mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-24 14:29:07 +02:00
Maycon Santos
c051ca8f87
* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys Eight eMudhra intermediate CA private keys were compromised and browsers blocked them on 2026-10-17. Our binaries were built with go1.26.7, which accepts chains through those intermediates whenever the trust store still holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on every platform, regardless of the trust store. The UBI base still ships the root and Red Hat has no fixed package yet, so the UBI images blocklist it with p11-kit. The ingest image, the UI server image and the pinned Chainguard digests also carried the root and move to bases that no longer do. * [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22, which drops emSign ECC Root CA - G3 and AAA Certificate Services. The current ubi9-minimal image carries it, so pin that digest and remove the p11-kit blocklist step. * [misc] Pin upload-server images by digest only and restore go.mod comment
854 lines
31 KiB
YAML
854 lines
31 KiB
YAML
name: Linux
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- "release-*"
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-cache:
|
|
name: "Build Cache"
|
|
runs-on: ubuntu-22.04
|
|
outputs:
|
|
management: ${{ steps.filter.outputs.management }}
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
|
|
id: filter
|
|
with:
|
|
filters: |
|
|
management:
|
|
- 'management/**'
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
id: cache
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Install dependencies
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
|
|
|
|
- name: Install 32-bit libpcap
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
run: sudo dpkg --add-architecture i386 && sudo apt update && sudo apt-get install -y libpcap0.8-dev:i386
|
|
|
|
- name: Build client
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: client
|
|
run: CGO_ENABLED=1 go build .
|
|
|
|
- name: Build client 386
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: client
|
|
run: CGO_ENABLED=1 GOARCH=386 go build -o client-386 .
|
|
|
|
- name: Build management
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: management
|
|
run: CGO_ENABLED=1 go build .
|
|
|
|
- name: Build management 386
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: management
|
|
run: CGO_ENABLED=1 GOARCH=386 go build -o management-386 .
|
|
|
|
- name: Build signal
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: signal
|
|
run: CGO_ENABLED=1 go build .
|
|
|
|
- name: Build signal 386
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: signal
|
|
run: CGO_ENABLED=1 GOARCH=386 go build -o signal-386 .
|
|
|
|
- name: Build relay
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: relay
|
|
run: CGO_ENABLED=1 go build .
|
|
|
|
- name: Build relay 386
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: relay
|
|
run: CGO_ENABLED=1 GOARCH=386 go build -o relay-386 .
|
|
|
|
- name: Build combined
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: combined
|
|
run: CGO_ENABLED=1 go build .
|
|
|
|
- name: Build combined 386
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
working-directory: combined
|
|
run: CGO_ENABLED=1 GOARCH=386 go build -o combined-386 .
|
|
|
|
test:
|
|
name: "Client / Unit"
|
|
needs: [build-cache]
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch: ["386", "amd64"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install dependencies
|
|
run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
|
|
|
|
- name: Install 32-bit libpcap
|
|
if: matrix.arch == '386'
|
|
run: sudo dpkg --add-architecture i386 && sudo apt update && sudo apt-get install -y libpcap0.8-dev:i386
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
- name: Test
|
|
# Exclude client/ui: its main.go uses //go:embed all:frontend/dist,
|
|
# which fails to compile until the frontend has been built, and its
|
|
# release pipeline runs `pnpm build` before goreleaser. The subpackages
|
|
# go with it because this runner's gtk4 is older than the wails runtime
|
|
# needs; the Client UI / Unit job below covers them instead.
|
|
# `go list -e` lets the listing succeed even though the embed fails to
|
|
# resolve; the grep then drops the broken package by path. Without -e,
|
|
# go list aborts with empty stdout and `go test` falls back to the repo
|
|
# root, which has no Go files.
|
|
run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,CGO_ENABLED' -timeout 10m -p 1 $(go list -e ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /client/testutil/privileged)
|
|
|
|
- name: Upload coverage reports to Codecov
|
|
if: matrix.arch == 'amd64'
|
|
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
|
|
with:
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
slug: netbirdio/netbird
|
|
flags: unit,client
|
|
|
|
test_client_ui:
|
|
name: "Client UI / Unit"
