Skip to content

test: CON-1433 Enable cup_compatibility_test for new NiDkgTag::HighThresholdForKey #20050

test: CON-1433 Enable cup_compatibility_test for new NiDkgTag::HighThresholdForKey

test: CON-1433 Enable cup_compatibility_test for new NiDkgTag::HighThresholdForKey #20050

Workflow file for this run

name: CI Main
on:
merge_group:
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
push:
branches:
- master
- 'dev-gh-*'
pull_request:
branches-ignore:
- hotfix-* # This is to ensure that this workflow is not triggered twice on ic-private, as it's already triggered from release-testing
# Used as reusable workflow within release-testing workflow
workflow_call:
# runs for the same workflow are cancelled on PRs but not on master
# explanation: on push to master head_ref is not set, so we want it to fall back to run_id so it is not cancelled
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
env:
CI_COMMIT_SHA: ${{ github.sha }}
CI_JOB_NAME: ${{ github.job }}
CI_JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
CI_PIPELINE_SOURCE: ${{ github.event_name }}
CI_PROJECT_DIR: ${{ github.workspace }}
CI_EVENT_NAME: ${{ github.event_name }}
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
CI_RUN_ID: ${{ github.run_id }}
RUSTFLAGS: "--remap-path-prefix=${CI_PROJECT_DIR}=/ic"
BUILDEVENT_DATASET: "github-ci-dfinity"
jobs:
bazel-test-all:
name: Bazel Test All
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
options: >-
-e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
timeout-minutes: 90
runs-on:
group: zh1
labels: dind-large
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Login to Dockerhub
shell: bash
run: ./ci/scripts/docker-login.sh
env:
DOCKER_HUB_USER: ${{ vars.DOCKER_HUB_USER }}
DOCKER_HUB_PASSWORD_RO: ${{ secrets.DOCKER_HUB_PASSWORD_RO }}
- name: Set BAZEL_EXTRA_ARGS
shell: bash
run: |
set -xeuo pipefail
# Determine which tests to skip and append 'long_test' for pull requests, merge groups or push on dev-gh-*
EXCLUDED_TEST_TAGS=(
system_test_hourly
system_test_nightly
system_test_nightly_nns
system_test_staging
system_test_hotfix
system_test_benchmark
fuzz_test
fi_tests_nightly
nns_tests_nightly
)
if [[ "$CI_EVENT_NAME" =~ ^(pull_request|merge_group)$ ]]; then
if [[ "$CI_EVENT_NAME" == "merge_group" || "${RUN_ON_DIFF_ONLY:-}" == "true" ]]; then
EXCLUDED_TEST_TAGS+=(long_test)
fi
elif [[ "$CI_EVENT_NAME" == "push" ]] && [[ "$BRANCH_NAME" =~ ^dev-gh-.* ]]; then
EXCLUDED_TEST_TAGS+=(long_test)
fi
# Export excluded tags as environment variable for ci/bazel-scripts/diff.sh
echo "EXCLUDED_TEST_TAGS=${EXCLUDED_TEST_TAGS[*]}" >> $GITHUB_ENV
# Prepend tags with '-' and join them with commas for Bazel
TEST_TAG_FILTERS=$(IFS=,; echo "${EXCLUDED_TEST_TAGS[*]/#/-}")
# Determine BAZEL_EXTRA_ARGS based on event type or branch name
BAZEL_EXTRA_ARGS="--test_tag_filters=$TEST_TAG_FILTERS"
if [[ "${{ github.event_name }}" == 'merge_group' ]]; then
BAZEL_EXTRA_ARGS+=" --test_timeout_filters=short,moderate --flaky_test_attempts=3"
elif [[ $BRANCH_NAME =~ ^hotfix-.* ]]; then
BAZEL_EXTRA_ARGS+=" --test_timeout_filters=short,moderate"
else
BAZEL_EXTRA_ARGS+=" --keep_going"
fi
# Export BAZEL_EXTRA_ARGS to environment
echo "BAZEL_EXTRA_ARGS=$BAZEL_EXTRA_ARGS" >> $GITHUB_ENV
env:
RUN_ON_DIFF_ONLY: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'CI_ALL_BAZEL_TARGETS') }}
- name: Run Bazel Test All
id: bazel-test-all
uses: ./.github/actions/bazel-test-all/
env:
AWS_SHARED_CREDENTIALS_CONTENT: ${{ secrets.AWS_SHARED_CREDENTIALS_FILE }}
# Only run ci/bazel-scripts/diff.sh on PRs that are not labeled with "CI_ALL_BAZEL_TARGETS".
OVERRIDE_DIDC_CHECK: ${{ contains(github.event.pull_request.labels.*.name, 'CI_OVERRIDE_DIDC_CHECK') }}
CI_OVERRIDE_BUF_BREAKING: ${{ contains(github.event.pull_request.labels.*.name, 'CI_OVERRIDE_BUF_BREAKING') }}
RUN_ON_DIFF_ONLY: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'CI_ALL_BAZEL_TARGETS') }}
with:
BAZEL_COMMAND: "test"
BAZEL_TARGETS: "//..."
