-
Notifications
You must be signed in to change notification settings - Fork 1.5k
210 lines (189 loc) · 8.18 KB
/
tests.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
# Exceptions. See /LICENSE for license information.
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
name: Tests
on:
push:
branches: [trunk, action-test]
pull_request:
merge_group:
permissions:
contents: read # For actions/checkout.
pull-requests: read # For dorny/paths-filter to read pull requests.
# Cancel previous workflows on the PR when there are multiple fast commits.
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#concurrency
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
cancel-in-progress: true
jobs:
test:
strategy:
matrix:
# On PRs and in the merge queue test a recent version of each supported
# OS. On push (post-submit), also run on `macos-12` to get Intel macOS
# coverage.
runner:
${{ fromJSON(github.event_name != 'push' && '["ubuntu-22.04",
"macos-14"]' || '["ubuntu-22.04", "macos-14", "macos-12"]') }}
build_mode: [fastbuild, opt]
include:
# The clang-tidy config doesn't work on macos (missing `truncate`).
- runner: ubuntu-22.04
build_mode: clang-tidy
runs-on: ${{ matrix.runner }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
with:
egress-policy: block
# When adding endpoints, see README.md.
# prettier-ignore
allowed-endpoints: >
*.dl.sourceforge.net:443
api.github.com:443
bcr.bazel.build:443
downloads.sourceforge.net:443
github.com:443
mirrors.kernel.org:443
nodejs.org:443
oauth2.googleapis.com:443
objects.githubusercontent.com:443
pypi.org:443
releases.bazel.build:443
sourceforge.net:443
storage.googleapis.com:443
# Checkout the pull request head or the branch.
- name: Checkout pull request
if: github.event_name == 'pull_request'
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
ref: ${{ github.event.pull_request.head.sha }}
- name: Checkout branch
if: github.event_name != 'pull_request'
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
# Tests should only run on applicable paths, but we still need to have an
# action run for the merge queue. We filter steps based on the paths here,
# and condition steps on the output.
- id: filter
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
with:
filters: |
has_code:
- '!{**/*.md,LICENSE,CODEOWNERS,.git*}'
# Disable uploads when the remote cache is read-only.
- name: Set up remote cache access (read-only)
if:
steps.filter.outputs.has_code == 'true' && github.event_name ==
'pull_request'
run: |
echo "remote_cache_upload=--remote_upload_local_results=false" \
>> $GITHUB_ENV
# Provide a cache key when the remote cache is read-write.
- name: Set up remote cache access (read-write)
if:
steps.filter.outputs.has_code == 'true' && github.event_name !=
'pull_request'
env:
REMOTE_CACHE_KEY: ${{ secrets.CARBON_BUILDS_GITHUB }}
run: |
echo "$REMOTE_CACHE_KEY" | base64 -d > $HOME/remote_cache_key.json
echo "remote_cache_upload=--google_credentials=$HOME/remote_cache_key.json" \
>> $GITHUB_ENV
- uses: ./.github/actions/build-setup-common
if: steps.filter.outputs.has_code == 'true'
with:
matrix_runner: ${{ matrix.runner }}
remote_cache_upload: ${{ env.remote_cache_upload }}
# Just for visibility, print space before and after the build.
- name: Disk space before build
if: steps.filter.outputs.has_code == 'true'
run: df -h
- name: Verify MODULE.bazel.lock
if: steps.filter.outputs.has_code == 'true'
run: |
exit_code=0
./scripts/run_bazel.py \
--attempts=5 \
mod deps --lockfile_mode=error || exit_code=$?
if (( $exit_code != 0 )); then
./scripts/run_bazel.py \
--attempts=5 \
mod deps --lockfile_mode=update
echo "MODULE.bazel.lock is out of date! Use below file for update."
echo "Platforms may require merging output, for example by applying"
echo "an update, re-running triggers, and applying the next update."
echo "============================================================"
cat MODULE.bazel.lock
echo "============================================================"
exit 1
fi
# Build and run all targets on branch pushes to ensure we always have a
# clean tree. We don't expect this to be an interactive path and so don't
# optimize the latency of this step.
- name: Compute impacted pull request targets (for push)
if:
steps.filter.outputs.has_code == 'true' && github.event_name == 'push'
env:
TARGETS_FILE: ${{ runner.temp }}/targets
run: |
echo "//..." >$TARGETS_FILE
# Compute the set of possible rules impacted by this change using
# Bazel-based diffing. This lets PRs and the merge queue have a much more
# efficient test CI action by avoiding even enumerating (and downloading)
# all of the unaffected Bazel targets.
- name: Compute impacted pull request targets
if:
steps.filter.outputs.has_code == 'true' && github.event_name != 'push'
env:
# Compute the base SHA from the different event structures.
GIT_BASE_SHA:
${{ github.event_name == 'pull_request' &&
github.event.pull_request.base.sha ||
github.event.merge_group.base_sha }}
TARGETS_FILE: ${{ runner.temp }}/targets
run: |
# First fetch the relevant base into the git repository.
git fetch --depth=1 origin $GIT_BASE_SHA
# Then use `target-determinator` as wrapped by our script.
./scripts/target_determinator.py $GIT_BASE_SHA >$TARGETS_FILE
# Bazel requires a test target to run the test command. There may be
# no targets or there may only be non-test targets that we want to
# build, so simply inject an explicit no-op test target.
echo "//scripts:no_op_test" >> $TARGETS_FILE
# Build and run just the tests impacted by the PR or merge group.
- name: Test (${{ matrix.build_mode }})
if:
steps.filter.outputs.has_code == 'true' && matrix.build_mode !=
'clang-tidy'
env:
# 'libtool_check_unique failed to generate' workaround.
# https://github.com/bazelbuild/bazel/issues/14113#issuecomment-999794586
BAZEL_USE_CPP_ONLY_TOOLCHAIN: 1
TARGETS_FILE: ${{ runner.temp }}/targets
run: |
# Decrease the jobs sharply if we see repeated failures to try to
# work around transient network errors even if it makes things
# slower.
./scripts/run_bazel.py \
--attempts=5 --jobs-on-last-attempt=4 \
test -c ${{ matrix.build_mode }} \
--target_pattern_file=$TARGETS_FILE
# Run in the clang-tidy config. This is done as part of tests so that we
# aren't duplicating bazel/llvm setup.
#
# The `-k` flag is used to print all clang-tidy errors.
- name: clang-tidy
if:
steps.filter.outputs.has_code == 'true' && matrix.build_mode ==
'clang-tidy'
env:
TARGETS_FILE: ${{ runner.temp }}/targets
run: |
./scripts/run_bazel.py \
--attempts=5 \
build --config=clang-tidy -k \
--target_pattern_file=$TARGETS_FILE
# See "Disk space before build".
- name: Disk space after build
if: steps.filter.outputs.has_code == 'true'
run: df -h