virtkit/.github/workflows/quality.yml at main · virtkit-dev/virtkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
name: Quality

# Reusable lint + test + audit + script checks, called by ci.yml (push/PR) and release.yml
# (release gate).
#
# The cargo jobs run inside the pinned virtkit-build devcontainer image (same one
# build.sh uses), so clippy/rustfmt are the exact versions from rust-toolchain.toml
# and the musl-native gcc our vendored C deps need is present. The script checks need
# no toolchain and run on the runner itself.
# Audit shells out to ./audit.sh so .cargo/audit.toml (the RUSTSEC ignore list) stays
# the single source of truth shared with local runs.

on:
  workflow_call:

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - name: Build toolchain image
        run: docker build -t virtkit-build -f .devcontainer/Dockerfile .devcontainer

      - name: rustfmt
        run: |
          docker run --rm \
            --user "$(id -u):$(id -g)" -e HOME=/tmp \
            -v "$PWD":/work -w /work \
            virtkit-build \
            cargo fmt --all -- --check

      # clippy compiles the workspace, so it needs the same writable cargo home
      # as build.sh.
      - name: clippy
        run: |
          docker run --rm \
            --user "$(id -u):$(id -g)" -e HOME=/tmp \
            -e CARGO_HOME=/work/target/.cargo-home \
            -e CARGO_TARGET_DIR=/work/target \
            -v "$PWD":/work -w /work \
            virtkit-build \
            cargo clippy --workspace --all-targets --locked -- -D warnings

  # Run tests in parallel with lint and audit. CI builds wait for all three.
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - name: Build toolchain image
        run: docker build -t virtkit-build -f .devcontainer/Dockerfile .devcontainer

      # Run the workspace suite as ./dev.sh test does locally. The image includes
      # qemu-img/qemu-io/e2fsck so qcow2 and ext4 cross-checks run. Coverage excludes
      # #[ignore]d tests and checks requiring root (the container uses the host uid).
      # The built vk itself is attested by build.sh --bootstrap-check on release.
      #
      # Tests compile the workspace, so use the same writable cargo home as build.sh
      # and clippy. --locked prevents changes to the committed Cargo.lock. --init gives
      # the container a PID 1 that reaps orphans, as the dev VM and any normal system
      # do; without it cargo is PID 1 and adopted zombies pile up for the whole run.
      - name: cargo test
        run: |
          docker run --rm --init \
            --user "$(id -u):$(id -g)" -e HOME=/tmp \
            -e CARGO_HOME=/work/target/.cargo-home \
            -e CARGO_TARGET_DIR=/work/target \
            -v "$PWD":/work -w /work \
            virtkit-build \
            cargo test --workspace --locked

  # These two checks run on the runner without the toolchain image.
  scripts:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

      # install.sh is a published release asset and the first thing a fresh host runs, and
      # nothing else here would notice it stopped parsing. POSIX sh, as a bootstrap host's
      # /bin/sh may well be.
      - name: install.sh parses
        run: sh -n install.sh

      # `vk toolchain lock` covers DEFAULT_ARTIFACTS by default and the release publishes
      # the list below; written down twice, adding an asset to one and not the other would
      # silently leave the lock behind.
      - name: the release's assets and vk toolchain's default artifacts agree
        run: |
          workflow=$(sed -n '/gh release create "\$TAG"/,/--title/p' .github/workflows/release.yml |
            sed -n 's|^ *dist/\([a-z0-9-]*\) \\$|\1|p' | sort -u)
          code=$(sed -n '/^const DEFAULT_ARTIFACTS/,/];/p' vk-driver/src/toolchain.rs |
            grep -o '"[a-z0-9-]*"' | tr -d '"' | sort -u)
          [ -n "$workflow" ] && [ -n "$code" ] || { echo "neither list could be read"; exit 1; }
          [ "$workflow" = "$code" ] || {
            echo "release.yml publishes: $workflow"
            echo "DEFAULT_ARTIFACTS has:  $code"
            exit 1
          }

  audit:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - name: Build toolchain image
        run: docker build -t virtkit-build -f .devcontainer/Dockerfile .devcontainer

      # audit.sh runs cargo audit (baked into the image) and reads .cargo/audit.toml.
      # --deny warnings fails the job on any advisory. Invoked via `sh`: audit.sh is
      # POSIX-clean, so it needs nothing beyond the image's sh, and it finds no vk/docker in
      # the container so it audits directly.
      - name: cargo audit
        run: |
          docker run --rm \
            --user "$(id -u):$(id -g)" -e HOME=/tmp \
            -e CARGO_HOME=/work/target/.cargo-home \
            -e CARGO_TARGET_DIR=/work/target \
            -v "$PWD":/work -w /work \
            virtkit-build \
            sh audit.sh --deny warnings