From d6ae1a67c4244c5f121fe6be60390c8b9a0a08b2 Mon Sep 17 00:00:00 2001 From: WHC Date: Wed, 7 Oct 2026 02:21:18 +0800 Subject: [PATCH] ci: drop macOS, skip ASan, checkout without GitHub, MinGW zip - Replace actions/checkout (pulls from github.com) with scripts/ci_checkout.sh fetched from this Gitea over raw/commit. - Remove the macOS job (no runner). - Disable sanitizers until the Docker runner has SYS_PTRACE; it was wedging the only slot with AddressSanitizer:DEADLYSIGNAL. - Add windows-cross: Nix UCRT mingw via TUNA, bootstrap_windows.sh, verify dist/cst-agent-*-windows-x86_64.zip. Third-party git clones go through gitclone.com. --- .gitea/workflows/ci.yml | 112 ++++++++++++++++++++++++++++++---------- scripts/ci_checkout.sh | 33 ++++++++++++ 2 files changed, 117 insertions(+), 28 deletions(-) create mode 100755 scripts/ci_checkout.sh diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 02d9e55..d8200ed 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -4,8 +4,6 @@ on: push: pull_request: -# One runner: cancel the previous push's jobs (avoids a stuck ASan job -# blocking every later commit). concurrency: group: ci-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true @@ -19,7 +17,15 @@ jobs: matrix: cc: [gcc, clang] steps: - - uses: actions/checkout@v4 + - name: Checkout + env: + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_SHA: ${{ github.sha }} + run: | + curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \ + -o /tmp/ci_checkout.sh + bash /tmp/ci_checkout.sh - name: Install dependencies run: | SUDO=$(command -v sudo || true) @@ -43,11 +49,23 @@ jobs: ./cst-agent --workspace "$PWD" --list-sessions ./cst-agent --demo-ctl --workspace . + # Disabled: Docker runner lacks SYS_PTRACE; ASan spins on DEADLYSIGNAL and + # wedged the only runner. Re-enable after the runner gets --cap-add SYS_PTRACE + # (or seccomp=unconfined). sanitizers: + if: false runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - name: Checkout + env: + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_SHA: ${{ github.sha }} + run: | + curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \ + -o /tmp/ci_checkout.sh + bash /tmp/ci_checkout.sh - name: Install dependencies run: | SUDO=$(command -v sudo || true) @@ -58,45 +76,83 @@ jobs: - name: ASan + UBSan timeout-minutes: 10 env: - # Docker runners without SYS_PTRACE can spin forever on - # AddressSanitizer:DEADLYSIGNAL; keep the handler shallow and - # hard-cap wall time so the single runner is not wedged. ASAN_OPTIONS: abort_on_error=1:halt_on_error=1:detect_leaks=0:use_sigaltstack=0 UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1 - run: | - if ! timeout -s KILL 480 make asan; then - echo "::error::make asan failed or timed out after 8m (if the log is only DEADLYSIGNAL, give the runner SYS_PTRACE / seccomp=unconfined)" - exit 1 - fi + run: timeout -s KILL 480 make asan musl: runs-on: ubuntu-latest timeout-minutes: 30 container: alpine:3.20 steps: - - name: Install dependencies + - name: Install tools + mirror run: | - # Container has no checkout yet; rewrite apk repos in place. sed -i 's#https\?://dl-cdn.alpinelinux.org/alpine#https://mirrors.tuna.tsinghua.edu.cn/alpine#g' \ /etc/apk/repositories - apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3 - - uses: actions/checkout@v4 + apk add --no-cache curl git bash + - name: Checkout + env: + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_SHA: ${{ github.sha }} + run: | + curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \ + -o /tmp/ci_checkout.sh + bash /tmp/ci_checkout.sh + - name: Install build dependencies + run: apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3 - name: Build + unit tests run: | make CFLAGS="-std=c11 -Wall -Wextra -O2 -Werror" -j"$(nproc)" make check - # Gitea instances rarely have macOS runners; set the repository variable - # HAVE_MACOS_RUNNER=true once one is registered. - macos: - if: ${{ vars.HAVE_MACOS_RUNNER == 'true' }} - runs-on: macos-latest - timeout-minutes: 30 + # MinGW-w64 UCRT cross build → dist/cst-agent-*-windows-x86_64.zip + windows-cross: + runs-on: ubuntu-latest + timeout-minutes: 120 steps: - - uses: actions/checkout@v4 - - name: Install dependencies - run: brew install ncurses curl pkg-config - - name: Build + unit tests + - name: Checkout + env: + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_SHA: ${{ github.sha }} run: | - make -j"$(sysctl -n hw.ncpu)" - make check + curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \ + -o /tmp/ci_checkout.sh + bash /tmp/ci_checkout.sh + - name: Install host tools + run: | + SUDO=$(command -v sudo || true) + $SUDO bash scripts/ci_pkg_mirror.sh + $SUDO apt-get update + $SUDO apt-get install -y --no-install-recommends \ + ca-certificates curl git cmake ninja-build make pkg-config \ + python3 zip perl xz-utils + - name: Install Nix (TUNA) + run: | + if ! command -v nix-shell >/dev/null; then + curl -L https://mirrors.tuna.tsinghua.edu.cn/nix/latest/install | sh -s -- --no-daemon + fi + mkdir -p "$HOME/.config/nix" + printf '%s\n' \ + 'substituters = https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store https://cache.nixos.org/' \ + 'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \ + > "$HOME/.config/nix/nix.conf" + # shellcheck source=/dev/null + . "$HOME/.nix-profile/etc/profile.d/nix.sh" + nix --version + - name: Proxy GitHub for third_party clones + run: | + # curl/busybox-w32/ncurses sources; skip if the proxy is down + git config --global url."https://gitclone.com/github.com/".insteadOf "https://github.com/" + - name: Cross-build Windows zip + run: | + # shellcheck source=/dev/null + . "$HOME/.nix-profile/etc/profile.d/nix.sh" + nix-shell shell-win.nix --run 'scripts/bootstrap_windows.sh .' + - name: Verify zip + run: | + ls -lah dist/windows-x86_64/ + ls -lah dist/cst-agent-*-windows-x86_64.zip + cat dist/cst-agent-*-windows-x86_64.zip.sha256 + unzip -l dist/cst-agent-*-windows-x86_64.zip | head -20 diff --git a/scripts/ci_checkout.sh b/scripts/ci_checkout.sh new file mode 100755 index 0000000..e062474 --- /dev/null +++ b/scripts/ci_checkout.sh @@ -0,0 +1,33 @@ +#!/usr/bin/env bash +# Checkout this repo without downloading actions/checkout from GitHub. +# act_runner may already have placed sources in the workspace; otherwise +# clone from the same Gitea that started the job. +set -euo pipefail + +SERVER="${GITHUB_SERVER_URL:-${GITEA_SERVER_URL:-}}" +REPO="${GITHUB_REPOSITORY:-${GITEA_REPOSITORY:-}}" +SHA="${GITHUB_SHA:-${GITEA_SHA:-}}" + +if [[ -f CMakeLists.txt && -d src ]]; then + echo "==> workspace already has sources" + git rev-parse --short HEAD 2>/dev/null || true + exit 0 +fi + +if [[ -z "$SERVER" || -z "$REPO" ]]; then + echo "missing GITHUB_SERVER_URL / GITHUB_REPOSITORY" >&2 + exit 1 +fi + +echo "==> git clone $SERVER/$REPO" +git clone --filter=blob:none "$SERVER/$REPO.git" _ci_src +if [[ -n "$SHA" ]]; then + git -C _ci_src fetch --depth 1 origin "$SHA" || git -C _ci_src fetch origin "$SHA" + git -C _ci_src checkout --force "$SHA" +fi +# Move into the workspace root (may already contain act_runner metadata). +shopt -s dotglob nullglob +mv _ci_src/* . +rmdir _ci_src 2>/dev/null || rm -rf _ci_src +test -f CMakeLists.txt +git rev-parse --short HEAD