ci: extract inlined smoke scripts into scripts/ci/

loks0n · claude · loks0n · commit 22fb860fef44 · 2026-06-05T11:33:27.000+01:00
Move the multi-line bash blocks (Sury PHP install, NTS/ZTS/Pyroscope smoke
tests) out of ci.yml into dedicated, shellcheck-clean scripts under
scripts/ci/, with a shared spin.php fixture. ci.yml steps now just invoke
them, and the scripts are runnable locally.

Fixes a latent bug carried over from the inlined version: `! grep -q
'push failed'` is exempt from `set -e`, so a push failure never failed the
job; replaced with an explicit conditional.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -105,41 +105,12 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           key: ${{ matrix.target }}-smoke
-      - name: install Sury PHP 8.3
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            curl ca-certificates gnupg lsb-release
-          curl -sSLo /tmp/sury.gpg https://packages.sury.org/php/apt.gpg
-          sudo install -m 644 /tmp/sury.gpg /usr/share/keyrings/sury.gpg
-          . /etc/os-release
-          echo "deb [signed-by=/usr/share/keyrings/sury.gpg] https://packages.sury.org/php/ ${VERSION_CODENAME} main" \
-            | sudo tee /etc/apt/sources.list.d/sury.list
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends php8.3-cli
+      - name: install PHP
+        run: ./scripts/ci/install-php.sh
       - name: build
         run: cargo build --release --target ${{ matrix.target }}
-      - name: allow ptrace
-        run: |
-          echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope || true
       - name: smoke
-        run: |
-          cat > /tmp/spin.php <<'PHP'
-          <?php
-          class W { public function spin(): never { while (true) $this->a(); }
-          public function a(): void { $this->b(); }
-          public function b(): void { usleep(500); } }
-          (new W())->spin();
-          PHP
-          php8.3 /tmp/spin.php &
-          PID=$!
-          sleep 1
-          ./target/${{ matrix.target }}/release/pfp -p $PID -d 2 -H 99 -o /tmp/out.txt
-          kill $PID || true
-          wait || true
-          test "$(grep -c '^0 ' /tmp/out.txt)" -ge 100
-          grep -q 'W::a' /tmp/out.txt
-          grep -q 'W::b' /tmp/out.txt
+        run: ./scripts/ci/smoke.sh ./target/${{ matrix.target }}/release/pfp
 
   smoke-zts:
     name: smoke-zts (${{ matrix.target }})
@@ -167,38 +138,7 @@ jobs:
       - name: build
         run: cargo build --release --target ${{ matrix.target }}
       - name: smoke (ZTS)
-        # Run the ZTS PHP inside the official php:X.Y-zts image (the only
-        # convenient source of prebuilt ZTS binaries — Sury doesn't ship
-        # them). pfp runs inside the same container so we don't need to
-        # plumb pid namespaces between host and container.
-        run: |
-          cat > /tmp/spin.php <<'PHP'
-          <?php
-          class W { public function spin(): never { while (true) $this->a(); }
-          public function a(): void { $this->b(); }
-          public function b(): void { usleep(500); } }
-          (new W())->spin();
-          PHP
-          BIN=./target/${{ matrix.target }}/release/pfp
-          docker run -d --name php-zts \
-            --cap-add=SYS_PTRACE \
-            -v /tmp/spin.php:/spin.php:ro \
-            -v "$(realpath $BIN):/pfp:ro" \
-            ${{ matrix.php_image }} \
-            php /spin.php
-          sleep 1
-          docker exec php-zts php -i 2>/dev/null | grep -i 'thread safety' \
-            | grep -qi enabled
-          # php is the container's PID 1 — the docker-php-entrypoint execs
-          # the command — and the php:*-zts image ships no pgrep (no procps).
-          PHP_PID=1
-          docker exec php-zts /pfp -p "$PHP_PID" -d 2 -H 99 -o /tmp/out.txt
-          OUT=$(docker exec php-zts cat /tmp/out.txt)
-          docker rm -f php-zts
-          echo "$OUT" | head -20
-          test "$(echo "$OUT" | grep -c '^0 ')" -ge 100
-          echo "$OUT" | grep -q 'W::a'
-          echo "$OUT" | grep -q 'W::b'
+        run: ./scripts/ci/smoke-zts.sh ./target/${{ matrix.target }}/release/pfp ${{ matrix.php_image }}
 
   smoke-pyroscope:
     name: smoke-pyroscope
@@ -218,66 +158,9 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           key: x86_64-unknown-linux-gnu-smoke-pyroscope
-      - name: install Sury PHP 8.3
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            curl ca-certificates gnupg lsb-release
-          curl -sSLo /tmp/sury.gpg https://packages.sury.org/php/apt.gpg
-          sudo install -m 644 /tmp/sury.gpg /usr/share/keyrings/sury.gpg
-          . /etc/os-release
-          echo "deb [signed-by=/usr/share/keyrings/sury.gpg] https://packages.sury.org/php/ ${VERSION_CODENAME} main" \
-            | sudo tee /etc/apt/sources.list.d/sury.list
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends php8.3-cli
+      - name: install PHP
+        run: ./scripts/ci/install-php.sh
       - name: build
         run: cargo build --release
-      - name: allow ptrace
-        run: echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope || true
-      - name: push profiles to pyroscope and query them back
-        run: |
-          set -euo pipefail
-          cat > /tmp/spin.php <<'PHP'
-          <?php
-          class W { public function spin(): never { while (true) $this->a(); }
-          public function a(): void { $this->b(); }
-          public function b(): void { usleep(500); } }
-          (new W())->spin();
-          PHP
-          php8.3 /tmp/spin.php &
-          PHP_PID=$!
