-
Notifications
You must be signed in to change notification settings - Fork 280
286 lines (273 loc) · 9.79 KB
/
ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
name: Continuous Integration
run-name: Triggered by ${{ github.actor }} on ${{ github.event_name }}
on:
pull_request:
merge_group:
types: [checks_requested]
workflow_call:
inputs:
stage:
required: true
type: string
profile:
required: true
type: string
env:
# mark:automatic-version
VERSION: "1.0.6"
# Cancel old workflow runs if new code is pushed
concurrency:
group: "ci-${{ github.event_name }}-${{ github.workflow }}-${{ github.ref }}"
cancel-in-progress: ${{ github.event_name != 'workflow_call' }}
jobs:
kotlin:
uses: ./.github/workflows/_kotlin.yml
secrets: inherit
swift:
uses: ./.github/workflows/_swift.yml
secrets: inherit
tauri:
uses: ./.github/workflows/_tauri.yml
secrets: inherit
elixir:
uses: ./.github/workflows/_elixir.yml
rust:
uses: ./.github/workflows/_rust.yml
secrets: inherit
static-analysis:
uses: ./.github/workflows/_static-analysis.yml
terraform:
uses: ./.github/workflows/_terraform.yml
secrets: inherit
codeql:
uses: ./.github/workflows/_codeql.yml
secrets: inherit
update-release-draft:
runs-on: ubuntu-22.04
outputs:
tag_name: ${{ steps.update-release-draft.outputs.tag_name }}
steps:
- uses: release-drafter/release-drafter@v6
id: update-release-draft
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
build-artifacts:
needs: update-release-draft
uses: ./.github/workflows/_build_artifacts.yml
secrets: inherit
with:
# Build debug/ on PRs and merge group, no prefix for production release images
image_prefix: ${{ ((github.event_name == 'pull_request' || github.event_name == 'merge_group') && 'debug') || '' }}
profile: ${{ inputs.profile || 'debug' }}
stage: ${{ inputs.stage || 'debug' }}
tag_name: ${{ needs.update-release-draft.outputs.tag_name }}
build-base-perf-artifacts:
needs: update-release-draft
if: ${{ github.event_name == 'pull_request' }}
uses: ./.github/workflows/_build_artifacts.yml
secrets: inherit
with:
sha: ${{ github.event.pull_request.base.sha }}
image_prefix: 'perf'
profile: 'release'
stage: 'debug'
tag_name: ${{ needs.update-release-draft.outputs.tag_name }}
build-head-perf-artifacts:
needs: update-release-draft
if: ${{ github.event_name == 'pull_request' }}
uses: ./.github/workflows/_build_artifacts.yml
secrets: inherit
with:
sha: ${{ github.sha }}
image_prefix: 'perf'
profile: 'release'
stage: 'debug'
tag_name: ${{ needs.update-release-draft.outputs.tag_name }}
integration-tests:
uses: ./.github/workflows/_integration_tests.yml
needs: build-artifacts
secrets: inherit
with:
gateway_image: ${{ needs.build-artifacts.outputs.gateway_image }}
client_image: ${{ needs.build-artifacts.outputs.client_image }}
relay_image: ${{ needs.build-artifacts.outputs.relay_image }}
snownet-tests:
needs: build-artifacts
if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
name: snownet-tests-${{ matrix.name }}
runs-on: ubuntu-22.04
permissions:
contents: read
id-token: write
pull-requests: write
env:
RELAY_TAG: ${{ github.sha }}
SNOWNET_TAG: ${{ github.sha }}
strategy:
fail-fast: false
matrix:
name:
- lan
- wan-hp
- wan-relay
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/gcp-docker-login
id: login
with:
project: firezone-staging
- name: Run docker-compose.${{ matrix.name }}.yml test
run: |
sudo sysctl -w vm.overcommit_memory=1
timeout 600 docker compose -f rust/snownet-tests/docker-compose.${{ matrix.name }}.yml up --exit-code-from dialer --abort-on-container-exit
compatibility-tests:
