Tyger

Fix `tyger run cancel` race condition #629

Workflow file for this run

	name: Tyger

	on:
	push:
	branches: [main]
	tags: ["v..*"]
	pull_request: # all branches
	workflow_dispatch:

	permissions:
	id-token: write
	contents: read

	env:
	AZURE_CLIENT_ID: 789b8572-1fae-4a5f-b376-6d9d14651245
	AZURE_TENANT_ID: 72f988bf-86f1-41af-91ab-2d7cd011db47
	AZURE_SUBSCRIPTION_ID: 87d8acb3-5176-4651-b457-6ab9cefd8e3d

	CAN_ACCESS_SECRETS: ${{ secrets.CAN_ACCESS_SECRETS }}

	jobs:

	# If this is running a Dependabot PR or PR from a fork, it we won't have access to secrets
	# nor will be be able to obtain a federated token to access Azure resources.
	# Therefore, in those cases, we use hosted runners with managed identity to access Azure resources.
	# We only want to use those when necessary since they are a lot slower to come up, so this job
	# determines what we should pass in to `runs-on` for jobs that access Azure resources.
	# Also, this repo is configured to require approvals for all workflowd external contributors, and we
	# should inspect the code in the PR before approving the run.
	test-azure-needs-hosted-runner:
	runs-on: ubuntu-latest
	outputs:
	AZURE_RUNS_ON_JSON: ${{ steps.set-vars.outputs.AZURE_RUNS_ON_JSON }}
	AZURE_RUNS_ON_WINDOWS_JSON: ${{ steps.set-vars.outputs.AZURE_RUNS_ON_WINDOWS_JSON }}
	steps:
	- id: set-vars
	run: \|
	if [[ -n "${CAN_ACCESS_SECRETS:-}" ]]; then
	AZURE_RUNS_ON_JSON='"ubuntu-latest"'
	AZURE_RUNS_ON_WINDOWS_JSON='"windows-latest"'
	else
	AZURE_RUNS_ON_JSON='["self-hosted", "1ES.Pool=tyger-gh-1es"]'
	AZURE_RUNS_ON_WINDOWS_JSON='["self-hosted", "1ES.Pool=tyger-gh-1es-windows"]'
	fi

	echo "AZURE_RUNS_ON_JSON=$AZURE_RUNS_ON_JSON" >> "$GITHUB_OUTPUT"
	echo "AZURE_RUNS_ON_WINDOWS_JSON=$AZURE_RUNS_ON_WINDOWS_JSON" >> "$GITHUB_OUTPUT"

	unit-tests-and-format:
	runs-on: ubuntu-latest
	defaults:
	run:
	shell: bash
	env:
	TYGER_MIN_NODE_COUNT: "1"
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- uses: actions/setup-go@v4
	with:
	go-version-file: cli/go.mod
	cache-dependency-path: cli/go.sum

	- uses: actions/setup-dotnet@v3
	with:
	global-json-file: server/global.json

	- name: Build and Verify format
	run: \|
	set -euo pipefail
	make restore
	make verify-format
	make install-cli

	- name: Run unit tests
	run: \|
	set -euo pipefail
	make unit-test

	- name: Generate NOTICE.txt
	run: \|
	set -euo pipefail

	scripts/generate-notice.sh
	if [[ `git status --porcelain` ]]; then
	git diff
	echo "ERROR: NOTICE.txt needs to be regenerated using scripts/generate-notice.sh"
	exit 1
	fi

	- name: Check copyright headers
	run: \|
	set -euo pipefail

	scripts/add-copyright-headers.sh
	if [[ `git status --porcelain` ]]; then
	git diff
	echo "ERROR: update copyright headers using scripts/add-cpopyright-headers.sh"
	exit 1
	fi

	- name: Build docs
	run: \|
	set -euo pipefail
	cd docs
	npm install
	npm run docs:build

	build-images:
	needs:
	- test-azure-needs-hosted-runner
	- get-config

	runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}

	env:
	EXPLICIT_IMAGE_TAG: ${{ needs.get-config.outputs.IMAGE_TAG }}
	steps:

	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Log in to Azure
	uses: ./.github/actions/login-azure

	- name: build images
	run: \|
	set -eo pipefail
	make -j 4 docker-build

	get-config:
	runs-on: ubuntu-latest
	defaults:
	run:
	shell: bash
	outputs:
	IMAGE_TAG: ${{ steps.tag.outputs.IMAGE_TAG }}
	TYGER_ENVIRONMENT_NAME: ${{ steps.set-variables.outputs.TYGER_ENVIRONMENT_NAME }}
	TYGER_URI: ${{ steps.set-variables.outputs.TYGER_URI }}
	DEVELOPER_CONFIG_BASE64: ${{ steps.set-variables.outputs.DEVELOPER_CONFIG_BASE64 }}
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Generate tag
	id: tag
	run: \|
	echo "IMAGE_TAG=$(date +'%Y%m%d%H%M%S')-$GITHUB_SHA" >> "$GITHUB_OUTPUT"