BAZEL_CI_CONFIG: "--config=ci --repository_cache=/cache/bazel"
# check if PR title contains release and set timeout filters accordingly
BAZEL_EXTRA_ARGS: ${{ env.BAZEL_EXTRA_ARGS }}
BUILDEVENT_APIKEY: ${{ secrets.HONEYCOMB_API_TOKEN }}
- name: Upload bazel-bep
# runs only if previous step succeeded or failed;
# we avoid collecting artifacts of jobs that were cancelled
if: success() || failure()
uses: actions/upload-artifact@v4
with:
name: ${{ github.job }}-bep
retention-days: 14
if-no-files-found: ignore
compression-level: 9
path: |
bazel-bep.pb
profile.json
- name: Upload bazel-targets
uses: actions/upload-artifact@v4
with:
name: bazel-targets
retention-days: 14
if-no-files-found: error
path: |
bazel-targets
bazel-build-all-config-check:
runs-on:
labels: dind-large
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
options: >-
-e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
timeout-minutes: 90
name: Bazel Build All Config Check
if: ${{ contains(github.event.pull_request.labels.*.name, 'CI_BUILD_CHECK') }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Login to Dockerhub
shell: bash
run: ./ci/scripts/docker-login.sh
env:
DOCKER_HUB_USER: ${{ vars.DOCKER_HUB_USER }}
DOCKER_HUB_PASSWORD_RO: ${{ secrets.DOCKER_HUB_PASSWORD_RO }}
- name: Run bazel build --config=check //rs/...
id: bazel-build-config-check
uses: ./.github/actions/bazel-test-all/
with:
BAZEL_COMMAND: "build"
BAZEL_TARGETS: "//rs/..."
BAZEL_CI_CONFIG: "--config=check --config=ci --keep_going"
- name: Upload bazel-bep
# runs only if previous step succeeded or failed;
# we avoid collecting artifacts of jobs that were cancelled
if: success() || failure()
uses: actions/upload-artifact@v4
with:
name: ${{ github.job }}-bep
retention-days: 14
if-no-files-found: ignore
compression-level: 9
path: |
bazel-bep.pb
profile.json
bazel-test-macos-intel:
name: Bazel Test macOS Intel
timeout-minutes: 130
runs-on:
labels: macOS
# Run on protected branches, but only on public repo
if: ${{ github.ref_protected && github.repository == 'dfinity/ic' }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Set PATH
run: |
echo "/usr/local/bin" >> $GITHUB_PATH
echo "$HOME/.cargo/bin:" >> $GITHUB_PATH
- name: Login to Dockerhub
shell: bash
run: ./ci/scripts/docker-login.sh
env:
DOCKER_HUB_USER: ${{ vars.DOCKER_HUB_USER }}
DOCKER_HUB_PASSWORD_RO: ${{ secrets.DOCKER_HUB_PASSWORD_RO }}
- name: Run Bazel Test Darwin x86-64
id: bazel-test-darwin-x86-64
uses: ./.github/actions/bazel-test-all/
env:
AWS_SHARED_CREDENTIALS_CONTENT: ${{ secrets.AWS_SHARED_CREDENTIALS_FILE }}
with:
BAZEL_CI_CONFIG: "--config=ci --config macos_ci"
BAZEL_COMMAND: test
BAZEL_EXTRA_ARGS: '--test_tag_filters=test_macos'
BAZEL_STARTUP_ARGS: "--output_base /var/tmp/bazel-output/${CI_RUN_ID}"
BAZEL_TARGETS: "//rs/... //publish/binaries/..."
