Skip to content
aya-ci

build: migrate integration kernels to linux.bzl v0.0.1 #6399

Sign in to view logs

build: migrate integration kernels to linux.bzl v0.0.1

build: migrate integration kernels to linux.bzl v0.0.1 #6399

Workflow file for this run

.github/workflows/ci.yml at 350e7ec
name: aya-ci
on:
push:
pull_request:
schedule:
- cron: 00 4 * * *
env:
CARGO_TERM_COLOR: always
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions: {}
jobs:
bazel:
name: bazel (${{ matrix.os }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os:
- ubuntu-latest
- macos-latest
defaults:
run:
shell: bash
steps:
- uses: actions/checkout@v7
- name: Test
run: |
set -euo pipefail
bazel_args=(
--config=remote
# This key is intentionally public so fork pull requests can use BuildBuddy.
--remote_header=x-buildbuddy-api-key=5CeVmFS0jDnutd00x9Xl
)
bazel test //... "${bazel_args[@]}"
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@nightly
with:
components: clippy,miri,rustfmt,rust-src
# Cache usage approaches GitHub's default 10 GB repository allowance.
# PR-scoped entries can only help reruns of one PR, but repeatedly evict
# main caches that every PR can restore. Keep PRs restore-only.
- uses: Swatinem/rust-cache@v2
with:
save-if: ${{ github.event_name != 'pull_request' }}
- uses: taiki-e/install-action@v2
with:
tool: cargo-hack,taplo-cli,typos-cli
- run: git ls-files -- '*.c' '*.h' | xargs clang-format --dry-run --Werror
- uses: DavidAnson/markdownlint-cli2-action@v24
- run: taplo fmt --check
- run: typos
- run: cargo +nightly fmt --all -- --check
- name: Install libbpf-rs prerequisites
run: |
set -euxo pipefail
sudo apt update
sudo apt -y install autopoint
- run: cargo xtask clippy
# On the `aya-rs/aya` repository, regenerate the public API on a schedule.
#
# On all other events and repositories assert the public API is up to date.
- run: cargo xtask public-api
if: ${{ !(github.event_name == 'schedule' && github.repository == 'aya-rs/aya') }}
- run: cargo xtask public-api --bless
if: ${{ (github.event_name == 'schedule' && github.repository == 'aya-rs/aya') }}
- uses: peter-evans/create-pull-request@v8
if: ${{ (github.event_name == 'schedule' && github.repository == 'aya-rs/aya') }}
with:
# GitHub actions aren't allowed to trigger other actions to prevent
# abuse; the canonical workaround is to use a sufficiently authorized
# token.
#
# See https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#workarounds-to-trigger-further-workflow-runs.
token: ${{ secrets.CRABBY_GITHUB_TOKEN }}
branch: create-pull-request/public-api
commit-message: 'public-api: regenerate'
title: 'public-api: regenerate'
body: |
**Automated changes**
- name: Run miri
run: |
set -euxo pipefail
cargo +nightly hack --locked miri test --all-targets --feature-powerset \
--exclude aya-ebpf \
--exclude aya-ebpf-bindings \
--exclude aya-log-ebpf \
--exclude integration-ebpf \
--exclude integration-test \
--workspace
build-test-aya:
strategy:
fail-fast: false
matrix:
arch:
- aarch64-unknown-linux-gnu
- armv7-unknown-linux-gnueabi
- loongarch64-unknown-linux-gnu
- powerpc64le-unknown-linux-gnu
- riscv64gc-unknown-linux-gnu
- s390x-unknown-linux-gnu
- x86_64-unknown-linux-gnu
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.arch }}
# Cache usage approaches GitHub's default 10 GB repository allowance.
# PR-scoped entries can only help reruns of one PR, but repeatedly evict
# main caches that every PR can restore. Keep PRs restore-only.
- uses: Swatinem/rust-cache@v2
with:
save-if: ${{ github.event_name != 'pull_request' }}
- uses: taiki-e/install-action@cargo-hack
# This is magic, it sets `$CARGO_BUILD_TARGET`.
- uses: taiki-e/setup-cross-toolchain-action@v1
with:
target: ${{ matrix.arch }}
- name: Install libbpf-rs prerequisites
run: |
set -euxo pipefail
