mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-13 03:42:35 -06:00
Charlie Egan
aee10e4a8d
In: https://github.com/open-policy-agent/opa/actions/runs/15607457047/job/43960850907?pr=7693 The output is really unclear that it's the race job that failed. Since it's the summary that is the required check, it should be give the author some hint about what to do next to fix the issue rather than just saying "one of the required checks failed". Signed-off-by: Charlie Egan <charlie@styra.com>
522 lines
16 KiB
YAML
522 lines
16 KiB
YAML
name: PR Check
|
|
|
|
on: [pull_request]
|
|
|
|
# When a new revision is pushed to a PR, cancel all in-progress CI runs for that
|
|
# PR. See https://docs.github.com/en/actions/using-jobs/using-concurrency
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# Check what types of changes this PR contains
|
|
check-changes:
|
|
name: Check what files changed
|
|
runs-on: ubuntu-24.04
|
|
outputs:
|
|
go: ${{ steps.changes.outputs.go }}
|
|
wasm: ${{ steps.changes.outputs.wasm }}
|
|
docs: ${{ steps.changes.outputs.docs }}
|
|
steps:
|
|
- name: Check for file changes
|
|
id: changes
|
|
run: |
|
|
set -e
|
|
|
|
# Default to running all checks
|
|
echo "go=true" >> $GITHUB_OUTPUT
|
|
echo "wasm=true" >> $GITHUB_OUTPUT
|
|
echo "docs=true" >> $GITHUB_OUTPUT
|
|
|
|
if ! curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
|
|
"https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \
|
|
| jq -r '.[].filename' > changed_files.txt; then
|
|
echo "Error: Failed to fetch changed files from GitHub API"
|
|
echo "Defaulting to running all checks (go=true, wasm=true, docs=true)"
|
|
exit 0
|
|
fi
|
|
|
|
if [ ! -s changed_files.txt ]; then
|
|
echo "Warning: No changed files found"
|
|
echo "Defaulting to running all checks (go=true, wasm=true, docs=true)"
|
|
exit 0
|
|
fi
|
|
|
|
echo "Changed files:"
|
|
cat changed_files.txt
|
|
|
|
# Check for Go-related changes
|
|
go_patterns="^(.*\.go$|\
|
|
.*\.yaml$|\
|
|
.*\.yml$|\
|
|
.*\.json$|\
|
|
.*\.mod$|\
|
|
.*\.sum$|\
|
|
.*\.sh$|\
|
|
^Makefile$|\
|
|
^cmd/|\
|
|
^internal/|\
|
|
^v1/)"
|
|
if ! grep -E "$go_patterns" changed_files.txt > /dev/null 2>&1; then
|
|
echo "go=false" >> $GITHUB_OUTPUT
|
|
echo "No Go files changed, skipping Go checks"
|
|
else
|
|
echo "Found Go file changes"
|
|
fi
|
|
|
|
# Check for WASM-related changes
|
|
wasm_patterns="^(Makefile|\
|
|
wasm/|\
|
|
ast/|\
|
|
internal/compiler/|\
|
|
internal/planner/|\
|
|
internal/wasm/|\
|
|
test/wasm/|\
|
|
test/cases/|\
|
|
v1/ast/|\
|
|
v1/test/cases/|\
|
|
v1/test/wasm/|\
|
|
v1/ir/)"
|
|
if ! grep -E "$wasm_patterns" changed_files.txt > /dev/null 2>&1; then
|
|
echo "wasm=false" >> $GITHUB_OUTPUT
|
|
echo "No WASM-related changes detected, skipping WASM checks"
|
|
else
|
|
echo "Found WASM-related changes"
|
|
fi
|
|
|
|
# Check for docs changes (docs/, builtin_metadata.json, capabilities/*)
|
|
docs_patterns="^(docs/|builtin_metadata\.json|capabilities/)"
|
|
if ! grep -E "$docs_patterns" changed_files.txt > /dev/null 2>&1; then
|
|
echo "docs=false" >> $GITHUB_OUTPUT
|
|
echo "No docs-related changes detected, skipping docs checks"
|
|
else
|
|
echo "Found docs-related changes"
|
|
fi
|
|
|
|
echo "Final outputs:"
|
|
echo "go=$(grep '^go=' $GITHUB_OUTPUT | tail -1 | cut -d'=' -f2)"
|
|
echo "wasm=$(grep '^wasm=' $GITHUB_OUTPUT | tail -1 | cut -d'=' -f2)"
|
|
echo "docs=$(grep '^docs=' $GITHUB_OUTPUT | tail -1 | cut -d'=' -f2)"