BUILDEVENT_APIKEY: ${{ secrets.HONEYCOMB_API_TOKEN }}
- name: Upload bazel-bep
# runs only if previous step succeeded or failed;
# we avoid collecting artifacts of jobs that were cancelled
if: success() || failure()
uses: actions/upload-artifact@v4
with:
name: ${{ github.job }}-bep
retention-days: 14
if-no-files-found: ignore
compression-level: 9
path: |
bazel-bep.pb
profile.json
- name: Purge Bazel Output
if: always()
shell: bash
run: |
sudo rm -rf /private/var/tmp/bazel-output
bazel-build-fuzzers:
name: Bazel Build Fuzzers
runs-on:
labels: dind-large
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
options: >-
-e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
timeout-minutes: 90
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Run Bazel Build Fuzzers
id: bazel-build-fuzzers
uses: ./.github/actions/bazel-test-all/
with:
BAZEL_COMMAND: "build"
BAZEL_TARGETS: "//rs/..."
BAZEL_EXTRA_ARGS: "--keep_going --config=fuzzing --build_tag_filters=libfuzzer"
BUILDEVENT_APIKEY: ${{ secrets. HONEYCOMB_API_TOKEN }}
- name: Upload bazel-bep
# runs only if previous step succeeded or failed;
# we avoid collecting artifacts of jobs that were cancelled
if: success() || failure()
uses: actions/upload-artifact@v4
with:
name: ${{ github.job }}-bep
retention-days: 14
if-no-files-found: ignore
compression-level: 9
path: |
bazel-bep.pb
profile.json
bazel-build-fuzzers-afl:
name: Bazel Build Fuzzers AFL
runs-on:
labels: dind-large
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
options: >-
-e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
timeout-minutes: 90
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Run Bazel Build Fuzzers AFL
id: bazel-build-fuzzers-afl
uses: ./.github/actions/bazel-test-all/
with:
BAZEL_COMMAND: "build"
BAZEL_TARGETS: "//rs/..."
BAZEL_EXTRA_ARGS: "--keep_going --config=afl"
BUILDEVENT_APIKEY: ${{ secrets. HONEYCOMB_API_TOKEN }}
- name: Upload bazel-bep
# runs only if previous step succeeded or failed;
# we avoid collecting artifacts of jobs that were cancelled
if: success() || failure()
uses: actions/upload-artifact@v4
with:
name: ${{ github.job }}-bep
retention-days: 14
if-no-files-found: ignore
compression-level: 9
path: |
bazel-bep.pb
profile.json
python-ci-tests:
name: Python CI Tests
runs-on:
labels: dind-small
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
timeout-minutes: 30
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Run Python CI Tests
id: python-ci-tests
shell: bash
run: |
set -xeuo pipefail
export PYTHONPATH=$PWD/ci/src:$PWD/ci/src/dependencies
# Ignore externally-managed-environment pip error, install packages system-wide.
PIP_BREAK_SYSTEM_PACKAGES=1 pip3 install --ignore-installed -r requirements.txt
cd ci/src
pytest -m "not fails_on_merge_train" -v -o junit_family=xunit1 \
--junitxml=../../test_report.xml --cov=. --cov-report=term \
--cov-report=term-missing --cov-report=html --cov-branch
env:
CI_COMMIT_REF_PROTECTED: ${{ github.ref_protected }}
CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
REPO_NAME: ${{ github.repository }}
build-ic:
name: Build IC
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
options: >-
-e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
timeout-minutes: 90
# keep options from dind-large-setup but run on dind-small-setup
runs-on:
group: ch1
labels: dind-small
if: ${{ github.event_name != 'merge_group' }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Login to Dockerhub
shell: bash
run: ./ci/scripts/docker-login.sh
env:
DOCKER_HUB_USER: ${{ vars.DOCKER_HUB_USER }}
DOCKER_HUB_PASSWORD_RO: ${{ secrets.DOCKER_HUB_PASSWORD_RO }}
- name: Run Build IC
id: build-ic
shell: bash
run: |
set -eExuo pipefail
[ -n "${NODE_NAME:-}" ] && echo "Run on node: $NODE_NAME" >>$GITHUB_STEP_SUMMARY
REPO_NAME="${GITHUB_REPOSITORY##*/}"
rm -rf "/cache/job/${CI_JOB_NAME}/${CI_RUN_ID}"
