mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-25 09:45:14 -06:00
Stephan Renatus
8b52a08b74
This extra check is meant to catch go module proxy checksum mismatches, like the one we've released 0.32.1 to fix, earlier. It causes the go mod tooling to fetch all modules from their external sources, most likely all github references, and compares the contents' checksums with what we have in go.sum. It deliberately bypasses the "sumdb" service that is part of the golang infrastructure. The event of a mismatch would happen if a git tag was published, and later changed, and the golang infrastructure's module proxy (and sumdb service) had picked up the first tag. This is rather unlikely, and this test is thus a bit over-cautious. The idea is that if it becomes invisible, it's fine to keep, and gives us a bit of extra safety. However, if it becomes annoying (it's a giant network dependency in our CI runs), it's not critical enough to be kept and is OK to disable again. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
286 lines
6.8 KiB
YAML
286 lines
6.8 KiB
YAML
name: PR Check
|
|
|
|
on: [pull_request]
|
|
|
|
jobs:
|
|
# All jobs essentially re-create the `ci-release-test` make target, but are split
|
|
# up for parallel runners for faster PR feedback and a nicer UX.
|
|
generate:
|
|
name: Generate Code
|
|
runs-on: ubuntu-18.04
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Generate
|
|
run: make clean generate
|
|
|
|
- name: Upload generated artifacts
|
|
uses: actions/upload-artifact@v2
|
|
with:
|
|
name: generated
|
|
path: |
|
|
internal/compiler/wasm/opa
|
|
capabilities.json
|
|
|
|
go-build:
|
|
name: Go Build (${{ matrix.os }})
|
|
runs-on: ${{ matrix.run }}
|
|
needs: generate
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- os: linux
|
|
run: ubuntu-18.04
|
|
targets: ci-go-ci-build-linux ci-go-ci-build-linux-static
|
|
- os: windows
|
|
run: ubuntu-18.04
|
|
targets: ci-go-ci-build-windows
|
|
- os: darwin
|
|
run: macos-latest
|
|
targets: ci-build-darwin
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- id: go_version
|
|
name: Read go version
|
|
run: echo "::set-output name=go_version::$(cat .go-version)"
|
|
|
|
- name: Install Go (${{ steps.go_version.outputs.go_version }})
|
|
uses: actions/setup-go@v2
|
|
with:
|
|
go-version: ${{ steps.go_version.outputs.go_version }}
|
|
if: matrix.os == 'darwin'
|
|
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@v2
|
|
with:
|
|
name: generated
|
|
|
|
- name: Build
|
|
run: make ${{ matrix.targets }}
|
|
timeout-minutes: 30
|
|
|
|
- name: Upload binaries
|
|
uses: actions/upload-artifact@v2
|
|
if: always()
|
|
with:
|
|
name: binaries
|
|
path: _release
|
|
|
|
go-test:
|
|
name: Go Test (${{ matrix.os }})
|
|
runs-on: ${{ matrix.run }}
|
|
needs: generate
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- os: linux
|
|
run: ubuntu-18.04
|
|
- os: darwin
|
|
run: macos-latest
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- id: go_version
|
|
name: Read go version
|
|
run: echo "::set-output name=go_version::$(cat .go-version)"
|
|
|
|
- name: Install Go (${{ steps.go_version.outputs.go_version }})
|
|
uses: actions/setup-go@v2
|
|
with:
|
|
go-version: ${{ steps.go_version.outputs.go_version }}
|
|
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@v2
|
|
with:
|
|
name: generated
|
|
|
|
- name: Unit Test Golang
|
|
run: make test-coverage
|
|
timeout-minutes: 30
|
|
|
|
go-perf:
|
|
name: Go Perf
|
|
runs-on: ubuntu-18.04