	- name: Set variables
	id: set-variables
	run: \|
	set -eo pipefail

	event_name="${{ github.event_name }}"
	if [ "$event_name" == "pull_request" ]; then
	# Reuse environment names so that we are not creating new Let's Encrypt certificate requests for each PR
	environment_name="tyger-gpr$(( (${{ github.event.pull_request.number }} % 15) + 38 ))"
	else
	environment_name="tygerwestus2"
	fi

	export TYGER_ENVIRONMENT_NAME="${environment_name}"

	tyger_uri=$(make -s get-tyger-uri)
	echo "TYGER_URI=$tyger_uri" >> "$GITHUB_OUTPUT"

	echo "TYGER_ENVIRONMENT_NAME=$environment_name" >> "$GITHUB_OUTPUT"
	echo "TYGER_ENVIRONMENT_NAME=$environment_name" >> "$GITHUB_ENV"

	# GitHub Actions thinks this holds a secret, which prevents us from using
	# it as an output variable. So we base64 encode it as a workaround.
	# There is no secret in this value.

	developer_config_base64=$(scripts/get-config.sh --dev -o json \| jq -c \| base64 -w 0)
	echo "DEVELOPER_CONFIG_BASE64=$developer_config_base64" >> "$GITHUB_OUTPUT"
	echo "DEVELOPER_CONFIG_BASE64=$developer_config_base64" >> "$GITHUB_ENV"

	up:
	needs:
	- test-azure-needs-hosted-runner
	- get-config
	runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
	defaults:
	run:
	shell: bash
	env:
	TYGER_MIN_NODE_COUNT: "1"
	DO_NOT_BUILD_IMAGES: "true"
	EXPLICIT_IMAGE_TAG: ${{ needs.get-config.outputs.IMAGE_TAG }}-amd64
	TYGER_ENVIRONMENT_NAME: ${{ needs.get-config.outputs.TYGER_ENVIRONMENT_NAME }}

	steps:

	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Log in to Azure
	uses: ./.github/actions/login-azure

	- name: Log in to ACR
	run: \|
	make login-wip-acr

	- uses: actions/setup-go@v4
	with:
	go-version-file: cli/go.mod
	cache-dependency-path: cli/go.sum

	- name: up
	run: \|
	set -euo pipefail
	make -s up INSTALL_CLOUD=true
	make -s migrate

	restore-scale-to-zero:
	needs:
	- test-azure-needs-hosted-runner
	- up
	- get-config
	runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
	defaults:
	run:
	shell: bash
	env:
	TYGER_ENVIRONMENT_NAME: ${{ needs.get-config.outputs.TYGER_ENVIRONMENT_NAME }}
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Log in to Azure
	uses: ./.github/actions/login-azure

	- uses: actions/setup-go@v4
	with:
	go-version-file: cli/go.mod
	cache-dependency-path: cli/go.sum

	- name: restore-scale-to-zero
	run: \|
	set -euo pipefail
	make -s ensure-environment

	integration-tests:
	needs:
	- test-azure-needs-hosted-runner
	- get-config
	- up
	runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
	env:
	TYGER_MIN_NODE_COUNT: "1"
	DO_NOT_BUILD_IMAGES: "true"
	EXPLICIT_IMAGE_TAG: ${{ needs.get-config.outputs.IMAGE_TAG }}-amd64
	TYGER_ENVIRONMENT_NAME: ${{ needs.get-config.outputs.TYGER_ENVIRONMENT_NAME }}
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Log in to Azure
	uses: ./.github/actions/login-azure

	- uses: actions/setup-go@v4
	with:
	go-version-file: cli/go.mod
	cache-dependency-path: cli/go.sum

	- name: Deploy and test
	run: \|
	set -euo pipefail
	make -s integration-test-no-up

	build-windows-binaries:
	runs-on: ubuntu-latest
	defaults:
	run:
	shell: bash
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- uses: actions/setup-go@v4
	with:
	go-version-file: cli/go.mod
	# use a different cache key for windows builds
	cache-dependency-path: \|
	cli/go.sum
	cli/go.mod

	- name: Build Windows Binaries
	run: \|
	set -eo pipefail

	export CGO_ENABLED=1
	export GOOS=windows
	export GOARCH=amd64

	make install-cli

	destination="${GITHUB_WORKSPACE}/windows-cli-tools"
	mkdir -p "$destination"
	cp -a "$(go env GOPATH)/bin/$(go env GOOS)_$(go env GOARCH)/." "$destination"

	- name: Archive windows-cli-tools
	uses: actions/upload-artifact@v4
	with:
	name: windows-cli-tools
	path: windows-cli-tools

	windows-smoke-tests:
	needs:
	- test-azure-needs-hosted-runner
	- get-config
	- build-windows-binaries
	- up
	runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_WINDOWS_JSON)}}
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Download artifacts
	uses: actions/download-artifact@v4
	with:
	name: windows-cli-tools
	path: windows-cli-tools

	- name: Log in to Azure
	uses: ./.github/actions/login-azure

	- name: Run smoke tests
	env:
	DEVELOPER_CONFIG_BASE64: ${{ needs.get-config.outputs.DEVELOPER_CONFIG_BASE64 }}
	TYGER_URI: ${{ needs.get-config.outputs.TYGER_URI }}
	shell: pwsh
	run: \|
	$ErrorActionPreference = "Stop"
	Set-StrictMode -Version Latest

