Relax mypy strict mode for alpha release #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI — Integration | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| types: [labeled] | |
| concurrency: | |
| group: ci-integration-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| REGISTRY: ghcr.io | |
| REPO: ${{ github.repository }} | |
| jobs: | |
| should-run: | |
| name: Check Trigger | |
| runs-on: ubuntu-22.04 | |
| outputs: | |
| run: ${{ steps.check.outputs.run }} | |
| steps: | |
| - id: check | |
| run: | | |
| if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| elif [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.label.name }}" == "integration" ]]; then | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "run=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| build-all: | |
| name: Build All Components | |
| needs: should-run | |
| if: needs.should-run.outputs.run == 'true' | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build images | |
| run: | | |
| docker compose -f deploy/docker-compose.yml build correlation-engine audit-ledger | |
| - name: Save images | |
| run: | | |
| docker save \ | |
| sentinel/correlation-engine \ | |
| sentinel/audit-ledger \ | |
| | gzip > sentinel-images.tar.gz | |
| - name: Upload images | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sentinel-images | |
| path: sentinel-images.tar.gz | |
| retention-days: 1 | |
| e2e-tests: | |
| name: End-to-End Tests | |
| needs: build-all | |
| runs-on: [self-hosted, gpu, cuda] | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Download images | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: sentinel-images | |
| - name: Load images | |
| run: gunzip -c sentinel-images.tar.gz | docker load | |
| - name: Start all services | |
| run: | | |
| docker compose -f deploy/docker-compose.yml up -d | |
| sleep 15 | |
| - name: Wait for health checks | |
| run: | | |
| for svc in correlation-engine audit-ledger; do | |
| for i in $(seq 1 30); do | |
| if docker compose -f deploy/docker-compose.yml exec -T $svc test -f /tmp/healthy 2>/dev/null || \ | |
| curl -sf http://localhost:8080/health 2>/dev/null; then | |
| echo "$svc is healthy" | |
| break | |
| fi | |
| echo "Waiting for $svc... ($i/30)" | |
| sleep 5 | |
| done | |
| done | |
| - name: Run E2E test suite | |
| run: | | |
| docker compose -f deploy/docker-compose.yml exec -T test-runner \ | |
| python -m pytest /tests/e2e/ -v --timeout=600 | |
| - name: Run SDC injection tests | |
| run: | | |
| docker compose -f deploy/docker-compose.yml exec -T test-runner \ | |
| python /tools/sdc-injector/src/harness.py \ | |
| --sentinel-api http://correlation-engine:8080 \ | |
| --scenarios single_weight_bitflip,fma_stuck_at \ | |
| --report /tmp/injection_results.json | |
| - name: Run overhead measurement | |
| run: | | |
| docker compose -f deploy/docker-compose.yml exec -T test-runner \ | |
| python /benchmarks/overhead_measurement/probe_overhead.py \ | |
| --all-schedules --output /tmp/overhead.json | |
| - name: Collect logs | |
| if: always() | |
| run: | | |
| docker compose -f deploy/docker-compose.yml logs --no-color > docker-compose-logs.txt | |
| - name: Upload test artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: integration-test-artifacts | |
| path: | | |
| docker-compose-logs.txt | |
| - name: Tear down | |
| if: always() | |
| run: docker compose -f deploy/docker-compose.yml down -v | |
| coverage: | |
| name: Coverage Report | |
| needs: e2e-tests | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Download coverage artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| pattern: "*-coverage" | |
| merge-multiple: true | |
| - name: Generate combined report | |
| run: | | |
| echo "Coverage artifacts collected." | |
| ls -la *.xml 2>/dev/null || echo "No coverage files found." |