proxy/.github/workflows/ci-tests.yaml at main · cilium/proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
name: CI run integration tests
on:
  pull_request: {}

# By specifying the access of one of the scopes, all of those that are not specified are set to 'none'.
permissions:
  # To be able to access the repository with actions/checkout
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
  cancel-in-progress: true

jobs:
  proxylib:
    timeout-minutes: 360
    name: Run unit tests for proxylib
    runs-on: ubuntu-latest
    steps:
    - name: Install Go
      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
      with:
        # renovate: datasource=golang-version depName=go
        go-version: 1.26.5
    - name: Checkout code
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        persist-credentials: false
    - name: Check module vendoring
      run: |
        go mod tidy
        go mod vendor
        test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
    - name: Run unit tests
      run: |
        make -C proxylib test

  tests:
    timeout-minutes: 360
    name: Run integration tests on amd64
    runs-on: ${{ vars.PROXY_BUILD_GITHUB_RUNNER || 'oracle-vm-32cpu-128gb-x86-64' }}
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Cache Docker layers
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /tmp/buildx-cache
          key: docker-cache-tests
          restore-keys: docker-cache-main

      - name: Checkout PR Source Code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Prep for build
        run: |
          echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION
          echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder | awk '{ print $3 }')" >> $GITHUB_ENV

      - name: Wait for build image
        uses: ./.github/workflows/wait-for-image
        with:
          SHA: ${{ env.BUILDER_DOCKER_HASH }}
          repo: cilium
          images: cilium-envoy-builder-dev

      - name: Run integration tests on amd64
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        id: docker_tests_ci
        with:
          provenance: false
          context: .
          file: ./Dockerfile.tests
          platforms: linux/amd64
          build-args: |
            BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
            ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
            BAZEL_BUILD_OPTS=--remote_upload_local_results=false
            BAZEL_TEST_OPTS=--jobs=HOST_RAM*.0002 --test_timeout=300 --local_test_jobs=4 --flaky_test_attempts=3
          cache-from: type=local,src=/tmp/buildx-cache
          push: false

  asan-tests:
    timeout-minutes: 360
    name: Run ASAN integration tests on amd64
    runs-on: ${{ vars.PROXY_BUILD_GITHUB_RUNNER || 'oracle-vm-32cpu-128gb-x86-64' }}
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Cache Docker layers
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /tmp/buildx-cache
          key: docker-cache-tests-asan
          restore-keys: docker-cache-tests

      - name: Checkout PR Source Code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Prep for build
        run: |
          echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION
          echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder | awk '{ print $3 }')" >> $GITHUB_ENV

      - name: Wait for build image
        uses: ./.github/workflows/wait-for-image
        with:
          SHA: ${{ env.BUILDER_DOCKER_HASH }}
          repo: cilium
          images: cilium-envoy-builder-dev

      - name: Run ASAN integration tests on amd64
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        id: docker_asan_tests_ci
        with:
          provenance: false
          context: .
          file: ./Dockerfile.tests
          platforms: linux/amd64
          build-args: |
            BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
            ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
            DEBUG=1
            BAZEL_BUILD_OPTS=--remote_upload_local_results=false --config=asan --config=clang-asan
            BAZEL_TEST_OPTS=--jobs=HOST_RAM*.0001 --test_timeout=600 --local_test_jobs=2 --flaky_test_attempts=1 --noshow_progress --noshow_loading_progress
          cache-from: type=local,src=/tmp/buildx-cache
          push: false

  msan-tests:
    timeout-minutes: 360
    name: Run MSAN integration tests on amd64
    runs-on: ${{ vars.PROXY_BUILD_GITHUB_RUNNER || 'oracle-vm-32cpu-128gb-x86-64' }}
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Cache Docker layers
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: /tmp/buildx-cache
          key: docker-cache-tests-msan
          restore-keys: docker-cache-tests

      - name: Checkout PR Source Code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Prep for build
        run: |
          echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION
          echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder | awk '{ print $3 }')" >> $GITHUB_ENV

      - name: Wait for build image
        uses: ./.github/workflows/wait-for-image
        with:
          SHA: ${{ env.BUILDER_DOCKER_HASH }}
          repo: cilium
          images: cilium-envoy-builder-dev

      - name: Run MSAN integration tests on amd64
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        id: docker_msan_tests_ci
        with:
          provenance: false
          context: .
          file: ./Dockerfile.tests
          platforms: linux/amd64
          build-args: |
            BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
            PROXYLIB_BUILDER=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
            PROXYLIB_CC=/usr/lib/llvm-18/bin/clang
            PROXYLIB_GO_BUILD_FLAGS=-msan -buildvcs=false
            PROXYLIB_GOCACHE=/tmp/go-build
            ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
            DEBUG=1
            BAZEL_BUILD_OPTS=--config=msan --remote_upload_local_results=false
            BAZEL_TEST_OPTS=--jobs=HOST_RAM*.00005 --test_timeout=900 --local_test_jobs=1 --notest_keep_going --flaky_test_attempts=1 --noshow_progress --noshow_loading_progress --test_env=MSAN_SYMBOLIZER_PATH=/usr/lib/llvm-18/bin/llvm-symbolizer
          cache-from: type=local,src=/tmp/buildx-cache
          push: false