mkdir -p "/cache/job/${CI_JOB_NAME}/${CI_RUN_ID}/artifacts"
ln -s "/cache/job/${CI_JOB_NAME}/${CI_RUN_ID}/artifacts" /__w/$REPO_NAME/$REPO_NAME/artifacts
buildevents cmd "$CI_RUN_ID" "$CI_JOB_NAME" build-command -- \
"$CI_PROJECT_DIR"/ci/scripts/run-build-ic.sh
rm -rf "/cache/job/${CI_JOB_NAME}/${CI_RUN_ID}"
env:
BAZEL_COMMAND: "build"
MERGE_BASE_SHA: ${{ github.event.pull_request.base.sha }}
BUILDEVENT_APIKEY: ${{ secrets.HONEYCOMB_API_TOKEN }}
BRANCH_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
RUN_ON_DIFF_ONLY: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'CI_ALL_BAZEL_TARGETS') }}
- name: Upload build-ic.tar
uses: actions/upload-artifact@v4
with:
name: build-ic
retention-days: 1
if-no-files-found: error
path: |
build-ic.tar
build-determinism:
name: Build Determinism
runs-on: ubuntu-latest
timeout-minutes: 30
needs: [build-ic, bazel-test-all]
strategy:
matrix:
include:
- TARGET: "//publish/binaries:upload"
PATH0: "release"
PATH1: "build-ic/release"
SETUPOS_FLAG: "false"
- TARGET: "//publish/canisters:upload"
PATH0: "canisters"
PATH1: "build-ic/canisters"
SETUPOS_FLAG: "false"
- TARGET: "//ic-os/guestos/envs/prod:upload_disk-img"
PATH0: "guest-os/update-img"
PATH1: "build-ic/icos/guestos"
SETUPOS_FLAG: "false"
- TARGET: "//ic-os/hostos/envs/prod:upload_update-img"
PATH0: "host-os/update-img"
PATH1: "build-ic/icos/hostos"
SETUPOS_FLAG: "false"
- TARGET: "//ic-os/setupos/envs/prod:upload_disk-img"
PATH0: "setup-os/disk-img"
PATH1: "build-ic/icos/setupos"
SETUPOS_FLAG: "true"
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Download bazel-targets [bazel-test-all]
uses: actions/download-artifact@v4
with:
name: bazel-targets
- name: Download build-ic.tar [build-ic]
uses: actions/download-artifact@v4
with:
name: build-ic
- name: Build Determinism Test
id: build-determinism
shell: bash
run: |
set -eExuo pipefail
sudo apt update && sudo apt install -y curl
"$CI_PROJECT_DIR"/ci/scripts/build-determinism.sh
env:
TARGET: ${{ matrix.TARGET }}
PATH0: ${{ matrix.PATH0 }}
PATH1: ${{ matrix.PATH1 }}
SETUPOS_FLAG: ${{ matrix.SETUPOS_FLAG }}
cargo-clippy-linux:
name: Cargo Clippy Linux
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
timeout-minutes: 30
runs-on:
group: ch1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Filter Rust Files [*.{rs,toml,lock}]
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
id: filter
if: |
github.event_name == 'pull_request' ||
github.event_name == 'merge_group'
with:
filters: |
cargo:
- "**/*.rs"
- "**/*.toml"
- "**/*.lock"
- name: Run Cargo Clippy Linux
id: cargo-clippy-linux
if: |
steps.filter.outputs.cargo == 'true' ||
github.event_name == 'schedule' ||
github.event_name == 'workflow_dispatch'
shell: bash
env:
BUILDEVENT_APIKEY: ${{ secrets. HONEYCOMB_API_TOKEN }}
run: |
set -eExuo pipefail
buildevents cmd "$CI_RUN_ID" "$CI_JOB_NAME" build-command -- \
"$CI_PROJECT_DIR"/ci/scripts/rust-lint.sh
cargo-build-release-linux:
name: Cargo Build Release Linux
container:
image: ghcr.io/dfinity/ic-build@sha256:3cc80d1a2d5789b69f6a7f170280bb3763a54acce299430903f59718f904f273
timeout-minutes: 30
runs-on:
group: ch1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
- name: Filter Rust Files [*.{rs,toml,lock}]
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
id: filter
if: |
github.event_name == 'pull_request' ||
github.event_name == 'merge_group'
with:
filters: |
cargo:
- "**/*.rs"
- "**/*.toml"
- "**/*.lock"
- name: Run Cargo Build Release Linux
id: cargo-build-release-linux
if: |
steps.filter.outputs.cargo == 'true' ||
github.event_name == 'schedule' ||
github.event_name == 'workflow_dispatch'
shell: bash
env:
BUILDEVENT_APIKEY: ${{ secrets. HONEYCOMB_API_TOKEN }}
run: |
set -eExuo pipefail
buildevents cmd "$CI_RUN_ID" "$CI_JOB_NAME" build-command -- \
cargo build --release --locked