Skip to content

Commit 259a5e4

Browse files
claudeclaude
committed
ci: build and publish the secnetperf image
Build msquic's perf tool from source (pinned to a released version) and publish it to ghcr.io/firezone/secnetperf for use by the performance tests in firezone/firezone. A nightly workflow opens a bump PR when msquic publishes a new release. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D5fQ3ZF2TZpZc4h77KMNt5
0 parents  commit 259a5e4

4 files changed

Lines changed: 140 additions & 0 deletions

File tree

‎.github/workflows/bump-msquic.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Bump msquic
2+
on:
3+
schedule:
4+
- cron: "37 3 * * *"
5+
workflow_dispatch:
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
bump:
12+
runs-on: ubuntu-24.04
13+
steps:
14+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
15+
- name: Determine versions
16+
id: versions
17+
env:
18+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
19+
run: |
20+
set -euo pipefail
21+
22+
current=$(grep -oP '^ARG MSQUIC_VERSION=\K.+' Dockerfile)
23+
latest=$(gh api repos/microsoft/msquic/releases/latest --jq .tag_name)
24+
25+
if [[ ! "$latest" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
26+
echo "Unexpected tag format: $latest" >&2
27+
exit 1
28+
fi
29+
30+
{
31+
echo "current=$current"
32+
echo "latest=$latest"
33+
} >> "$GITHUB_OUTPUT"
34+
- name: Open bump PR
35+
if: steps.versions.outputs.current != steps.versions.outputs.latest
36+
env:
37+
GH_TOKEN: ${{ secrets.RELEASE_PR_BOT_GITHUB_TOKEN }}
38+
CURRENT: ${{ steps.versions.outputs.current }}
39+
LATEST: ${{ steps.versions.outputs.latest }}
40+
run: |
41+
set -euo pipefail
42+
43+
branch="chore/bump-msquic-$LATEST"
44+
45+
if [ -n "$(gh pr list --head "$branch" --state open --json number --jq '.[].number')" ]; then
46+
echo "PR for $LATEST is already open; nothing to do."
47+
exit 0
48+
fi
49+
50+
sed -i "s/^ARG MSQUIC_VERSION=.*/ARG MSQUIC_VERSION=$LATEST/" Dockerfile
51+
52+
git config --local user.email "github-bot@firezone.dev"
53+
git config --local user.name "Firezone Bot"
54+
55+
git checkout -b "$branch"
56+
git commit -am "chore: bump msquic to $LATEST"
57+
58+
# The checkout persists the default (read-only) GITHUB_TOKEN as an
59+
# http.extraheader, which git sends regardless of the remote URL's
60+
# embedded credentials. Clear it so the bot token below is actually
61+
# used, letting the PR's checks run (a GITHUB_TOKEN push would not
62+
# trigger them).
63+
git config --local http.https://github.com/.extraheader ""
64+
git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
65+
git push -u origin HEAD --force
66+
67+
gh pr create \
68+
--title "chore: bump msquic to $LATEST" \
69+
--body "Update msquic from $CURRENT to $LATEST: https://github.com/microsoft/msquic/releases/tag/$LATEST" \
70+
--reviewer firezone/engineering

‎.github/workflows/ci.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: CI
2+
on:
3+
pull_request:
4+
push:
5+
branches:
6+
- main
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
build:
14+
runs-on: ubuntu-24.04
15+
permissions:
16+
contents: read
17+
packages: write
18+
steps:
19+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
20+
- name: Read pinned msquic version
21+
id: version
22+
run: echo "msquic=$(grep -oP '^ARG MSQUIC_VERSION=\K.+' Dockerfile)" >> "$GITHUB_OUTPUT"
23+
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
24+
- uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
25+
if: github.ref == 'refs/heads/main'
26+
with:
27+
registry: ghcr.io
28+
username: ${{ github.actor }}
29+
password: ${{ secrets.GITHUB_TOKEN }}
30+
- uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
31+
with:
32+
context: .
33+
push: ${{ github.ref == 'refs/heads/main' }}
34+
tags: |
35+
ghcr.io/firezone/secnetperf:latest
36+
ghcr.io/firezone/secnetperf:${{ steps.version.outputs.msquic }}

‎Dockerfile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
FROM ubuntu:24.04 AS build
2+
3+
ARG MSQUIC_VERSION=v2.5.8
4+
5+
RUN apt-get update \
6+
&& apt-get install -y --no-install-recommends build-essential ca-certificates cmake git perl \
7+
&& rm -rf /var/lib/apt/lists/*
8+
9+
RUN git clone --depth 1 --branch "${MSQUIC_VERSION}" https://github.com/microsoft/msquic /msquic \
10+
&& cd /msquic \
11+
&& git submodule update --init --depth 1 submodules/quictls
12+
13+
WORKDIR /msquic/build
14+
15+
RUN cmake -DCMAKE_BUILD_TYPE=Release -DQUIC_BUILD_PERF=ON .. \
16+
&& cmake --build . --parallel "$(nproc)"
17+
18+
FROM ubuntu:24.04
19+
20+
LABEL org.opencontainers.image.source=https://github.com/firezone/secnetperf
21+
22+
COPY --from=build /msquic/build/bin/Release/secnetperf /usr/local/bin/secnetperf
23+
COPY --from=build /msquic/build/bin/Release/libmsquic.so.2 /usr/local/lib/libmsquic.so.2
24+
25+
RUN ldconfig
26+
27+
CMD ["secnetperf"]

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# secnetperf
2+
3+
Packages [`secnetperf`](https://github.com/microsoft/msquic/tree/main/src/perf), msquic's performance measurement tool, as a container image because the msquic project publishes neither prebuilt binaries nor images for it.
4+
5+
Every push to `main` builds and publishes `ghcr.io/firezone/secnetperf`, tagged `latest` and with the pinned msquic version. A nightly workflow opens a PR to bump the pinned version when msquic publishes a new release.
6+
7+
Used by the performance tests in [firezone/firezone](https://github.com/firezone/firezone).

0 commit comments

Comments
 (0)