-fablab-instances/
- name: Create Logs Archive
if: always()
run: |
$(go env GOPATH)/bin/smoketest get files '*' "./logs/{{ .Id }}/" ./logs
- name: Upload artifacts
uses: actions/upload-artifact@v7
if: always()
with:
name: logs-ha-${{ github.run_id }}
path: logs/
compression-level: 7
retention-days: 5
- name: Test Report Generation
if: ${{ !cancelled() }}
shell: bash
run: |
go install github.com/jstemmer/go-junit-report/v2@latest
$(go env GOPATH)/bin/go-junit-report -in zititest/test.out -out test-report.xml
- name: Test Summary
uses: test-summary/action@v2
if: ${{ !cancelled() }}
with:
paths: |
test-report.xml
show: "fail, skip"
fablab-ha-smoketest-teardown:
name: Teardown HA SmokeTest
if: always()
runs-on: ubuntu-24.04
needs: [ fablab-ha-smoketest ]
steps:
# release cloud resources if the smoketest succeeded, failed, or was cancelled; unnecessary if skipped
- name: Install Terraform CLI
uses: hashicorp/setup-terraform@v4
with:
terraform_version: ~1.5
- name: Teardown Test Environment
if: needs.fablab-ha-smoketest.result != 'skipped'
timeout-minutes: 30
env:
FABLAB_PASSPHRASE: ${{ secrets.FABLAB_PASSPHRASE }}
shell: bash
run: |
if aws s3api head-object \
--bucket ziti-smoketest-fablab-instances \
--key smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz.gpg
then
aws s3 cp s3://ziti-smoketest-fablab-instances/smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz.gpg .
gpg --quiet --batch --yes --decrypt --passphrase=${FABLAB_PASSPHRASE} --output smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz.gpg
tar -xzf smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz
./smoketest-ha-${GITHUB_RUN_NUMBER}/smoketest import smoketest-ha-${GITHUB_RUN_NUMBER}
./smoketest-ha-${GITHUB_RUN_NUMBER}/smoketest dispose
aws s3 rm s3://ziti-smoketest-fablab-instances/smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz.gpg
else
echo "WARN: No instance archive found for smoketest-ha-${GITHUB_RUN_NUMBER}.tar.gz.gpg" >&2
fi
publish:
name: Publish Binaries
# - !cancelled() allows evaluating further conditional expressions even if needed jobs were skipped; this unblocks
# the job allowing it to run even if needed jobs failed, unless explicitly required in the "if" expression
if: ${{
!cancelled()
&& (needs.mac-os-build.result == 'success' || needs.mac-os-build.result == 'skipped')
&& (needs.windows-build.result == 'success' || needs.windows-build.result == 'skipped')
&& (needs.fablab-smoketest.result == 'success' || needs.fablab-smoketest.result == 'skipped')
&& (needs.fablab-ha-smoketest.result == 'success' || needs.fablab-ha-smoketest.result == 'skipped')
&& (needs.tests.result == 'success')
}}
runs-on: ubuntu-24.04
# ensure required job outcomes are specified in "if" expression
needs: [ tests, linux-build, mac-os-build, windows-build, fablab-smoketest, fablab-ha-smoketest ]
outputs:
ZITI_VERSION: ${{ steps.get_version.outputs.ZITI_VERSION }}
steps:
- name: Git Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Install Go
uses: ./.github/actions/setup-go
- name: Install Python
uses: actions/setup-python@v7
with:
python-version: '3.13'
- name: Install Ziti CI
uses: openziti/ziti-ci@v1
- name: Download linux release artifact
uses: actions/download-artifact@v8
with:
name: linux-release-${{ github.run_id }}
path: release/
- name: Download darwin release artifact
if: needs.mac-os-build.result == 'success'
uses: actions/download-artifact@v8
with:
name: darwin-release-${{ github.run_id }}
path: release/
- name: Download windows release artifact
if: needs.windows-build.result == 'success'
uses: actions/download-artifact@v8
with:
name: windows-release-${{ github.run_id }}
path: release/
- name: List downloaded release artifacts
shell: bash
run: |
ls -lAhR release/
- name: Restore execute filemode on macOS and Linux release artifacts before publishing
shell: bash
run: |
find ./release \
-type f \
-print0 \
-path "./release/*/darwin/ziti" \
-o \
-path "./release/*/linux/ziti*" \
| xargs -0 chmod -c +x
# only ziti-ci computed version for release branches and {version}-{run_id} for non-release branches
- name: Get next version for downstream release candidates
id: get_version
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_REF: ${{ github.ref }}
GITHUB_RUN_ID: ${{ github.run_id }}
shell: bash
run: |
function validateSemver() {
if ! [[ "${1}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "ERROR: ${1} is not a release semver" >&2
return 1
fi
}
echo "DEBUG: GITHUB_REPOSITORY=${GITHUB_REPOSITORY} GITHUB_REF=${GITHUB_REF} GITHUB_RUN_ID=${GITHUB_RUN_ID}"
(set -x; git remote -v show;)
# compute next release candidate version on non-release branches
ZITI_VERSION="$($(go env GOPATH)/bin/ziti-ci -q get-next-version ${ZITI_BASE_VERSION:+--base-version $ZITI_BASE_VERSION})"
validateSemver "${ZITI_VERSION}"
# drop the leading 'v', if any, and append run id
ZITI_VERSION=${ZITI_VERSION#v}-${GITHUB_RUN_ID}
echo ZITI_VERSION="${ZITI_VERSION}" | tee -a $GITHUB_OUTPUT
call-publish-docker-images:
# - !cancelled() allows evaluating further conditional expressions even if
# needed jobs were skipped
if: ${{
!cancelled()
&& needs.publish.result == 'success'
&& github.ref_name == 'main'
}}
name: Publish Release Candidate Docker Images
needs: publish
uses: ./.github/workflows/publish-docker-images.yml
secrets: inherit
with:
ziti-tag: main
# call on default branch "main" to publish linux packages to "testing" package repos in Artifactory
call-publish-linux-packages:
# - !cancelled() allows evaluating further conditional expressions even if
# needed jobs were skipped
if: ${{
!cancelled()
&& needs.publish.result == 'success'
&& github.ref_name == 'main'
}}
name: Publish Release Candidate Linux Packages
needs: publish
uses: ./.github/workflows/publish-linux-packages.yml
secrets: inherit
with:
ziti-version: ${{ needs.publish.outputs.ZITI_VERSION }}
Reference in New Issue View Git Blame Copy Permalink