|
|
# Pinned to 24.04 rather than the 22.04 the other client jobs use: the wails
|
|
# runtime's linux cgo layer needs GtkFileDialog, which arrived in gtk4 4.10,
|
|
# and jammy ships 4.6. Not ubuntu-latest, so a runner image rollover cannot
|
|
# move this out from under us.
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Install dependencies
|
|
run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev
|
|
|
|
- name: Test
|
|
# client/ui itself stays out: its main.go embeds all:frontend/dist,
|
|
# which only exists after `pnpm build`. The subpackages carry the
|
|
# Go-side unit tests, including the window manager re-entrancy
|
|
# regression test, and need no frontend bundle.
|
|
run: CGO_ENABLED=1 go test -timeout 5m ./client/ui/authsession/... ./client/ui/i18n/... ./client/ui/preferences/... ./client/ui/services/...
|
|
|
|
test_client_pkcs11:
|
|
name: "Client PKCS#11 / Unit"
|
|
# The deb and rpm packages ship the client built with the pkcs11 tag, which loads
|
|
# PKCS#11 modules through purego. The other jobs build without the tag, so this one
|
|
# compiles that driver and signs with a real SoftHSM token, the build release ships.
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Install SoftHSM
|
|
run: sudo apt update && sudo apt install -y -q softhsm2
|
|
|
|
- name: Initialise token
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/softhsm/tokens"
|
|
printf 'directories.tokendir = %s\nobjectstore.backend = file\n' "$RUNNER_TEMP/softhsm/tokens" > "$RUNNER_TEMP/softhsm/softhsm2.conf"
|
|
echo "SOFTHSM2_CONF=$RUNNER_TEMP/softhsm/softhsm2.conf" >> "$GITHUB_ENV"
|
|
SOFTHSM2_CONF="$RUNNER_TEMP/softhsm/softhsm2.conf" softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
|
|
|
|
- name: Vet
|
|
run: CGO_ENABLED=0 go vet -tags pkcs11 ./client/internal/pkcs11/... ./client/internal/certproof/...
|
|
|
|
- name: Test
|
|
env:
|
|
NB_TEST_PKCS11_URI: "pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234"
|
|
NB_TEST_PKCS11_DISPOSABLE: "1"
|
|
run: CGO_ENABLED=0 go test -tags pkcs11 -timeout 5m ./client/internal/pkcs11/... ./client/internal/certproof/...
|
|
|
|
test_client_on_docker:
|
|
name: "Client (Docker) / Unit"
|
|
needs: [build-cache]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Get Go environment
|
|
id: go-env
|
|
run: |
|
|
echo "cache_dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
|
|
echo "modcache_dir=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
id: cache-restore
|
|
with:
|
|
path: |
|
|
${{ steps.go-env.outputs.cache_dir }}
|
|
${{ steps.go-env.outputs.modcache_dir }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Run tests in container
