test(e2e): expand native-host and k8s coverage for untested subsystems #1640
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: "-D warnings" | |
| # All jobs run on ephemeral GitHub-hosted runners. | |
| # Zero secrets, zero self-hosted runners — safe for fork PRs. | |
| jobs: | |
| deny: | |
| runs-on: ubuntu-latest | |
| env: | |
| CARGO_DENY_VERSION: "0.19.6" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Install cargo-deny | |
| run: | | |
| curl -sL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz" | tar xz -C /usr/local/bin --strip-components=1 | |
| - name: Check dependencies | |
| run: cargo deny check | |
| fmt: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Check formatting | |
| run: cargo fmt --all --check | |
| clippy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install protobuf compiler | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Cache cargo registry and build | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-${{ github.job }}- | |
| ${{ runner.os }}-cargo- | |
| - name: Clippy | |
| run: cargo clippy --workspace --exclude spur-ffi --all-targets --locked | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install protobuf compiler | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Cache cargo registry and build | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-${{ github.job }}- | |
| ${{ runner.os }}-cargo- | |
| - name: Build all targets | |
| run: cargo build --all-targets --locked | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install protobuf compiler | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Cache cargo registry and build | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-${{ github.job }}- | |
| ${{ runner.os }}-cargo- | |
| - name: Test | |
| run: cargo test --locked | |
| test-db: | |
| name: DB tests (accounting) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| services: | |
| postgres: | |
| image: postgres:16@sha256:33f923b05f64ca54ac4401c01126a6b92afe839a0aa0a52bc5aeb5cc958e5f20 | |
| env: | |
| POSTGRES_USER: spur_ci | |
| POSTGRES_PASSWORD: spur_ci | |
| POSTGRES_DB: spur_acct_ci | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U spur_ci -d spur_acct_ci" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install protobuf compiler | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Cache cargo registry and build | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-${{ github.job }}- | |
| ${{ runner.os }}-cargo- | |
| - name: Run accounting DB integration tests | |
| env: | |
| DATABASE_URL: postgres://spur_ci:spur_ci@localhost:5432/spur_acct_ci | |
| run: cargo test --locked -p spurctld -- --ignored --test-threads=1 | |
| coverage: | |
| runs-on: ubuntu-latest | |
| env: | |
| RUSTFLAGS: "" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install protobuf compiler | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Cache cargo registry and build | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-${{ github.job }}- | |
| ${{ runner.os }}-cargo- | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@cargo-llvm-cov | |
| - name: Run tests with coverage | |
| run: cargo llvm-cov --workspace --exclude spur-ffi --locked --lcov --output-path lcov.info | |
| - name: Upload coverage to Codecov | |
| if: always() | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| files: lcov.info | |
| fail_ci_if_error: false | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| build-docker-image: | |
| name: Build Docker Image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build Docker image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| target: runtime | |
| push: false | |
| tags: spur:ci | |
| outputs: type=docker,dest=/tmp/spur-image.tar | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Upload Docker image | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: spur-image | |
| path: /tmp/spur-image.tar | |
| retention-days: 1 | |
| - name: Extract release binaries from image | |
| run: | | |
| docker load -i /tmp/spur-image.tar | |
| CID=$(docker create spur:ci) | |
| mkdir -p /tmp/release-binaries | |
| for bin in spur spurctld spurd spur-k8s-operator; do | |
| docker cp "$CID:/usr/local/bin/$bin" "/tmp/release-binaries/$bin" | |
| done | |
| docker rm "$CID" | |
| - name: Upload release binaries | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-binaries | |
| path: /tmp/release-binaries/ | |
| retention-days: 1 | |
| - name: Pack E2E test assets | |
| run: | | |
| set -euo pipefail | |
| root=/tmp/e2e-assets/trusted-repo | |
| mkdir -p "$root" | |
| cp -r tests "$root/" | |
| cp -r scripts "$root/" | |
| - name: Upload E2E assets | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: e2e-assets | |
| path: /tmp/e2e-assets/trusted-repo | |
| retention-days: 1 | |
| trivy-image-scan: | |
| name: Trivy image scan | |
| needs: build-docker-image | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: spur-image | |
| path: /tmp | |
| - name: Load image | |
| run: docker load -i /tmp/spur-image.tar | |
| - name: Scan image for vulnerabilities and secrets | |
| id: scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: spur:ci | |
| scanners: vuln,secret | |
| format: sarif | |
| output: trivy-image.sarif | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| limit-severities-for-sarif: true | |
| exit-code: "1" | |
| - name: Upload SARIF to GitHub Security | |
| if: always() && steps.scan.outcome != 'skipped' && github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| uses: github/codeql-action/upload-sarif@v4.37.4 | |
| with: | |
| sarif_file: trivy-image.sarif | |
| category: trivy-image | |
| trivy-dockerfile-scan: | |
| name: Trivy Dockerfile scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Scan Dockerfile for misconfigurations | |
| id: scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: config | |
| scan-ref: Dockerfile | |
| format: sarif | |
| output: trivy-config.sarif | |
| severity: CRITICAL,HIGH | |
| limit-severities-for-sarif: true | |
| exit-code: "1" | |
| - name: Upload SARIF to GitHub Security | |
| if: always() && steps.scan.outcome != 'skipped' && github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| uses: github/codeql-action/upload-sarif@v4.37.4 | |
| with: | |
| sarif_file: trivy-config.sarif | |
| category: trivy-config |