main.yml

name: CI

on: [push, pull_request]

env:
  DEVELOPER: 1

# If more than one workflow run is triggered for the very same commit hash
# (which happens when multiple branches pointing to the same commit), only
# the first one is allowed to run, the second will be kept in the "queued"
# state. This allows a successful completion of the first run to be reused
# in the second run via the `skip-if-redundant` logic in the `config` job.
#
# The only caveat is that if a workflow run is triggered for the same commit
# hash that another run is already being held, that latter run will be
# canceled. For more details about the `concurrency` attribute, see:
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#concurrency
concurrency:
  group: ${{ github.sha }}

jobs:
  ci-config:
    name: config
    if: vars.CI_BRANCHES == '' || contains(vars.CI_BRANCHES, github.ref_name)
    runs-on: ubuntu-latest
    outputs:
      enabled: ${{ steps.check-ref.outputs.enabled }}${{ steps.skip-if-redundant.outputs.enabled }}
      skip_concurrent: ${{ steps.check-ref.outputs.skip_concurrent }}
    steps:
      - name: try to clone ci-config branch
        run: |
          git -c protocol.version=2 clone \
            --no-tags \
            --single-branch \
            -b ci-config \
            --depth 1 \
            --no-checkout \
            --filter=blob:none \
            https://github.com/${{ github.repository }} \
            config-repo &&
          cd config-repo &&
          git checkout HEAD -- ci/config || : ignore
      - id: check-ref
        name: check whether CI is enabled for ref
        run: |
          enabled=yes
          if test -x config-repo/ci/config/allow-ref
          then
            echo "::warning::ci/config/allow-ref is deprecated; use CI_BRANCHES instead"
            if ! config-repo/ci/config/allow-ref '${{ github.ref }}'
            then
              enabled=no
            fi
          fi

          skip_concurrent=yes
          if test -x config-repo/ci/config/skip-concurrent &&
             ! config-repo/ci/config/skip-concurrent '${{ github.ref }}'
          then
            skip_concurrent=no
          fi
          echo "enabled=$enabled" >>$GITHUB_OUTPUT
          echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT
      - name: skip if the commit or tree was already tested
        id: skip-if-redundant
        uses: actions/github-script@v8
        if: steps.check-ref.outputs.enabled == 'yes'
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            try {
              // Figure out workflow ID, commit and tree
              const { data: run } = await github.rest.actions.getWorkflowRun({
                owner: context.repo.owner,
                repo: context.repo.repo,
                run_id: context.runId,
              });
              const workflow_id = run.workflow_id;
              const head_sha = run.head_sha;
              const tree_id = run.head_commit.tree_id;

              // See whether there is a successful run for that commit or tree
              const { data: runs } = await github.rest.actions.listWorkflowRuns({
                owner: context.repo.owner,
                repo: context.repo.repo,
                per_page: 500,
                status: 'success',
                workflow_id,
              });
              for (const run of runs.workflow_runs) {
                if (head_sha === run.head_sha) {
                  core.warning(`Successful run for the commit ${head_sha}: ${run.html_url}`);
                  core.setOutput('enabled', ' but skip');
                  break;
                }
                if (run.head_commit && tree_id === run.head_commit.tree_id) {
                  core.warning(`Successful run for the tree ${tree_id}: ${run.html_url}`);
                  core.setOutput('enabled', ' but skip');
                  break;
                }
              }
            } catch (e) {
              core.warning(e);
            }
  dockerized:
    name: ${{matrix.vector.jobname}} (${{matrix.vector.image}})
    needs: ci-config
    if: needs.ci-config.outputs.enabled == 'yes'
    concurrency:
      group: dockerized-${{ matrix.vector.jobname }}-${{ matrix.vector.image }}-${{ github.ref }}
      cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
    strategy:
      fail-fast: false
      matrix:
        vector:
        - jobname: linux-leaks
          image: ubuntu:rolling
          cc: gcc
        - jobname: linux-reftable-leaks
          image: ubuntu:rolling
          cc: gcc
    env:
      jobname: ${{matrix.vector.jobname}}
      CC: ${{matrix.vector.cc}}
      CI_JOB_IMAGE: ${{matrix.vector.image}}
      CUSTOM_PATH: /custom
    runs-on: ubuntu-latest
    container: ${{matrix.vector.image}}
    steps:
    - name: prepare libc6 for actions
      if: matrix.vector.jobname == 'linux32'
      run: apt -q update && apt -q -y install libc6-amd64 lib64stdc++6
    - name: install git in container
      run: |
        if command -v git
        then
          : # nothing to do
        elif command -v apk
        then
          apk add --update git
        elif command -v dnf
        then
          dnf -yq update && dnf -yq install git
        else
          apt-get -q update && apt-get -q -y install git
        fi
    - uses: actions/checkout@v5
    - run: ci/install-dependencies.sh
    - run: useradd builder --create-home
    - run: chown -R builder .
    - run: chmod a+w $GITHUB_ENV && sudo --preserve-env --set-home --user=builder ci/run-build-and-tests.sh
    - name: print test failures
      if: failure() && env.FAILED_TEST_ARTIFACTS != ''
      run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh
    - name: Upload failed tests' directories
      if: failure() && env.FAILED_TEST_ARTIFACTS != ''
      uses: actions/upload-artifact@v5
      with:
        name: failed-tests-${{matrix.vector.jobname}}
        path: ${{env.FAILED_TEST_ARTIFACTS}}