.github/workflows/ci.yml - master - githubmirror/authselect

.github/workflows/ci.yml
344 строки10 KB
Pavel Březina
ci: do not test on centos-10
28 май 2026, 15:08
28 май 2026, 15:085d19bdc
name: "ci"
on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  system:
    strategy:
      fail-fast: false
      matrix:
        tag:
        - rawhide
        - fedora-latest
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - uses: actions/setup-python@v5
      with:
        python-version: 3.11

    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        path: authselect

    - name: Setup containers
      uses: SSSD/sssd-ci-containers/actions/setup@master
      with:
        path: sssd-ci-containers
        tag: ${{ matrix.tag }}
        override: |
          services:
            client:
              image: ${REGISTRY}/ci-client-devel:${TAG}
              shm_size: 4G
              tmpfs:
              - /dev/shm
              volumes:
              - ../authselect:/authselect:rw

    - name: Install build dependencies on the client
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: dependencies.log
        working-directory: /authselect
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex

          scripts/auto install-build-deps

    - name: Build authselect on the client
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: build.log
        working-directory: /authselect
        where: client
        script: |
          #!/bin/bash
          set -ex

          autoreconf -if && ./configure --enable-silent-rules
          make rpms

    - name: Install authselect on the client
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: install.log
        working-directory: /authselect
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex

          dnf install -y rpmbuild/RPMS/*/*.rpm

    - name: Install system tests dependencies
      shell: bash
      working-directory: ./authselect/src/tests/system
      run: |
        set -ex

        sudo apt-get update

        # Install dependencies for python-ldap
        sudo apt-get install -y libsasl2-dev python3-dev libldap2-dev libssl-dev

        # Virtualenv
        pip3 install virtualenv
        python3 -m venv .venv
        source .venv/bin/activate

        # Install system tests requirements
        pip3 install -r ./requirements.txt

        # Install yq to parse yaml files
        sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
        sudo chmod a+x /usr/local/bin/yq

    - name: Remove ad from mhc.yaml
      shell: bash
      working-directory: ./authselect/src/tests/system
      run: |
        yq -i 'del(.domains[0].hosts.[] | select(.role == "ad"))' mhc.yaml

    - name: Check polarion metadata
      shell: bash
      working-directory: ./authselect/src/tests/system
      run: |
        # Run pytest in collect only mode to quickly catch issues in Polarion metadata.
        set -ex -o pipefail

        mkdir -p $GITHUB_WORKSPACE/artifacts
        source .venv/bin/activate
        pytest \
          --color=yes \
          --mh-config=./mhc.yaml \
          --mh-artifacts-dir=$GITHUB_WORKSPACE/artifacts \
          --polarion-config=./polarion.yaml \
          --output-polarion-testcase=$GITHUB_WORKSPACE/artifacts/testcase.xml \
          --collect-only . |& tee $GITHUB_WORKSPACE/pytest-collect.log

    - name: Run tests
      shell: bash
      working-directory: ./authselect/src/tests/system
      run: |
        set -ex -o pipefail

        mkdir -p $GITHUB_WORKSPACE/artifacts
        source .venv/bin/activate
        pytest \
          --color=yes \
          --show-capture=no \
          --mh-config=./mhc.yaml \
          --mh-artifacts-dir=$GITHUB_WORKSPACE/artifacts \
          --polarion-config=./polarion.yaml \
          --output-polarion-testcase=$GITHUB_WORKSPACE/artifacts/testcase.xml \
          --output-polarion-testrun=$GITHUB_WORKSPACE/artifacts/testrun.xml \
          -vvv . |& tee $GITHUB_WORKSPACE/pytest.log

    - name: Upload artifacts
      if: always()
      uses: actions/upload-artifact@v4
      with:
        if-no-files-found: ignore
        name: ${{ matrix.tag }}-system
        path: |
          artifacts
          dependencies.log
          build.log
          install.log
          pytest.log
          pytest-collect.log

  ostree:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        path: authselect

    - name: Setup containers
      uses: SSSD/sssd-ci-containers/actions/setup@master
      with:
        path: sssd-ci-containers
        tag: rawhide
        override: |
          services:
            client:
              image: ${REGISTRY}/ci-client-devel:${TAG}
              shm_size: 4G
              tmpfs:
              - /dev/shm
              volumes:
              - ../authselect:/authselect:rw