sudo apt update
sudo apt -y install autopoint
- name: Build
env:
# Fix for 32-bit ARM: Ubuntu 24.04 GCC defines _TIME_BITS=64 as a built-in,
# which requires _FILE_OFFSET_BITS=64 (glibc requirement). We must unset
# _TIME_BITS first because the built-in is seen before -D flags by libbpf-sys.
CFLAGS_armv7_unknown_linux_gnueabi: "-U_TIME_BITS -D_FILE_OFFSET_BITS=64"
run: |
set -euxo pipefail
cargo hack --locked build --all-targets --feature-powerset \
--exclude aya-ebpf \
--exclude aya-ebpf-bindings \
--exclude aya-log-ebpf \
--exclude integration-ebpf \
--exclude xtask \
--workspace
- name: Test
env:
RUST_BACKTRACE: full
run: |
set -euxo pipefail
cargo hack --locked test --all-targets \
--exclude aya-ebpf \
--exclude aya-ebpf-bindings \
--exclude aya-log-ebpf \
--exclude integration-ebpf \
--exclude integration-test \
--feature-powerset
- name: Doctests
env:
RUST_BACKTRACE: full
run: |
set -euxo pipefail
cargo hack --locked test --doc \
--exclude aya-ebpf \
--exclude aya-ebpf-bindings \
--exclude aya-log-ebpf \
--exclude integration-ebpf \
--exclude integration-test \
--feature-powerset
build-test-aya-ebpf:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@nightly
with:
components: rust-src
# Installed *after* nightly so it is the default.
- uses: dtolnay/rust-toolchain@stable
# Cache usage approaches GitHub's default 10 GB repository allowance.
# PR-scoped entries can only help reruns of one PR, but repeatedly evict
# main caches that every PR can restore. Keep PRs restore-only.
- uses: Swatinem/rust-cache@v2
with:
save-if: ${{ github.event_name != 'pull_request' }}
- uses: taiki-e/install-action@v2
with:
tool: cargo-binstall,cargo-hack
- run: cargo binstall --force bpf-linker
- name: Build & test for all BPF architectures
env:
RUST_BACKTRACE: full
run: |
set -euo pipefail
failures=()
# NB: this hand-rolled shell script is used instead of a matrix
# because the time spent doing useful work per target is about equal
# to the overhead of setting up the job - so this saves a bunch of
# machine time.
for arch in aarch64 arm loongarch64 mips mips64 powerpc64 riscv64 s390x x86_64; do
echo "::group::arch=$arch"
export RUSTFLAGS="--cfg bpf_target_arch=\"$arch\""
for target in bpfeb-unknown-none bpfel-unknown-none; do
echo "::group::target=$target"
if ! (
cargo +nightly hack --locked build \
--release \
--target "$target" \
-Z build-std=core \
--package aya-ebpf \
--package aya-ebpf-bindings \
--package aya-log-ebpf \
--package integration-ebpf \
--feature-powerset
); then
failures+=("build: $arch/$target")
fi
echo "::endgroup::"
done
if ! (
RUSTDOCFLAGS=$RUSTFLAGS cargo +nightly hack --locked test --doc \
--package aya-ebpf \
--package aya-ebpf-bindings \
--package aya-log-ebpf \
--package integration-ebpf \
--feature-powerset
); then
failures+=("doctests: $arch")
fi
echo "::endgroup::"
done
if ((${#failures[@]})); then
echo "::error::Some builds/tests failed:"
printf ' %s\n' "${failures[@]}"
exit 1
fi
run-integration-test:
strategy:
fail-fast: false
matrix:
# We don't have a fast solution for running virtualized integration
# tests on arm64 because:
# - GitHub Ubuntu arm64 runners don't support nested virtualization (see
# https://github.com/orgs/community/discussions/148648#discussioncomment-11863547).
# - GitHub macOS arm64 runners don't support nested virtualization (see
# https://docs.github.com/en/actions/reference/runners/github-hosted-runners#limitations-for-arm64-macos-runners).
#
# So we spin a runner for every arm64 kernel to avoid waiting 20 minutes
# for CI. We use arm64 runners to avoid cross-compilation.
os:
- ubuntu-24.04-arm
vm-kernels:
- arm64 5.10
- arm64 5.15
- arm64 6.1
- arm64 6.6
- arm64 6.12
- arm64 6.18
skip-local:
- true
include:
- os: macos-latest