|
|
# Unlike the native job above, this one drops all of client/ui including
|
|
# the subpackages: the alpine container has no gtk4/webkitgtk, so the
|
|
# Wails application package they import would fail to link.
|
|
env:
|
|
HOST_GOCACHE: ${{ steps.go-env.outputs.cache_dir }}
|
|
HOST_GOMODCACHE: ${{ steps.go-env.outputs.modcache_dir }}
|
|
CONTAINER: "true"
|
|
run: |
|
|
CONTAINER_GOCACHE="/root/.cache/go-build"
|
|
CONTAINER_GOMODCACHE="/go/pkg/mod"
|
|
|
|
docker run --rm \
|
|
--cap-add=NET_ADMIN \
|
|
--privileged \
|
|
-v $PWD:/app \
|
|
-w /app \
|
|
-v "${HOST_GOCACHE}:${CONTAINER_GOCACHE}" \
|
|
-v "${HOST_GOMODCACHE}:${CONTAINER_GOMODCACHE}" \
|
|
-e CGO_ENABLED=1 \
|
|
-e CI=true \
|
|
-e DOCKER_CI=true \
|
|
-e GOARCH=${GOARCH_TARGET} \
|
|
-e GOCACHE=${CONTAINER_GOCACHE} \
|
|
-e GOMODCACHE=${CONTAINER_GOMODCACHE} \
|
|
-e CONTAINER=${CONTAINER} \
|
|
golang:1.26.10-alpine \
|
|
sh -c ' \
|
|
apk update; apk add --no-cache \
|
|
ca-certificates iptables ip6tables dbus dbus-dev libpcap-dev build-base; \
|
|
go test -buildvcs=false -tags "devcert privileged" -v -timeout 10m -p 1 $(go list -e -buildvcs=false ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /upload-server -e /client/testutil/privileged)
|
|
'
|
|
|
|
test_relay:
|
|
name: "Relay / Unit"
|
|
needs: [build-cache]
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- arch: "386"
|
|
raceFlag: ""
|
|
- arch: "amd64"
|
|
raceFlag: "-race"
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Install dependencies
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
run: sudo apt update && sudo apt install -y gcc-multilib g++-multilib libc6-dev-i386
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
- name: Test
|
|
run: |
|
|
CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
|
|
go test ${{ matrix.raceFlag }} \
|
|
-exec 'sudo' -coverprofile=coverage.txt \
|
|
-timeout 10m -p 1 ./relay/... ./shared/relay/...
|
|
|
|
- name: Upload coverage reports to Codecov
|
|
if: matrix.arch == 'amd64'
|
|
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
|
|
with:
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
slug: netbirdio/netbird
|
|
flags: unit,relay
|
|
|
|
test_proxy:
|
|
name: "Proxy / Unit"
|
|
needs: [build-cache]
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch: ["386", "amd64"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Install dependencies
|
|
run: sudo apt update && sudo apt install -y gcc-multilib g++-multilib libc6-dev-i386
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
- name: Test
|
|
run: |
|
|
CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
|
|
go test -timeout 10m -p 1 -coverprofile=coverage.txt ./proxy/...
|
|
|
|
- name: Upload coverage reports to Codecov
|
|
if: matrix.arch == 'amd64'
|
|
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
|
|
with:
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
slug: netbirdio/netbird
|
|
flags: unit,proxy
|
|
|
|
test_signal:
|
|
name: "Signal / Unit"
|
|
needs: [build-cache]
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch: ["386", "amd64"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Install dependencies
|
|
if: steps.cache.outputs.cache-hit != 'true'
|
|
run: sudo apt update && sudo apt install -y gcc-multilib g++-multilib libc6-dev-i386
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
- name: Test
|
|
run: |
|
|
CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
|
|
go test \
|
|
-exec 'sudo' -coverprofile=coverage.txt \
|
|
-timeout 10m ./signal/... ./shared/signal/...
|
|
|
|
- name: Upload coverage reports to Codecov
|
|
if: matrix.arch == 'amd64'
|
|
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
|
|
with:
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
slug: netbirdio/netbird
|
|
flags: unit,signal
|
|
|
|
test_management:
|
|
name: "Management / Unit"
|
|
needs: [build-cache]
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch: ["amd64"]
|
|
store: ["sqlite", "postgres"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
- name: Login to Docker hub
|
|
if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USER }}
|
|
password: ${{ secrets.DOCKER_TOKEN }}
|
|
|
|
- name: docker login for root user
|
|
if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
|
|
env:
|
|
DOCKER_USER: ${{ secrets.DOCKER_USER }}
|
|
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
|
run: echo "$DOCKER_TOKEN" | sudo docker login --username "$DOCKER_USER" --password-stdin