    - name: Create ostree marker (mimic required ostree detection)
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex
          mkdir -p /run
          touch /run/ostree-booted

    - name: Install build dependencies on the client
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: ostree-dependencies.log
        working-directory: /authselect
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex

          scripts/auto install-build-deps

    - name: Build authselect RPMs on the client
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: ostree-build.log
        working-directory: /authselect
        where: client
        script: |
          #!/bin/bash
          set -ex
          autoreconf -if && ./configure --enable-silent-rules
          make rpms

    - name: Install authselect RPMs on the client
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: ostree-install.log
        working-directory: /authselect
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex
          dnf install -y rpmbuild/RPMS/*/*.rpm

    - name: Verify that vendor profiles were created
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: ostree-verify-vendor.log
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex

          # Check that vendor profiles directory exists
          test -d /usr/share/authselect/vendor

          # Check that vendor profiles were created for each default profile
          for profile in sssd winbind nis local; do
            if [ -d "/usr/share/authselect/default/$profile" ]; then
              echo "Checking vendor profile: $profile"
              test -d "/usr/share/authselect/vendor/$profile" || {
                echo "ERROR: Vendor profile $profile not found"
                exit 1
              }

              # Verify nsswitch.conf exists in vendor profile
              nsswitch="/usr/share/authselect/vendor/$profile/nsswitch.conf"
              test -f "$nsswitch" || {
                echo "ERROR: nsswitch.conf not found in vendor/$profile"
                exit 1
              }

              # Verify "with-altfiles" template conditional was removed
              if grep -q "with-altfiles" "$nsswitch"; then
                echo "ERROR: 'with-altfiles' template conditional still present in $nsswitch"
                cat "$nsswitch"
                exit 1
              fi

              echo "Vendor profile $profile: OK (with-altfiles conditional removed)"
            fi
          done

    - name: Verify altfiles is enabled in /etc/nsswitch.conf
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: ostree-verify-altfiles.log
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex

          echo "Checking /etc/nsswitch.conf for altfiles..."
          cat /etc/nsswitch.conf

          # Check altfiles is present on passwd: line
          if ! grep "^passwd:" /etc/nsswitch.conf | grep -q "altfiles"; then
            echo "ERROR: 'altfiles' not found on passwd: line in /etc/nsswitch.conf"
            exit 1
          fi

          # Check altfiles is present on group: line
          if ! grep "^group:" /etc/nsswitch.conf | grep -q "altfiles"; then
            echo "ERROR: 'altfiles' not found on group: line in /etc/nsswitch.conf"
            exit 1
          fi

          echo "SUCCESS: altfiles present on passwd: and group: lines in /etc/nsswitch.conf"

    - name: Verify altfiles is enabled with with-group-merging /etc/nsswitch.conf
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: ostree-verify-altfiles-after.log
        user: root
        where: client
        script: |
          #!/bin/bash
          set -ex

          authselect enable-feature with-group-merging

          echo "Checking /etc/nsswitch.conf for altfiles after enabling with-group-merging..."
          cat /etc/nsswitch.conf

          # Check altfiles is present on passwd: line
          if ! grep "^passwd:" /etc/nsswitch.conf | grep -q "altfiles"; then
            echo "ERROR: 'altfiles' not found on passwd: line in /etc/nsswitch.conf after feature change"
            exit 1
          fi

          # Check altfiles is present on group: line
          if ! grep "^group:" /etc/nsswitch.conf | grep -q "altfiles"; then
            echo "ERROR: 'altfiles' not found on group: line in /etc/nsswitch.conf after feature change"
            exit 1
          fi

          echo "SUCCESS: altfiles still present on passwd: and group: lines in /etc/nsswitch.conf after feature change"

    - name: Upload artifacts
      if: always()
      uses: actions/upload-artifact@v4
      with:
        if-no-files-found: ignore
        name: ostree
        path: |
          ostree-dependencies.log
          ostree-build.log
          ostree-install.log
          ostree-verify-vendor.log
          ostree-verify-altfiles.log
          ostree-verify-altfiles-after.log