|
|
|
|
# All jobs essentially re-create the `ci-release-test` make target, but are split
|
|
# up for parallel runners for faster PR feedback and a nicer UX.
|
|
generate:
|
|
name: Generate Code
|
|
runs-on: ubuntu-24.04
|
|
needs: check-changes
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Generate
|
|
run: make clean generate
|
|
|
|
- name: Upload generated artifacts
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: generated
|
|
path: |
|
|
internal/compiler/wasm/opa
|
|
capabilities.json
|
|
|
|
go-build:
|
|
name: Go Build (${{ matrix.os }}${{ matrix.arch && format(' {0}', matrix.arch) || '' }}${{ matrix.go_tags }})
|
|
runs-on: ${{ matrix.run }}
|
|
needs: [generate, check-changes]
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: linux
|
|
run: ubuntu-24.04
|
|
targets: ci-go-ci-build-linux ci-go-ci-build-linux-static
|
|
arch: amd64
|
|
- os: linux
|
|
run: ubuntu-24.04
|
|
targets: ci-go-ci-build-linux-static
|
|
arch: arm64
|
|
- os: linux
|
|
run: ubuntu-24.04
|
|
targets: ci-go-ci-build-linux-static
|
|
go_tags: GO_TAGS="-tags=opa_no_oci"
|
|
variant_name: opa_no_ci
|
|
arch: arm64
|
|
- os: windows
|
|
run: ubuntu-24.04
|
|
targets: ci-go-ci-build-windows
|
|
arch: amd64
|
|
- os: darwin
|
|
run: macos-13
|
|
targets: ci-build-darwin
|
|
arch: amd64
|
|
- os: darwin
|
|
run: macos-14
|
|
targets: ci-build-darwin-arm64-static
|
|
arch: arm64
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- id: go_version
|
|
name: Read go version
|
|
run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
|
|
|
|
- name: Install Go (${{ steps.go_version.outputs.go_version }})
|
|
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
|
|
with:
|
|
go-version: ${{ steps.go_version.outputs.go_version }}
|
|
if: matrix.os == 'darwin'
|
|
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: generated
|
|
|
|
- name: Build
|
|
run: make ${{ matrix.go_tags }} ${{ matrix.targets }}
|
|
env:
|
|
GOARCH: ${{ matrix.arch }}
|
|
timeout-minutes: 30
|
|
|
|
- name: Upload binaries - No Go tags
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
if: ${{ matrix.go_tags == '' }}
|
|
with:
|
|
name: binaries-${{ matrix.os }}-${{ matrix.arch }}
|
|
path: _release
|
|
|
|
- name: Upload binaries - Go tag variants
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
if: ${{ matrix.go_tags != '' && matrix.variant_name != '' }}
|
|
with:
|
|
name: binaries-variant-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.variant_name }}
|
|
path: _release
|
|
|
|
go-test:
|
|
name: Go Test (${{ matrix.os }})
|
|
runs-on: ${{ matrix.run }}
|
|
needs: [generate, check-changes]