|
|
|
|
# The -json stream goes through tools/gotestsummary so the log shows one
|
|
# line per test, the output of failed tests, the head of a timeout panic
|
|
# with the still-running tests, and the slowest tests per package.
|
|
- name: Test
|
|
shell: bash
|
|
run: |
|
|
set -o pipefail
|
|
CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
|
|
NETBIRD_STORE_ENGINE=${{ matrix.store }} \
|
|
CI=true \
|
|
go test -json -tags=devcert -coverprofile=coverage.txt \
|
|
-exec "sudo --preserve-env=CI,NETBIRD_STORE_ENGINE" \
|
|
-timeout 20m ./management/... ./shared/management/... \
|
|
| tee management-test-events.jsonl \
|
|
| go run ./tools/gotestsummary
|
|
|
|
# The summary trims long outputs; the raw stream keeps every line for
|
|
# the failures that need it. A green run has no use for it.
|
|
- name: Upload raw test events
|
|
if: failure()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
|
|
with:
|
|
name: management-unit-test-events-${{ matrix.store }}
|
|
path: management-test-events.jsonl
|
|
if-no-files-found: ignore
|
|
retention-days: 14
|
|
|
|
- name: Upload coverage reports to Codecov
|
|
if: matrix.arch == 'amd64'
|
|
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
|
|
with:
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
slug: netbirdio/netbird
|
|
flags: unit,management
|
|
|
|
benchmark:
|
|
name: "Management / Benchmark"
|
|
needs: [build-cache]
|
|
if: ${{ needs.build-cache.outputs.management == 'true' || github.event_name != 'pull_request' }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch: ["amd64"]
|
|
store: ["sqlite", "postgres"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Create Docker network
|
|
run: docker network create promnet
|
|
|
|
- name: Start Prometheus Pushgateway
|
|
run: docker run -d --name pushgateway --network promnet -p 9091:9091 prom/pushgateway
|
|
|
|
- name: Start Prometheus (for Pushgateway forwarding)
|
|
run: |
|
|
echo '
|
|
global:
|
|
scrape_interval: 15s
|
|
scrape_configs:
|
|
- job_name: "pushgateway"
|
|
static_configs:
|
|
- targets: ["pushgateway:9091"]
|
|
remote_write:
|
|
- url: ${{ secrets.GRAFANA_URL }}
|
|
basic_auth:
|
|
username: ${{ secrets.GRAFANA_USER }}
|
|
password: ${{ secrets.GRAFANA_API_KEY }}
|
|
' > prometheus.yml
|
|
|
|
docker run -d --name prometheus --network promnet \
|
|
-v $PWD/prometheus.yml:/etc/prometheus/prometheus.yml \
|
|
-p 9090:9090 \
|
|
prom/prometheus
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
- name: Login to Docker hub
|
|
if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USER }}
|
|
password: ${{ secrets.DOCKER_TOKEN }}
|
|
|
|
- name: docker login for root user
|
|
if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
|
|
env:
|
|
DOCKER_USER: ${{ secrets.DOCKER_USER }}
|
|
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
|
run: echo "$DOCKER_TOKEN" | sudo docker login --username "$DOCKER_USER" --password-stdin
|
|
|
|
- name: Test
|
|
run: |
|
|
CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
|
|
NETBIRD_STORE_ENGINE=${{ matrix.store }} \
|
|
CI=true \
|
|
go test -tags devcert -run=^$ -bench=. \
|
|
-exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE,GIT_BRANCH,GITHUB_RUN_ID' \
|
|
-timeout 20m ./management/... ./shared/management/... $(go list ./management/... ./shared/management/... | grep -v -e /management/server/http)
|
|
env:
|
|
GIT_BRANCH: ${{ github.ref_name }}
|
|
|
|
api_benchmark:
|
|
name: "Management / Benchmark (API)"
|
|
needs: [build-cache]
|
|
if: ${{ needs.build-cache.outputs.management == 'true' || github.event_name != 'pull_request' }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch: ["amd64"]
|
|