# Don't run compatibility tests when called from hotfix.yml or publish.yml on `main` because
# it'll be red if there was a breaking change we're tring to publish,
# and the deploy_production workflow checks for main to be green.
if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
uses: ./.github/workflows/_integration_tests.yml
needs: build-artifacts
secrets: inherit
with:
gateway_image: "ghcr.io/firezone/gateway"
gateway_tag: "latest"
client_image: "ghcr.io/firezone/client"
client_tag: "latest"
perf-tests:
# Only the debug images have perf tooling
if: ${{ github.event_name == 'pull_request' }}
name: perf-tests-${{ matrix.version.prefix }}-${{ matrix.test_name }}
needs:
- build-base-perf-artifacts
- build-head-perf-artifacts
runs-on: ubuntu-22.04
permissions:
contents: read
id-token: write
pull-requests: write
env:
API_IMAGE: 'us-east1-docker.pkg.dev/firezone-staging/firezone/api'
API_TAG: ${{ matrix.version.sha }}
WEB_IMAGE: 'us-east1-docker.pkg.dev/firezone-staging/firezone/web'
WEB_TAG: ${{ matrix.version.sha }}
ELIXIR_IMAGE: 'us-east1-docker.pkg.dev/firezone-staging/firezone/elixir'
ELIXIR_TAG: ${{ matrix.version.sha }}
GATEWAY_IMAGE: 'us-east1-docker.pkg.dev/firezone-staging/firezone/perf/gateway'
GATEWAY_TAG: ${{ matrix.version.sha }}
CLIENT_IMAGE: 'us-east1-docker.pkg.dev/firezone-staging/firezone/perf/client'
CLIENT_TAG: ${{ matrix.version.sha }}
RELAY_IMAGE: 'us-east1-docker.pkg.dev/firezone-staging/firezone/perf/relay'
RELAY_TAG: ${{ matrix.version.sha }}
strategy:
fail-fast: false
matrix:
version:
- sha: ${{ github.sha }}
prefix: head
- sha: ${{ github.event.pull_request.base.sha }}
prefix: base
test_name:
- direct-tcp-client2server
- direct-tcp-server2client
- direct-udp-client2server
- direct-udp-server2client
- relayed-tcp-client2server
- relayed-tcp-server2client
- relayed-udp-client2server
- relayed-udp-server2client
steps:
- uses: actions/checkout@v4
with:
ref: ${{ matrix.version.sha }}
- uses: ./.github/actions/gcp-docker-login
id: login
with:
project: firezone-staging
- name: Seed database
run:
docker compose run elixir /bin/sh -c 'cd apps/domain && mix ecto.seed'
- name: Start docker compose in the background
run: |
# We need to increase the log level to make sure that they don't hold off storm of packets
# generated by UDP tests. Wire is especially chatty.
sed -i 's/^\(\s*\)RUST_LOG:.*$/\1RUST_LOG: wire=error,info/' docker-compose.yml
cat docker-compose.yml | grep RUST_LOG
# Start services in the same order each time for the tests
docker compose up -d iperf3
docker compose up -d api web domain --no-build
docker compose up -d relay-1 relay-2 --no-build
docker compose up -d gateway --no-build
docker compose up -d client --no-build
- name: 'Performance test: ${{ matrix.test_name }}'
timeout-minutes: 5
env:
TEST_NAME: ${{ matrix.test_name }}
run: ./scripts/tests/perf/${{ matrix.test_name }}.sh
- name: 'Save performance test results: ${{ matrix.test_name }}'
uses: actions/upload-artifact@v4
with:
overwrite: true
name: ${{ matrix.test_name }}-${{ matrix.version.sha }}-iperf3results
path: ./${{ matrix.test_name }}.json
- name: Show Client logs
if: "!cancelled()"
run: docker compose logs client
- name: Show Client UDP stats
if: "!cancelled()"
run: docker compose exec client cat /proc/net/udp
- name: Show Relay-1 logs
if: "!cancelled()"
run: docker compose logs relay-1
- name: Show Relay-2 logs
if: "!cancelled()"
run: docker compose logs relay-2
- name: Show Gateway logs
if: "!cancelled()"
run: docker compose logs gateway
- name: Show Gateway UDP stats
if: "!cancelled()"
run: docker compose exec gateway cat /proc/net/udp
- name: Show API logs
if: "!cancelled()"
run: docker compose logs api
- name: Show iperf3 logs
if: "!cancelled()"
run: docker compose logs iperf3
compare-results:
if: github.event_name == 'pull_request'
needs: perf-tests
runs-on: ubuntu-22.04
permissions:
contents: read
id-token: write
pull-requests: write
steps:
- uses: actions/checkout@v4
- name: Download base ref performance test results
uses: actions/download-artifact@v4
with:
pattern: '*-${{ github.event.pull_request.base.sha }}-iperf3results'
merge-multiple: true
path: ./${{ github.event.pull_request.base.sha }}
- name: Download head ref performance test results
uses: actions/download-artifact@v4
with:
pattern: '*-${{ github.sha }}-iperf3results'
merge-multiple: true
path: ./${{ github.sha }}
- name: Update PR with results
uses: actions/github-script@v7
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const { script } = require('./scripts/tests/perf/results.js');
script(github, context, '${{ github.event.pull_request.base.sha }}', '${{ github.sha }}', [
'direct-tcp-client2server',
'direct-tcp-server2client',
'direct-udp-client2server',
'direct-udp-server2client',
'relayed-tcp-client2server',
'relayed-tcp-server2client',
'relayed-udp-client2server',
'relayed-udp-server2client'
]);