.github/workflows/ci.yml - master - githubmirror/sssd

.github/workflows/ci.yml
345 строк10 KB
Alexey Tikhonov
CI: don't specify 'push:'/'pull_request:' branches
20 июл 2026, 15:40
20 июл 2026, 15:40b58482f
name: "ci"
on:
  push:
  pull_request:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  prepare:
    if: github.event_name == 'push' || !contains(github.event.pull_request.labels.*.name, 'Accepted')
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
    - name: Checkout sources
      uses: actions/checkout@v7

    - name: Get matrix
      id: matrix
      run: ./contrib/ci/get-matrix.py --action

  intgcheck:
    if: github.event_name == 'push' || !contains(github.event.pull_request.labels.*.name, 'Accepted')
    needs: [prepare]
    strategy:
      fail-fast: false
      matrix:
        tag: ${{ fromJson(needs.prepare.outputs.matrix).intgcheck }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - name: Checkout repository
      uses: actions/checkout@v7
      with:
        path: sssd

    - name: Setup containers
      uses: SSSD/sssd-ci-containers/actions/setup@master
      with:
        path: sssd-ci-containers
        tag: ${{ matrix.tag }}
        limit: dns client
        override: |
          services:
            client:
              image: ${REGISTRY}/ci-client-devel:${TAG}
              volumes:
              - ../sssd:/sssd:rw

    - name: Run integration tests
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        working-directory: /sssd
        script: ./contrib/ci/run --moderate

    - name: Print logs
      uses: next-actions/print-logs@master
      if: always()
      with:
        working-directory: ./sssd/ci-build-debug
        files: |
          test-suite.log
          ci-make-intgcheck.log
          ci-make-distcheck.log

    - name: Upload main artifacts
      if: always()
      uses: actions/upload-artifact@v7
      with:
        if-no-files-found: ignore
        name: ${{ matrix.tag }}-intgcheck
        path: |
          ./sssd/var/log/sssd/*.log
          ./sssd/ci-build-debug/ci-*.log
          ./sssd/ci-build-debug/config.log
          ./sssd/ci-build-debug/test-suite.log
          ./sssd/ci-build-debug/ci-mock-result/*.log
          ./sssd/ci-build-debug/src/tests/cwrap/test-suite.log
          ./sssd/ci-install-deps.log
          ./sssd/ci-autoreconf.log

    - name: Upload valgrind artifacts
      if: always()
      uses: actions/upload-artifact@v7
      with:
        if-no-files-found: ignore
        name: ${{ matrix.tag }}-intgcheck-valgrind
        path: |
          ./sssd/ci-build-debug/*.valgrind.log

  system:
    if: github.event_name == 'push' || !contains(github.event.pull_request.labels.*.name, 'Accepted')
    needs: [prepare]
    strategy:
      fail-fast: false
      matrix:
        tag: ${{ fromJson(needs.prepare.outputs.matrix).multihost }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - uses: actions/setup-python@v6
      with:
        python-version: '3.x'

    - name: Checkout sssd repository
      uses: actions/checkout@v7
      with:
        path: sssd

    - name: Install and load kernel module for passkey testing
      shell: bash
      run: |
        set -ex -o pipefail

        sudo apt-get update
        sudo apt-get install -y linux-modules-extra-$(uname -r)

        sudo modprobe vhci-hcd

    - name: Setup containers
      uses: SSSD/sssd-ci-containers/actions/setup@master
      with:
        path: sssd-ci-containers
        tag: ${{ matrix.tag }}
        override: |
          services:
            client:
              image: ${REGISTRY}/ci-client-devel:${TAG}
              shm_size: 4G
              tmpfs:
              - /dev/shm
              volumes:
              - ../sssd:/sssd:rw
            ipa:
              image: ${REGISTRY}/ci-ipa-devel:${TAG}
              shm_size: 4G
              tmpfs:
              - /dev/shm
              volumes:
              - ../sssd:/sssd:rw

    - name: Build SSSD on the client and IPA
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: build.log
        working-directory: /sssd
        where: |
          client
          ipa
        script: |
          #!/bin/bash
          set -ex

          ./contrib/ci/run --deps-only
          autoreconf -if

          mkdir -p /dev/shm/sssd
          pushd /dev/shm/sssd
          /sssd/configure --enable-silent-rules
          make rpms

    - name: Install SSSD on the client and IPA
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        log-file: install.log
        user: root
        where: |
          client
          ipa
        script: |
          #!/bin/bash
          set -ex

          # Avoid error 'Lower version of database is expected!' for locally built installed rpms
          systemctl stop sssd
          rm -f /var/lib/sss/db/*

          dnf install -y /dev/shm/sssd/rpmbuild/RPMS/*/*.rpm
          rm -fr /dev/shm/sssd

          # We need to reenable sssd-kcm since it was disabled by removing sssd not not enabled again
          systemctl enable --now sssd-kcm.socket

