714dda08e5
Некоторые проверки не удались
CI / test (push) Successful in 3m19s
Docker / Build and publish worker image (push) Successful in 17m20s
SSH Source-Install E2E / Alpine/Ubuntu/Arch source-install E2E (push) Failing after 2m48s
95 строки
4.5 KiB
YAML
95 строки
4.5 KiB
YAML
name: SSH Source-Install E2E
|
|
|
|
# Work package 5 of docs/source-installation.md: run the Alpine/Ubuntu/Arch
|
|
# OpenSSH source-install E2E matrix (make test-ssh) in CI.
|
|
#
|
|
# Trust boundary. This job builds and runs privileged Docker containers from
|
|
# repository code (the distro fixtures execute the checked-out source), so it
|
|
# runs ONLY on trusted refs: pushes to the default branch (master) and manual
|
|
# workflow_dispatch. It deliberately does NOT trigger on pull_request: a PR
|
|
# can carry untrusted code into a privileged Docker environment, and Gitea's
|
|
# fork-PR read-only token clamp does not change what the containers can do on
|
|
# the runner host. The ordinary unit `make test` CI run (ci.yml) stays
|
|
# Docker-free and still covers pull requests.
|
|
#
|
|
# Runner requirement. The job inherits whatever Docker access `docker.yml`
|
|
# already relies on. The harness dials fixture SSH ports published on the
|
|
# Docker daemon loopback, so the runner must expose Docker with loopback port
|
|
# publishing reachable from the job; scripts/ci/test-ssh.sh fails fast when
|
|
# that is not the case.
|
|
#
|
|
# External network: fixture images (alpine from the reg.rsxx.ru mirror,
|
|
# ubuntu/arch overridable via RSMON_TEST_IMAGE_*), the pinned Go toolchain
|
|
# from go.dev, the public source repo from rocketgit.ru, and distro package
|
|
# repos are fetched live. Operators can pin a resolver for flaky CI DNS via
|
|
# the RSMON_TEST_DOCKER_DNS repository variable (comma-separated nameservers).
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
workflow_dispatch:
|
|
|
|
# Per-ref scoping: master pushes cancel a superseded in-flight run on the same
|
|
# ref instead of stacking; a manual dispatch on another branch has its own
|
|
# group and never cancels the master run.
|
|
concurrency:
|
|
group: test-ssh-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Least privilege: the job only needs to read the repository (actions/checkout
|
|
# and the harness's SSH-free operations). contents:read is supported by Gitea
|
|
# Actions (the GITEA_TOKEN scope for code/releases).
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test-ssh:
|
|
name: Alpine/Ubuntu/Arch source-install E2E
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
env:
|
|
# All empty by default (harness defaults / Docker embedded DNS).
|
|
# Override in repo/organization variables:
|
|
# RSMON_TEST_IMAGE_ALPINE / _UBUNTU / _ARCH - pin a mirror or a
|
|
# specific distro snapshot for the fixture base image;
|
|
# RSMON_TEST_DOCKER_DNS - comma-separated nameservers applied as
|
|
# `docker run --dns ...` for flaky CI resolvers.
|
|
RSMON_TEST_IMAGE_ALPINE: ${{ vars.RSMON_TEST_IMAGE_ALPINE }}
|
|
RSMON_TEST_IMAGE_UBUNTU: ${{ vars.RSMON_TEST_IMAGE_UBUNTU }}
|
|
RSMON_TEST_IMAGE_ARCH: ${{ vars.RSMON_TEST_IMAGE_ARCH }}
|
|
RSMON_TEST_DOCKER_DNS: ${{ vars.RSMON_TEST_DOCKER_DNS }}
|
|
steps:
|
|
# Actions are pinned to immutable full commit SHAs (not moving tags).
|
|
# Verified 2026-08-13 against the GitHub API that the commit the tag
|
|
# points to is a commit object:
|
|
# actions/checkout@v4 -> 11d5960a326750d5838078e36cf38b85af677262
|
|
# actions/setup-go@v5 -> 40f1582b2485089dde7abd97c1529aa768e1baff
|
|
# Other workflows (ci.yml, docker.yml) still use moving tags; see the
|
|
# repo-wide convention note in docs/source-installation.md.
|
|
- name: Check out code
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
|
|
with:
|
|
go-version: '1.26.x'
|
|
# Caches the Go module/build cache used to compile the harness test
|
|
# binary. Safe: only public dependencies, no credentials.
|
|
cache: true
|
|
|
|
- name: Run Alpine/Ubuntu/Arch OpenSSH source-install E2E
|
|
run: bash scripts/ci/test-ssh.sh
|
|
|
|
# Belt-and-suspenders: the harness and test-ssh.sh already tear down
|
|
# everything they create; this guarantees a killed job leaves no
|
|
# rsmon-worker-test-* resources behind on the runner. Filters are
|
|
# anchored to the harness's own prefix and image repository so cleanup
|
|
# never touches a shared base image or unrelated resources.
|
|
- name: Clean up leftover harness resources
|
|
if: always()
|
|
run: |
|
|
docker ps -aq --filter "name=^rsmon-worker-test-" 2>/dev/null | xargs -r docker rm -f >/dev/null 2>&1 || true
|
|
docker network ls -q --filter "name=^rsmon-worker-test-" 2>/dev/null | xargs -r docker network rm >/dev/null 2>&1 || true
|
|
docker images -q --filter "reference=rsmon-worker-test/*" 2>/dev/null | xargs -r docker image rm -f >/dev/null 2>&1 || true
|