mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-11-10 12:28:25 +00:00
Chandler Carruth
a1305604f2
Newer versions of `protobuf` depend on Rust to a limited extent. Builds don't use it, and _our_ builds rarely even touch on `protobuf`. But the way CI was running `bazel mod` commands in `action.yml` forced fully evaluating all the module extensions, including Rust. This ends up both hitting end points we didn't allow and being really expensive. We can skip that and keep the more targeted `cquery` that doesn't do anything beyond what our builds need. We also still have a test that the lock file is accurate, so we don't lose any coverage here, it just makes things faster. That said, we _do_ want to be able to hit the Rust dependency if and where we (transitively) need it, and we'll at least need our `prek` checks to be able to resolve them and rebuilding the lock file after an update, so the relevant end points are added to our hardened runner as allowed. The second issue is that `rules_python` in version 2.0 and newer is using a Bazel feature we disable. There is an escape hatch though that we can enable in our `.bazelrc` so it keeps working, and that works even with the current version. Once this lands, the Dependabot update of the Bazel module versions should be able to make more progress. Assisted-by: Antigravity with Claude Opus
131 lines
4.8 KiB
YAML
131 lines
4.8 KiB
YAML
# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
# Exceptions. See /LICENSE for license information.
|
|
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
name: Tests
|
|
|
|
on:
|
|
push:
|
|
branches: [trunk, action-test]
|
|
pull_request:
|
|
merge_group:
|
|
|
|
permissions:
|
|
contents: read # For actions/checkout.
|
|
pull-requests: read # For dorny/paths-filter to read pull requests.
|
|
|
|
# Cancel previous workflows on the PR when there are multiple fast commits.
|
|
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#concurrency
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
test:
|
|
name:
|
|
Testing ${{ matrix.config.name != 'Default' && format('({0})',
|
|
matrix.config.name) || '' }} (${{ matrix.runner }})
|
|
strategy:
|
|
matrix:
|
|
# Test a recent version of each supported OS, covering both x86-64 and
|
|
# AArch64: Linux on x86-64 and AArch64, and macOS on AArch64.
|
|
runner: ['ubuntu-22.04', 'ubuntu-22.04-arm', 'macos-26']
|
|
# Create a synthetic matrix dimension with the event name for filtering.
|
|
event: ['${{ github.event_name }}']
|
|
config:
|
|
- name: 'Default'
|
|
flags: ''
|
|
- name: 'Opt'
|
|
flags: '-c opt'
|
|
- name: 'ASan'
|
|
flags: '--config=asan'
|
|
exclude:
|
|
- runner: 'macos-26'
|
|
config: { name: 'ASan', flags: '--config=asan' }
|
|
- event: 'pull_request'
|
|
config: { name: 'ASan', flags: '--config=asan' }
|
|
- event: 'merge_group'
|
|
config: { name: 'ASan', flags: '--config=asan' }
|
|
runs-on: ${{ matrix.runner }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
|
|
with:
|
|
egress-policy: block
|
|
# When adding endpoints, see README.md.
|
|
# prettier-ignore
|
|
allowed-endpoints: >
|
|
*.blob.storage.azure.net:443
|
|
*.githubapp.com:443
|
|
*.sourceforge.net:443
|
|
api.github.com:443
|
|
api.ipify.org:443
|
|
bcr.bazel.build:443
|
|
download.gnome.org:443
|
|
downloads.sourceforge.net:443
|
|
files.pythonhosted.org:443
|
|
formulae.brew.sh:443
|
|
github.com:443
|
|
go.dev:443
|
|
index.crates.io:443
|
|
mirror.bazel.build:443
|
|
mirrors.kernel.org:443
|
|
nodejs.org:443
|
|
oauth2.googleapis.com:443
|
|
objects.githubusercontent.com:443
|
|
pkg-containers.githubusercontent.com:443
|
|
pypi.org:443
|
|
raw.githubusercontent.com:443
|
|
registry.npmjs.org:443
|
|
release-assets.githubusercontent.com:443
|
|
releases.astral.sh:443
|
|
releases.bazel.build:443
|
|
static.crates.io:443
|
|
static.rust-lang.org:443
|
|
storage.googleapis.com:443
|
|
uploads.github.com:443
|
|
www.googleapis.com:443
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- id: test-setup
|
|
uses: ./.github/actions/test-setup
|
|
with:
|
|
matrix_runner: ${{ matrix.runner }}
|
|
base_sha:
|
|
${{ github.event_name == 'pull_request' &&
|
|
github.event.pull_request.base.sha ||
|
|
github.event.merge_group.base_sha }}
|
|
# The remote cache key is only used outside of PRs, so only make it
|
|
# available on those events. PRs get an empty string.
|
|
remote_cache_key:
|
|
${{ (github.event_name != 'pull_request' &&
|
|
secrets.CARBON_BUILDS_GITHUB) || '' }}
|
|
targets_file: ${{ runner.temp }}/targets
|
|
|
|
# Build and run just the tests impacted by the PR or merge group.
|
|
- name: Test (${{ matrix.config.name }})
|
|
if: steps.test-setup.outputs.has_code == 'true'
|
|
shell: bash
|
|
env:
|
|
# 'libtool_check_unique failed to generate' workaround.
|
|
# https://github.com/bazelbuild/bazel/issues/14113#issuecomment-999794586
|
|
BAZEL_USE_CPP_ONLY_TOOLCHAIN: 1
|
|
TARGETS_FILE: ${{ runner.temp }}/targets
|
|
run: |
|
|
# Decrease the jobs sharply if we see repeated failures to try to
|
|
# work around transient network errors even if it makes things
|
|
# slower. Note that we allow passing targets that are incompatible and
|
|
# skip thim as-if we were using `//...` style wild card patterns.
|
|
./scripts/run_bazel.py \
|
|
--attempts=5 --jobs-on-last-attempt=4 \
|
|
test ${{ matrix.config.flags }} \
|
|
--target_pattern_file=$TARGETS_FILE
|
|
|
|
# See "Disk space before build" in `test-setup`.
|
|
- name: Disk space after build
|
|
if: steps.test-setup.outputs.has_code == 'true'
|
|
run: df -h
|