-          sleep 1
-          # Run pfp continuously in sidecar/push mode; keep pushing while we poll.
-          RUST_LOG=pfp=debug ./target/release/pfp \
-            -p "$PHP_PID" --pyroscope-url http://localhost:4040 \
-            --pyroscope-app pfp-smoke --push-interval-secs 2 -H 99 \
-            > /tmp/pfp.log 2>&1 &
-          PFP_PID=$!
-
-          # 1) Hard gate: pfp attached and pushed without errors. Pyroscope
-          #    answers /ingest with 422 on a malformed pprof (which the sink
-          #    logs as "push failed"), so a clean push proves the profile was
-          #    parsed and accepted end-to-end by the server.
-          sleep 12
-          cat /tmp/pfp.log
-          grep -q 'attached pid=' /tmp/pfp.log
-          grep -q 'pushed profile to pyroscope' /tmp/pfp.log
-          ! grep -q 'push failed' /tmp/pfp.log
-
-          # 2) Best-effort: confirm the profile is queryable with our PHP frames.
-          #    Pyroscope's ingest->queryable lag is timing-dependent, so this is
-          #    logged but does not gate the job (the push gate above is the
-          #    deterministic e2e signal).
-          for i in $(seq 1 30); do
-            now=$(date +%s%3N); from=$((now - 600000))
-            body=$(printf '{"profile_typeID":"process_cpu:samples:count::","label_selector":"{service_name=\\"pfp-smoke\\"}","start":%s,"end":%s}' "$from" "$now")
-            names=$(curl -s -X POST \
-              http://localhost:4040/querier.v1.QuerierService/SelectMergeStacktraces \
-              -H 'Content-Type: application/json' -d "$body" \
-              | python3 -c 'import sys,json; print("\n".join(json.load(sys.stdin).get("flamegraph",{}).get("names",[])))' 2>/dev/null || true)
-            if echo "$names" | grep -q 'W::a' && echo "$names" | grep -q 'W::b'; then
-              echo "queried PHP frames back from pyroscope:"; echo "$names"; break
-            fi
-            sleep 3
-          done
-          kill "$PFP_PID" "$PHP_PID" 2>/dev/null || true
+      - name: smoke (pyroscope)
+        run: ./scripts/ci/smoke-pyroscope.sh ./target/release/pfp
diff --git a/scripts/ci/install-php.sh b/scripts/ci/install-php.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Install the Sury-packaged PHP 8.3 CLI on a Debian/Ubuntu runner.
+set -euo pipefail
+
+sudo apt-get update
+sudo apt-get install -y --no-install-recommends \
+  curl ca-certificates gnupg lsb-release
+curl -sSLo /tmp/sury.gpg https://packages.sury.org/php/apt.gpg
+sudo install -m 644 /tmp/sury.gpg /usr/share/keyrings/sury.gpg
+# shellcheck disable=SC1091  # runtime file, not present at lint time
+. /etc/os-release
+echo "deb [signed-by=/usr/share/keyrings/sury.gpg] https://packages.sury.org/php/ ${VERSION_CODENAME} main" \
+  | sudo tee /etc/apt/sources.list.d/sury.list
+sudo apt-get update
+sudo apt-get install -y --no-install-recommends php8.3-cli
diff --git a/scripts/ci/smoke-pyroscope.sh b/scripts/ci/smoke-pyroscope.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# End-to-end test of continuous Pyroscope export: run pfp in push mode against a
+# live PHP and a Pyroscope server.
+#
+# Usage: scripts/ci/smoke-pyroscope.sh <pfp-binary> [pyroscope-url]
+set -euo pipefail
+
+PFP=${1:?usage: smoke-pyroscope.sh <pfp-binary> [pyroscope-url]}
+URL=${2:-http://localhost:4040}
+here=$(cd "$(dirname "$0")" && pwd)
+
+echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope >/dev/null || true
+
+php8.3 "$here/spin.php" &
+PHP_PID=$!
+# Run pfp continuously in sidecar/push mode; keep pushing while we poll.
+RUST_LOG=pfp=debug "$PFP" -p "$PHP_PID" --pyroscope-url "$URL" \
+  --pyroscope-app pfp-smoke --push-interval-secs 2 -H 99 \
+  > /tmp/pfp.log 2>&1 &
+PFP_PID=$!