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Benchmark Test Golang
|
|
run: make ci-go-perf
|
|
timeout-minutes: 30
|
|
|
|
go-quick-fuzz:
|
|
name: Go quick fuzz
|
|
runs-on: ubuntu-18.04
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Run fuzz check (3m)
|
|
run: make ci-go-check-fuzz FUZZ_TIME=180
|
|
timeout-minutes: 30
|
|
|
|
go-lint:
|
|
name: Go Lint
|
|
runs-on: ubuntu-18.04
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Golang Style and Lint Check
|
|
run: make check
|
|
timeout-minutes: 30
|
|
|
|
wasm:
|
|
name: WASM
|
|
runs-on: ubuntu-18.04
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Build and Test WASM
|
|
run: make ci-wasm
|
|
timeout-minutes: 15
|
|
|
|
check-generated:
|
|
name: Check Generated
|
|
runs-on: ubuntu-18.04
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Check Working Copy
|
|
run: make ci-check-working-copy
|
|
timeout-minutes: 15
|
|
|
|
wasm-go-sdk-e2e:
|
|
name: OPA Wasm SDK e2e
|
|
runs-on: ubuntu-18.04
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Build and Test Wasm SDK
|
|
run: make ci-go-wasm-sdk-e2e-test
|
|
timeout-minutes: 30
|
|
|
|
race-detector:
|
|
name: Go Race Detector
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Test with Race Detector
|
|
run: make ci-go-race-detector
|
|
|
|
smoke-test-docker-images:
|
|
name: docker image smoke test
|
|
runs-on: ubuntu-latest
|
|
needs: go-build
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Download release binaries
|
|
uses: actions/download-artifact@v2
|
|
with:
|
|
name: binaries
|
|
path: _release
|
|
|
|
- name: Test images
|
|
run: make ci-image-smoke-test
|
|
|
|
smoke-test-binaries:
|
|
runs-on: ${{ matrix.os }}
|
|
needs: go-build
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- os: ubuntu-latest
|
|
exec: opa_linux_amd64
|
|
- os: ubuntu-latest
|
|
exec: opa_linux_amd64_static
|
|
wasm: disabled
|
|
- os: macos-latest
|
|
exec: opa_darwin_amd64
|
|
- os: windows-latest
|
|
exec: opa_windows_amd64.exe
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Download release binaries
|
|
uses: actions/download-artifact@v2
|
|
with:
|
|
name: binaries
|
|
path: _release
|
|
|
|
- name: Test binaries (Rego)
|
|
run: make ci-binary-smoke-test-rego BINARY=${{ matrix.exec }}
|
|
|
|
- name: Test binaries (Wasm)
|
|
run: make ci-binary-smoke-test-wasm BINARY=${{ matrix.exec }}
|
|
if: matrix.wasm != 'disabled'
|
|
|
|
nodejs-wasm-example:
|
|
name: npm-opa-wasm
|
|
runs-on: ubuntu-latest
|
|
needs: go-build
|
|
steps:
|
|
- name: Download release binaries
|
|
uses: actions/download-artifact@v2
|
|
with:
|
|
name: binaries
|
|
path: _release
|
|
|
|
- name: Prepare OPA
|
|
run: |
|
|
ln -s _release/*/opa_linux_amd64 opa
|
|
chmod +x opa
|
|
echo $(pwd) >> $GITHUB_PATH
|
|
|
|
- name: Check out npm-opa-wasm
|
|
uses: actions/checkout@v2
|
|
with:
|
|
repository: open-policy-agent/npm-opa-wasm
|
|
path: npm-opa-wasm
|
|
|
|
- name: Run npm-opa-wasm nodejs-app examples
|
|
run: |
|
|
npm install
|
|
./e2e.sh
|
|
working-directory: npm-opa-wasm
|
|
|
|
go-version-build:
|
|
name: Go compat builds
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- version: "1.16"
|
|
- version: "1.15"
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Build
|
|
run: make ci-go-ci-build-linux GOVERSION=${{ matrix.version }}
|
|
timeout-minutes: 30
|
|
|
|
go-proxy-check:
|
|
name: Go mod check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Vendor without proxy
|
|
run: make check-go-module
|
|
timeout-minutes: 30
|