	$env:PATH = "$env:GITHUB_WORKSPACE\windows-cli-tools;" + $env:PATH

	$developerConfig = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($env:DEVELOPER_CONFIG_BASE64)) \| ConvertFrom-Json

	$servicePrincipal = $developerConfig.testAppUri
	$keyVaultName = $developerConfig.keyVault
	$certificateName = $developerConfig.pkcs12CertSecret.name
	$certificateVersion = $developerConfig.pkcs12CertSecret.version

	# Run tests
	.\scripts\Test-CertificateLoginOnWindows.ps1 `
	-ServerUri $env:TYGER_URI `
	-ServicePrincipal $servicePrincipal `
	-KeyVaultName $keyVaultName `
	-CertificateName $certificateName `
	-CertificateVersion $certificateVersion

	verify-docker:
	runs-on: ubuntu-latest
	defaults:
	run:
	shell: bash
	env:
	TYGER_ENVIRONMENT_TYPE: docker
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- uses: actions/setup-go@v4
	with:
	go-version-file: cli/go.mod
	cache-dependency-path: cli/go.sum

	- uses: actions/setup-dotnet@v3
	with:
	global-json-file: server/global.json

	- name: "Build and test"
	run: \|
	set -euo pipefail
	make -s -j 4

	codeql:
	runs-on: ubuntu-latest
	if: github.repository == 'microsoft/tyger'
	defaults:
	run:
	shell: bash
	permissions:
	actions: read
	contents: read
	security-events: write

	strategy:
	fail-fast: false
	matrix:
	language: [ 'csharp', 'go' ]

	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- uses: actions/setup-go@v4
	if: matrix.language == 'go'
	with:
	go-version-file: cli/go.mod
	cache-dependency-path: cli/go.sum

	- uses: actions/setup-dotnet@v3
	with:
	global-json-file: server/global.json

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v2
	with:
	languages: ${{ matrix.language }}

	- name: "Build"
	run: \|
	set -euo pipefail
	make -s build-${{ matrix.language }}

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v2
	with:
	category: "/language:${{matrix.language}}"

	publishDocs:
	if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'microsoft/tyger'
	needs:
	- unit-tests-and-format
	- integration-tests
	- get-config
	- verify-docker
	- windows-smoke-tests

	runs-on: ubuntu-latest

	environment:
	name: github-pages
	url: ${{ steps.deployment.outputs.page_url }}

	# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
	permissions:
	contents: read
	pages: write
	id-token: write

	# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
	# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
	concurrency:
	group: "pages"
	cancel-in-progress: false

	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Build static page
	run: \|
	cd docs
	npm install
	npm run docs:build
	- name: Setup Pages
	uses: actions/configure-pages@v3
	- name: Upload artifact
	uses: actions/upload-pages-artifact@v2
	with:
	# Upload entire repository
	path: 'docs/.vitepress/dist'
	- name: Deploy to GitHub Pages
	id: deployment
	uses: actions/deploy-pages@v2

	release:
	if: startsWith(github.ref, 'refs/tags/')
	needs:
	- unit-tests-and-format
	- integration-tests
	- get-config
	- verify-docker
	- windows-smoke-tests
	environment:
	name: publish-container-images
	env:
	DEVELOPER_CONFIG_BASE64: ${{ needs.get-config.outputs.DEVELOPER_CONFIG_BASE64 }}
	permissions:
	contents: write
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- uses: actions/setup-go@v4
	with:
	go-version-file: cli/go.mod
	cache-dependency-path: cli/go.sum

	- name: get container registry
	run: \|
	set -euo pipefail
	official_pull_container_registry=$(echo "$DEVELOPER_CONFIG_BASE64" \| base64 -d \| jq -r '.officialPullContainerRegistry.fqdn')
	echo "OFFICIAL_PULL_CONTAINER_REGISTRY=$(echo $official_pull_container_registry)" >> $GITHUB_ENV
	official_pull_container_registry_directory=$(echo "$DEVELOPER_CONFIG_BASE64" \| base64 -d \| jq -r '.officialPullContainerRegistry.directory // ""')
	echo "OFFICIAL_PULL_CONTAINER_REGISTRY_DIRECTORY=$(echo $official_pull_container_registry_directory)" >> $GITHUB_ENV

	- name: test image published
	run: \|
	set -euo pipefail
	docker pull "${OFFICIAL_PULL_CONTAINER_REGISTRY}${OFFICIAL_PULL_CONTAINER_REGISTRY_DIRECTORY}/tyger-server:$(git describe --tags)"

	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@v5
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	version: v1.21.2
	workdir: cli
	args: release --clean

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix `tyger run cancel` race condition #629

Workflow file

Fix `tyger run cancel` race condition #629

Jobs

Run details

Workflow file for this run

Fix tyger run cancel race condition #629

Workflow file

Workflow file for this run

Fix `tyger run cancel` race condition #629