store: ["sqlite", "postgres"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Create Docker network
|
|
run: docker network create promnet
|
|
|
|
- name: Start Prometheus Pushgateway
|
|
run: docker run -d --name pushgateway --network promnet -p 9091:9091 prom/pushgateway
|
|
|
|
- name: Start Prometheus (for Pushgateway forwarding)
|
|
run: |
|
|
echo '
|
|
global:
|
|
scrape_interval: 15s
|
|
scrape_configs:
|
|
- job_name: "pushgateway"
|
|
static_configs:
|
|
- targets: ["pushgateway:9091"]
|
|
remote_write:
|
|
- url: ${{ secrets.GRAFANA_URL }}
|
|
basic_auth:
|
|
username: ${{ secrets.GRAFANA_USER }}
|
|
password: ${{ secrets.GRAFANA_API_KEY }}
|
|
' > prometheus.yml
|
|
|
|
docker run -d --name prometheus --network promnet \
|
|
-v $PWD/prometheus.yml:/etc/prometheus/prometheus.yml \
|
|
-p 9090:9090 \
|
|
prom/prometheus
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
- name: Login to Docker hub
|
|
if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USER }}
|
|
password: ${{ secrets.DOCKER_TOKEN }}
|
|
|
|
- name: docker login for root user
|
|
if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
|
|
env:
|
|
DOCKER_USER: ${{ secrets.DOCKER_USER }}
|
|
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
|
run: echo "$DOCKER_TOKEN" | sudo docker login --username "$DOCKER_USER" --password-stdin
|
|
|
|
- name: Test
|
|
run: |
|
|
CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
|
|
NETBIRD_STORE_ENGINE=${{ matrix.store }} \
|
|
CI=true \
|
|
go test -tags=benchmark \
|
|
-run=^$ \
|
|
-bench=. \
|
|
-exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE,GIT_BRANCH,GITHUB_RUN_ID' \
|
|
-timeout 20m ./management/server/http/...
|
|
env:
|
|
GIT_BRANCH: ${{ github.ref_name }}
|
|
|
|
api_integration_test:
|
|
name: "Management / Integration"
|
|
needs: [build-cache]
|
|
if: ${{ needs.build-cache.outputs.management == 'true' || github.event_name != 'pull_request' }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
arch: ["amd64"]
|
|
store: ["sqlite", "postgres"]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: false
|
|
|
|
- name: Get Go environment
|
|
run: |
|
|
echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
|
|
echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
|
|
|
|
- name: Cache Go modules
|
|
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: |
|
|
${{ env.cache }}
|
|
${{ env.modcache }}
|
|
key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gotest-cache-
|
|
|
|
- name: Install modules
|
|
run: go mod tidy
|
|
|
|
- name: Run Mage
|
|
uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0
|
|
with:
|
|
install-only: true
|
|
|
|
- name: check git status
|
|
run: git --no-pager diff --exit-code
|
|
|
|
# Same summary as the unit job: a timeout here names the tests still
|
|
# running instead of ending in a goroutine dump.
|
|
- name: Test
|
|
shell: bash
|
|
run: |
|
|
set -o pipefail
|
|
CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
|
|
NETBIRD_STORE_ENGINE=${{ matrix.store }} \
|
|
CI=true \
|
|
mage integrationtest:all -gotestflags="-json -coverprofile=coverage.txt" \
|
|
| tee management-integration-test-events.jsonl \
|
|
| go run ./tools/gotestsummary
|
|
|
|
- name: Upload raw test events
|
|
if: failure()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
|
|
with:
|
|
name: management-integration-test-events-${{ matrix.store }}
|
|
path: management-integration-test-events.jsonl
|
|
if-no-files-found: ignore
|
|
retention-days: 14
|
|
|
|
- name: Upload coverage reports to Codecov
|
|
if: matrix.arch == 'amd64'
|
|
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
|
|
with:
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
slug: netbirdio/netbird
|
|
flags: integration,management
|