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: linux
|
|
run: ubuntu-24.04
|
|
- os: darwin
|
|
run: macos-14
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- id: go_version
|
|
name: Read go version
|
|
run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
|
|
|
|
- name: Install Go (${{ steps.go_version.outputs.go_version }})
|
|
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
|
|
with:
|
|
go-version: ${{ steps.go_version.outputs.go_version }}
|
|
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: generated
|
|
|
|
- name: Unit Test Golang
|
|
run: make test-coverage
|
|
timeout-minutes: 30
|
|
|
|
go-lint:
|
|
name: Go Lint
|
|
runs-on: ubuntu-24.04
|
|
needs: check-changes
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Golang Style and Lint Check
|
|
run: make check
|
|
timeout-minutes: 30
|
|
|
|
yaml-lint:
|
|
name: YAML Lint
|
|
runs-on: ubuntu-24.04
|
|
needs: check-changes
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: YAML Style and Lint Check
|
|
run: make check-yaml-tests
|
|
timeout-minutes: 30
|
|
env:
|
|
YAML_LINT_FORMAT: github
|
|
|
|
wasm:
|
|
name: WASM
|
|
runs-on: ubuntu-24.04
|
|
needs: [generate, check-changes]
|
|
if: ${{ needs.check-changes.outputs.wasm == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: generated
|
|
|
|
- name: Build and Test Wasm
|
|
run: make ci-wasm
|
|
timeout-minutes: 15
|
|
|
|
- name: Build and Test Wasm SDK
|
|
run: make ci-go-wasm-sdk-e2e-test
|
|
timeout-minutes: 30
|
|
env:
|
|
DOCKER_RUNNING: 0
|
|
|
|
check-generated:
|
|
name: Check Generated
|
|
runs-on: ubuntu-24.04
|
|
needs: [generate, check-changes]
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: generated
|
|
|
|
- name: Check Working Copy
|
|
run: make ci-check-working-copy
|
|
timeout-minutes: 15
|
|
env:
|
|
DOCKER_RUNNING: 0
|
|
|
|
race-detector:
|
|
name: Go Race Detector
|
|
runs-on: ubuntu-24.04
|
|
needs: [generate, check-changes]
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: generated
|
|
|
|
- name: Test with Race Detector
|
|
run: make ci-go-race-detector
|
|
env:
|
|
DOCKER_RUNNING: 0
|
|
|
|
smoke-test-docker-images:
|
|
name: docker image smoke test
|
|
runs-on: ubuntu-24.04
|
|
needs: [go-build, check-changes]
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
|
|
with:
|
|
platforms: arm64
|
|
|
|
- name: Download release binaries
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
pattern: binaries-*
|
|
merge-multiple: true
|
|
path: _release
|
|
|
|
- name: Test amd64 images
|
|
run: make ci-image-smoke-test
|
|
|
|
- name: Test arm64 images
|
|
run: make ci-image-smoke-test
|
|
env:
|
|
GOARCH: arm64
|
|
|
|
# Note(philipc): We only run the amd64 targets.
|
|
smoke-test-binaries:
|
|
runs-on: ${{ matrix.run }}
|
|
needs: [go-build, check-changes]
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- os: linux
|
|
run: ubuntu-24.04
|
|
exec: opa_linux_amd64
|
|
arch: amd64
|
|
- os: linux
|
|
run: ubuntu-24.04
|
|
exec: opa_linux_amd64_static
|
|
arch: amd64
|
|
wasm: disabled
|
|
- os: darwin
|
|
run: macos-13
|
|
exec: opa_darwin_amd64
|
|
arch: amd64
|
|
- os: darwin
|
|
run: macos-14
|
|
exec: opa_darwin_arm64_static
|
|
arch: arm64
|
|
wasm: disabled
|
|
- os: windows
|
|
run: windows-latest
|
|
exec: opa_windows_amd64.exe
|
|
arch: amd64
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Download release binaries
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: binaries-${{ matrix.os }}-${{ matrix.arch }}
|
|
path: _release
|
|
|
|
- name: Test binaries (Rego)
|
|
run: make ci-binary-smoke-test-rego BINARY=${{ matrix.exec }}
|
|
|
|
- name: Test binaries (Wasm)
|
|
run: make ci-binary-smoke-test-wasm BINARY=${{ matrix.exec }}
|
|
if: matrix.wasm != 'disabled'
|
|
|
|
go-version-build:
|
|
name: Go compat build/test
|
|
needs: [generate, check-changes]
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-24.04, macos-14]
|
|
version: ["1.21"]
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- name: Download generated artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: generated
|
|
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
|
|
with:
|
|
go-version: ${{ matrix.version }}
|
|
- run: make build
|
|
env:
|
|
DOCKER_RUNNING: 0
|
|
- run: make go-test
|
|
env:
|
|
DOCKER_RUNNING: 0
|
|
|
|
# Run PR metadata against Rego policies
|
|
rego-check-pr:
|
|
name: Rego PR checks
|
|
runs-on: ubuntu-24.04
|
|
needs: check-changes
|
|
if: ${{ needs.check-changes.outputs.go == 'true' }}
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Download OPA
|
|
uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
|
|
with:
|
|
version: edge
|
|
|
|
- name: Test policies
|
|
run: opa test --v0-compatible build/policy
|
|
|
|
- name: Ensure proper formatting
|
|
run: opa fmt --v0-compatible --list --fail build/policy
|
|
|
|
- name: Run file policy checks on changed files
|
|
run: |
|
|
curl --silent --fail --header 'Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' -o files.json \
|
|
https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files
|
|
|
|
opa eval --v0-compatible -d build/policy/files.rego -d build/policy/helpers.rego --format values --input files.json \
|
|
--fail-defined 'data.files.deny[message]'
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Show input on failure
|
|
run: opa eval --v0-compatible --input files.json --format pretty input
|
|
if: ${{ failure() }}
|
|
|
|
docs-build:
|
|
name: Build Docs
|
|
runs-on: ubuntu-24.04
|
|
needs: check-changes
|
|
if: ${{ needs.check-changes.outputs.docs == 'true' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Build docs
|
|
run: make docs-install docs-build
|
|
|
|
# This job is required to complete before merging, and is set as a branch
|
|
# protection rule:
|
|
# https://github.com/open-policy-agent/opa/settings/branch_protection_rules
|
|
pr-check-summary:
|
|
name: PR Check Summary
|
|
runs-on: ubuntu-24.04
|
|
needs: [
|
|
check-changes,
|
|
generate,
|
|
go-build,
|
|
go-test,
|
|
go-lint,
|
|
yaml-lint,
|
|
wasm,
|
|
check-generated,
|
|
race-detector,
|
|
smoke-test-docker-images,
|
|
smoke-test-binaries,
|
|
go-version-build,
|
|
rego-check-pr,
|
|
docs-build,
|
|
]
|
|
if: always()
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- name: Download OPA
|
|
uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
|
|
with:
|
|
version: edge
|
|
- name: Check job results
|
|
run: |
|
|
# Create the input file with all job results
|
|
echo '${{ toJSON(needs) }}' > input.json
|
|
|
|
# Find failed or cancelled jobs using OPA
|
|
opa eval -d .github/workflows/pull-request.yaml \
|
|
--input=input.json \
|
|
'{job|some _, job in data.jobs["pr-check-summary"].needs} & {job | input[job].result in {"failure", "cancelled"}}' \
|
|
--format=raw > failed_jobs.json
|
|
|
|
# Check for failures and display a nice message
|
|
if [ "$(cat failed_jobs.json)" != "[]" ]; then
|
|
echo "The following required jobs did not complete successfully:"
|
|
jq -r '.[]' failed_jobs.json | sed 's/^/- /'
|
|
exit 1
|
|
fi
|
|
|
|
echo "All jobs completed successfully or were skipped"
|