    - name: Restart SSSD on IPA server
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        user: root
        where: ipa
        script: |
          #!/bin/bash
          set -ex

          systemctl restart sssd || systemctl status sssd

    - name: Patch the SSH configuration
      uses: SSSD/sssd-ci-containers/actions/exec@master
      with:
        user: root
        script: |
          #!/bin/bash
          test -x /usr/bin/sss_ssh_knownhosts && \
              sed -e 's/GlobalKnownHostsFile/#GlobalKnownHostsFile/' \
                  -e 's/ProxyCommand \/usr\/bin\/sss_ssh_knownhostsproxy -p %p %h/KnownHostsCommand \/usr\/bin\/sss_ssh_knownhosts %H/' \
                  -i /etc/ssh/ssh_config.d/04-ipa.conf

    - name: Install system tests dependencies
      shell: bash
      working-directory: ./sssd/src/tests/system
      run: |
        set -ex

        sudo apt-get update

        # Install dependencies for python-ldap
        sudo apt-get install -y libsasl2-dev python3-dev libldap2-dev libssl-dev libssh-dev

        # Virtualenv
        pip3 install virtualenv
        python3 -m venv .venv
        source .venv/bin/activate

        # Install system tests requirements
        pip3 install -r ./requirements.txt

        # Install yq to parse yaml files
        sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
        sudo chmod a+x /usr/local/bin/yq

    - name: Remove ad from mhc.yaml
      shell: bash
      working-directory: ./sssd/src/tests/system
      run: |
        yq -i 'del(.domains[0].hosts.[] | select(.role == "ad"))' mhc.yaml

    - name: Get changed tests
      shell: bash {0}
      env:
        PR_ID: ${{ github.event.pull_request.number }}
        GH_TOKEN: ${{ github.token }}
      working-directory: sssd
      id: select-tests
      run: |
        set -e

        # Check if non-test files were changed or not run inside PR
        FILES=`gh pr diff "$PR_ID" --name-only 2>&1 || exit 0`

        if echo "$FILES" | grep 'no pull requests found'; then
          echo "Script not running against PR event. Will run all tests."
          echo "SELECT_TESTS=" >> "$GITHUB_OUTPUT"
          exit 0
        elif echo "$FILES" | grep -v 'src/tests/system/tests'; then
          echo "Non-test files were changed. Will run all tests."
          echo "SELECT_TESTS=" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        DIFF=`gh pr diff "$PR_ID"`

        # Find if any non-test function was modified, in that case we need to
        # run all tests as we do not know where the function is used
        if echo "$DIFF" | grep -P '^(@@.+|\+|-)\s*def (?!test_)'; then
          echo "Non-test function was modified. Will run all tests."
          echo "SELECT_TESTS=" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        # Find all tests that were added
        ADDED=`echo "$DIFF" | grep -P "^\+\s*def test_" | sed -E 's/.+def (test_[^(]+).+/\1/'`

        # Find all tests that are used as tokens in diff
        MODIFIED=`echo "$DIFF" | grep -E "^@@.+def test_" | sed -E 's/.+def (test_[^(]+).+/\1/'`

        # Combine and sort
        TESTS=`echo -e "$ADDED\n$MODIFIED" | sort | uniq`

        echo "Following tests were added or modified (or token is present in diff):"
        echo "$TESTS"

        ARGS=""
        if [ ! -z "$TESTS" ]; then
          FILTER=`echo "$TESTS" | xargs | sed 's/ / or /g'`
          ARGS="-k \"$FILTER\""
        fi

        echo "SELECT_TESTS=$ARGS" >> "$GITHUB_OUTPUT"

        echo "Set SELECT_TESTS as GitHub Output:"
        grep SELECT_TESTS "$GITHUB_OUTPUT"

    - name: Check polarion metadata
      shell: bash
      working-directory: ./sssd/src/tests/system
      run: |
        # Run pytest in collect only mode to quickly catch issues in Polarion metadata.
        set -ex -o pipefail

        mkdir -p $GITHUB_WORKSPACE/artifacts
        source .venv/bin/activate
        pytest \
          --color=yes \
          --mh-config=./mhc.yaml \
          --mh-artifacts-dir=$GITHUB_WORKSPACE/artifacts \
          --polarion-config=../polarion.yaml \
          --output-polarion-testcase=$GITHUB_WORKSPACE/artifacts/testcase.xml \
          ${{ steps.select-tests.outputs.SELECT_TESTS }} \
          --collect-only . |& tee $GITHUB_WORKSPACE/pytest-collect.log

    - name: Run tests
      shell: bash
      working-directory: ./sssd/src/tests/system
      run: |
        set -ex -o pipefail

        mkdir -p $GITHUB_WORKSPACE/artifacts
        source .venv/bin/activate
        pytest \
          --durations=0 \
          --color=yes \
          --show-capture=no \
          --mh-config=./mhc.yaml \
          --mh-artifacts-dir=$GITHUB_WORKSPACE/artifacts \
          --polarion-config=../polarion.yaml \
          --output-polarion-testcase=$GITHUB_WORKSPACE/artifacts/testcase.xml \
          --output-polarion-testrun=$GITHUB_WORKSPACE/artifacts/testrun.xml \
          ${{ steps.select-tests.outputs.SELECT_TESTS }} \
          -vvv . |& tee $GITHUB_WORKSPACE/pytest.log

    - name: Upload artifacts
      if: always()
      uses: actions/upload-artifact@v7
      with:
        if-no-files-found: ignore
        name: ${{ matrix.tag }}-system
        path: |
          sssd/ci-install-deps.log
          artifacts
          build.log
          install.log
          pytest.log
          pytest-collect.log