+trap 'kill "$PFP_PID" "$PHP_PID" 2>/dev/null || true' EXIT
+
+# 1) Hard gate: pfp attached and pushed without errors. Pyroscope answers
+#    /ingest with 422 on a malformed pprof (which the sink logs as "push
+#    failed"), so a clean push proves the profile was parsed and accepted
+#    end-to-end by the server.
+sleep 12
+cat /tmp/pfp.log
+grep -q 'attached pid=' /tmp/pfp.log
+grep -q 'pushed profile to pyroscope' /tmp/pfp.log
+if grep -q 'push failed' /tmp/pfp.log; then
+  echo "pfp reported push failures" >&2
+  exit 1
+fi
+
+# 2) Best-effort: confirm the profile is queryable with our PHP frames.
+#    Pyroscope's ingest->queryable lag is timing-dependent, so this is logged
+#    but does not gate the job (the push gate above is the deterministic
+#    e2e signal).
+for _ in $(seq 1 30); do
+  now=$(date +%s%3N)
+  from=$((now - 600000))
+  body=$(printf '{"profile_typeID":"process_cpu:samples:count::","label_selector":"{service_name=\\"pfp-smoke\\"}","start":%s,"end":%s}' "$from" "$now")
+  names=$(curl -s -X POST "$URL/querier.v1.QuerierService/SelectMergeStacktraces" \
+    -H 'Content-Type: application/json' -d "$body" \
+    | python3 -c 'import sys,json; print("\n".join(json.load(sys.stdin).get("flamegraph",{}).get("names",[])))' 2>/dev/null || true)
+  if echo "$names" | grep -q 'W::a' && echo "$names" | grep -q 'W::b'; then
+    echo "queried PHP frames back from pyroscope:"
+    echo "$names"
+    break
+  fi
+  sleep 3
+done
diff --git a/scripts/ci/smoke-zts.sh b/scripts/ci/smoke-zts.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Smoke test against a ZTS PHP. Runs the ZTS PHP inside the official php:X.Y-zts
+# image (the only convenient source of prebuilt ZTS binaries — Sury doesn't ship
+# them); pfp runs inside the same container so there's no pid-namespace plumbing
+# between host and container.
+#
+# Usage: scripts/ci/smoke-zts.sh <pfp-binary> <php-zts-image>
+set -euo pipefail
+
+PFP=${1:?usage: smoke-zts.sh <pfp-binary> <php-zts-image>}
+IMAGE=${2:?usage: smoke-zts.sh <pfp-binary> <php-zts-image>}
+spin=$(cd "$(dirname "$0")" && pwd)/spin.php
+
+docker run -d --name php-zts --cap-add=SYS_PTRACE \
+  -v "$spin:/spin.php:ro" \
+  -v "$(realpath "$PFP"):/pfp:ro" \
+  "$IMAGE" php /spin.php
+trap 'docker rm -f php-zts >/dev/null 2>&1 || true' EXIT
+sleep 1
+
+docker exec php-zts php -i 2>/dev/null | grep -i 'thread safety' | grep -qi enabled
+# php is the container's PID 1 — the docker-php-entrypoint execs the command —
+# and the php:*-zts image ships no pgrep (no procps).
+docker exec php-zts /pfp -p 1 -d 2 -H 99 -o /tmp/out.txt
+OUT=$(docker exec php-zts cat /tmp/out.txt)
+
+echo "$OUT" | head -20
+test "$(echo "$OUT" | grep -c '^0 ')" -ge 100
+echo "$OUT" | grep -q 'W::a'
+echo "$OUT" | grep -q 'W::b'
diff --git a/scripts/ci/smoke.sh b/scripts/ci/smoke.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Smoke test against a live NTS PHP 8.3: profile a busy loop and assert the
+# named frames show up.
+#
+# Usage: scripts/ci/smoke.sh <pfp-binary>
+set -euo pipefail
+
+PFP=${1:?usage: smoke.sh <pfp-binary>}
+here=$(cd "$(dirname "$0")" && pwd)
+
+# Same-UID process_vm_readv needs ptrace_scope relaxed on the runner.
+echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope >/dev/null || true
+
+php8.3 "$here/spin.php" &
+PID=$!
+trap 'kill "$PID" 2>/dev/null || true' EXIT
+sleep 1
+
+"$PFP" -p "$PID" -d 2 -H 99 -o /tmp/out.txt
+
+test "$(grep -c '^0 ' /tmp/out.txt)" -ge 100
+grep -q 'W::a' /tmp/out.txt
+grep -q 'W::b' /tmp/out.txt
diff --git a/scripts/ci/spin.php b/scripts/ci/spin.php
@@ -0,0 +1,9 @@
+<?php
+// A tiny, deterministic CPU-busy workload for the smoke tests: a known class
+// (W) with named methods (a/b) so we can assert the profiler captured them.
+class W {
+    public function spin(): never { while (true) $this->a(); }
+    public function a(): void { $this->b(); }
+    public function b(): void { usleep(500); }
+}
+(new W())->spin();
