From 5929c3afba0a1bd448665770422dd01016f89d6c Mon Sep 17 00:00:00 2001 From: grloper Date: Fri, 9 Oct 2026 21:24:53 +0300 Subject: [PATCH 1/2] ci: add distro container build/test matrix --- .github/workflows/distro-matrix.yml | 67 +++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 .github/workflows/distro-matrix.yml diff --git a/.github/workflows/distro-matrix.yml b/.github/workflows/distro-matrix.yml new file mode 100644 index 0000000..b734028 --- /dev/null +++ b/.github/workflows/distro-matrix.yml @@ -0,0 +1,67 @@ +name: distro-matrix + +on: + pull_request: + push: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: distro-${{ github.ref }} + cancel-in-progress: true + +jobs: + container-build-test: + name: ${{ matrix.image }} + runs-on: ubuntu-22.04 + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + image: ["ubuntu:22.04", "ubuntu:24.04", "debian:12", "fedora:latest"] + container: + image: ${{ matrix.image }} + # ptrace in containers can be restricted by the seccomp profile/capabilities. + options: --cap-add SYS_PTRACE --security-opt seccomp=unconfined + env: + CARGO_TERM_COLOR: always + steps: + - name: Install build prerequisites + shell: sh + run: | + if command -v apt-get >/dev/null; then + apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates curl gcc libc6-dev git python3 + else + dnf install -y gcc curl git python3 ca-certificates + fi + - uses: actions/checkout@v4 + - name: Install stable Rust + shell: sh + run: | + curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + - name: Show environment + run: | + cat /etc/os-release | head -3 + rustc --version + uname -r + - name: Build (release, locked) + run: cargo build --release --locked + - name: Ptrace preflight (informational) + # If the container forbids ptrace, ptrace-dependent integration tests + # print "skipping: could not start tracer" and pass without exercising + # tracing. This step makes that visible rather than hidden. + run: ./target/release/wraith doctor || echo "::warning::wraith doctor reported failures on ${{ matrix.image }}; ptrace tests may be skipped" + - name: Test + run: cargo test --locked -- --nocapture 2>&1 | tee test.log + shell: bash + - name: Report skipped ptrace tests + if: always() + shell: bash + run: | + n=$(grep -c 'skipping: could not start tracer' test.log || true) + echo "ptrace-skipped test count: $n" + if [ "$n" != 0 ]; then echo "::warning::$n ptrace tests were skipped on ${{ matrix.image }}"; fi From 006a52a2448a78f803f2a3ad7db6ce2d06698e2f Mon Sep 17 00:00:00 2001 From: grloper Date: Fri, 9 Oct 2026 21:53:12 +0300 Subject: [PATCH 2/2] ci(distro): pin fedora:43, pinned+checksummed rustup-init, pipefail, MSRV check --- .github/workflows/distro-matrix.yml | 35 +++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 7 deletions(-) diff --git a/.github/workflows/distro-matrix.yml b/.github/workflows/distro-matrix.yml index b734028..b6a9d8e 100644 --- a/.github/workflows/distro-matrix.yml +++ b/.github/workflows/distro-matrix.yml @@ -21,43 +21,64 @@ jobs: strategy: fail-fast: false matrix: - image: ["ubuntu:22.04", "ubuntu:24.04", "debian:12", "fedora:latest"] + image: ["ubuntu:22.04", "ubuntu:24.04", "debian:12", "fedora:43"] container: image: ${{ matrix.image }} # ptrace in containers can be restricted by the seccomp profile/capabilities. options: --cap-add SYS_PTRACE --security-opt seccomp=unconfined + defaults: + run: + shell: bash env: CARGO_TERM_COLOR: always + RUSTUP_VERSION: "1.29.1" + # sha256 of rustup-init for x86_64-unknown-linux-gnu at RUSTUP_VERSION + RUSTUP_INIT_SHA256: "dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71" + MSRV_TOOLCHAIN: "1.74.0" steps: - name: Install build prerequisites shell: sh run: | + set -eu if command -v apt-get >/dev/null; then apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates curl gcc libc6-dev git python3 else dnf install -y gcc curl git python3 ca-certificates fi - uses: actions/checkout@v4 - - name: Install stable Rust - shell: sh + - name: Install pinned rustup, stable and MSRV toolchains run: | - curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal + set -euo pipefail + url="https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x86_64-unknown-linux-gnu/rustup-init" + curl --proto '=https' --tlsv1.2 -sSfL -o rustup-init "$url" + echo "${RUSTUP_INIT_SHA256} rustup-init" | sha256sum -c - + chmod +x rustup-init + ./rustup-init -y --profile minimal --default-toolchain stable + rm rustup-init echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + "$HOME/.cargo/bin/rustup" toolchain install "$MSRV_TOOLCHAIN" --profile minimal - name: Show environment run: | cat /etc/os-release | head -3 rustc --version uname -r - name: Build (release, locked) - run: cargo build --release --locked + run: | + set -euo pipefail + cargo build --release --locked + - name: MSRV check (${{ env.MSRV_TOOLCHAIN }}) + run: | + set -euo pipefail + cargo +"$MSRV_TOOLCHAIN" check --locked - name: Ptrace preflight (informational) # If the container forbids ptrace, ptrace-dependent integration tests # print "skipping: could not start tracer" and pass without exercising # tracing. This step makes that visible rather than hidden. run: ./target/release/wraith doctor || echo "::warning::wraith doctor reported failures on ${{ matrix.image }}; ptrace tests may be skipped" - name: Test - run: cargo test --locked -- --nocapture 2>&1 | tee test.log - shell: bash + run: | + set -euo pipefail + cargo test --locked -- --nocapture 2>&1 | tee test.log - name: Report skipped ptrace tests if: always() shell: bash