# Just one kernel to keep things fast. We just want to keep things from rotting on
# macOS. We use amd64 because otherwise qemu tries to use HVF and hits a hard error:
# qemu-system-aarch64: -accel hvf: Error: ret = HV_UNSUPPORTED (0xfae9400f, at ../target/arm/hvf/hvf.c:956)
vm-kernels: amd64 5.10
# We don't use ubuntu-latest because we care about the apt packages available.
- os: ubuntu-24.04
vm-kernels: amd64 5.10 5.15 6.1 6.6 6.12 6.18
- os: ubuntu-24.04-arm
# Native arm runner for local tests only; arm runners don't support
# nested virtualization so running them here would be slow.
vm-kernels: local
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v7
with:
submodules: recursive
- name: Install prerequisites
if: runner.os == 'Linux'
run: |
set -euxo pipefail
# https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
sudo udevadm control --reload-rules
sudo udevadm trigger --name-match=kvm || true # kvm is not available on arm64.
sudo apt update
# linux-libc-dev provides kernel UAPI headers for libbpf-sys cross-compilation.
#
# llvm provides llvm-objcopy for integration tests.
#
# See https://github.com/libbpf/libbpf-sys/issues/137.
sudo apt -y install \
autopoint \
linux-libc-dev \
liblzma-dev \
llvm \
musl-tools \
qemu-system-{arm,x86}
- name: Install prerequisites
if: runner.os == 'macOS'
run: |
set -euxo pipefail
# Dependencies are tracked in `Brewfile`.
brew trust --formula filosottile/musl-cross/musl-cross
brew bundle
echo $(brew --prefix llvm)/bin >> $GITHUB_PATH
# https://github.com/actions/setup-python/issues/577
find /usr/local/bin -type l -exec sh -c 'readlink -f "$1" \
| grep -q ^/Library/Frameworks/Python.framework/Versions/' _ {} \; -exec rm -v {} \;
- uses: dtolnay/rust-toolchain@nightly
with:
components: rust-src
# Installed *after* nightly so it is the default.
- uses: dtolnay/rust-toolchain@stable
with:
targets: aarch64-unknown-linux-musl,x86_64-unknown-linux-musl
# Cache usage approaches GitHub's default 10 GB repository allowance.
# PR-scoped entries can only help reruns of one PR, but repeatedly evict
# main caches that every PR can restore. Keep PRs restore-only.
- uses: Swatinem/rust-cache@v2
with:
save-if: ${{ github.event_name != 'pull_request' }}
- uses: taiki-e/install-action@v2
with:
tool: cargo-binstall,cargo-hack
- run: cargo binstall --force bpf-linker
- name: Restore VM integration test cache
id: vm-cache
# `local` is the native arm64 test job; it does not run a VM or
# populate the VM cache directory.
if: matrix.vm-kernels != 'local'
uses: actions/cache/restore@v6
with:
path: test/.tmp
key: ${{ runner.arch }}-${{ runner.os }}-integration-test-vm-cache-v2-${{ matrix.vm-kernels }}
- name: Cleanup stale kernels and modules
run: rm -rf test/.tmp/boot test/.tmp/lib
- name: Run local integration tests
if: runner.os == 'Linux' && matrix.skip-local != true
run: cargo xtask integration-test local
- name: Run virtualized integration tests
if: matrix.vm-kernels != 'local'
run: |
set -euxo pipefail
cargo xtask integration-test vm --cache-dir test/.tmp \
--kernel-arch ${{ matrix.vm-kernels }}
- name: Save VM integration test cache
# By default, caches expire after seven days without access.
# An exact hit refreshes that period, so the immutable entry need not
# be uploaded again.
# The native arm64 `local` job produces no VM cache artifacts to save.
if: >-
matrix.vm-kernels != 'local' &&
steps.vm-cache.outputs.cache-hit != 'true' &&
github.event_name != 'pull_request'
uses: actions/cache/save@v6
with:
path: test/.tmp
key: ${{ runner.arch }}-${{ runner.os }}-integration-test-vm-cache-v2-${{ matrix.vm-kernels }}
check:
if: always()
needs:
- bazel
- lint
- build-test-aya
- build-test-aya-ebpf
- run-integration-test
runs-on: ubuntu-latest
steps:
- uses: re-actors/alls-green@release/v1
with:
jobs: ${{ toJSON(needs) }}