Patrick Lodder a680438a24
ci: enable security and symbol checks for all supported targets
This enables running of security checks for macOS and symbol
checks for windows and ARM linux targets with each CI run.

Symbol checks remain disabled for debug and experimental targets
because those aren't production binary releases.

macOS symbol checks need build system patches before it will
work as intended so these have to stay disabled at this point.
2023-01-22 03:56:49 +01:00

319 lines
12 KiB
YAML

name: Continuous Integration
on:
push:
paths-ignore:
- '**/*.md'
pull_request:
paths-ignore:
- 'doc/**'
- 'contrib/**'
- '**/*.md'
jobs:
build:
name: ${{ matrix.name }}
env:
MAKEJOBS: "-j3"
CHECK_DOC: "0"
CCACHE_SIZE: "100M"
CCACHE_TEMPDIR: /tmp/.ccache-temp
CCACHE_COMPRESS: "1"
PYTHON_DEBUG: "1"
CACHE_NONCE: "1"
WINEDEBUG: fixme-all
SDK_URL: https://depends.dogecoincore.org
BIONIC_LIEF_WHL: lief-0.12.3-cp36-cp36m-linux_x86_64.whl
strategy:
fail-fast: false
matrix:
name:
- aarch64-linux
- aarch64-linux-experimental
- aarch64-linux-sha512-experimental
- armhf-linux
- i686-linux
- i686-win
- x86_64-linux-dbg
- x86_64-linux-nowallet
- x86_64-macos
- x86_64-win
- x86_64-win-experimental
- x86_64-linux-experimental
include:
- name: i686-linux
host: i686-pc-linux-gnu
os: ubuntu-18.04
packages: g++-multilib bc python3-zmq
run-bench: true
test-script: |
make check $MAKEJOBS VERBOSE=1
qa/pull-tester/install-deps.sh
qa/pull-tester/rpc-tests.py --coverage
check-security: true
check-symbols: true
dep-opts: "NO_QT=1"
config-opts: "--enable-zmq --enable-glibc-back-compat LDFLAGS=-static-libstdc++"
goal: install
- name: armhf-linux
host: arm-linux-gnueabihf
os: ubuntu-18.04
packages: g++-arm-linux-gnueabihf qemu-user-static qemu-user
run-bench: false
test-script: |
qemu-arm -E LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib/ /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 src/test/test_dogecoin
check-security: true
check-symbols: true
dep-opts: "NO_QT=1"
config-opts: "--enable-glibc-back-compat LDFLAGS=-static-libstdc++"
goal: install
- name: aarch64-linux-experimental
host: aarch64-linux-gnu
os: ubuntu-18.04
packages: g++-aarch64-linux-gnu qemu-user-static qemu-user
run-bench: false
test-script: |
qemu-aarch64 -E LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib/ /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 src/test/test_dogecoin
check-security: true
check-symbols: false
dep-opts: "NO_QT=1"
config-opts: "--enable-experimental --with-armv8-crypto --enable-zmq --enable-glibc-back-compat LDFLAGS=-static-libstdc++"
goal: install
- name: aarch64-linux-sha512-experimental
host: aarch64-linux-gnu
os: ubuntu-20.04
packages: g++-aarch64-linux-gnu qemu-user-static qemu-user
run-bench: false
test-script: |
qemu-aarch64 -E LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib/ /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 src/test/test_dogecoin
check-security: true
check-symbols: false
dep-opts: "NO_QT=1"
config-opts: "--enable-experimental --with-armv82-crypto --enable-zmq --enable-glibc-back-compat LDFLAGS=-static-libstdc++"
goal: install
- name: aarch64-linux
host: aarch64-linux-gnu
os: ubuntu-18.04
packages: g++-aarch64-linux-gnu qemu-user-static qemu-user
run-bench: false
test-script: |
qemu-aarch64 -E LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib/ /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 src/test/test_dogecoin
check-security: true
check-symbols: true
dep-opts: "NO_QT=1"
config-opts: "--enable-zmq --enable-glibc-back-compat LDFLAGS=-static-libstdc++"
goal: install
- name: x86_64-linux-nowallet
host: x86_64-unknown-linux-gnu
os: ubuntu-18.04
packages: python3
run-bench: true
test-script: |
make check $MAKEJOBS VERBOSE=1
check-security: true
check-symbols: true
dep-opts: "NO_WALLET=1"
config-opts: "--with-gui=qt5 --enable-glibc-back-compat --disable-wallet LDFLAGS=-static-libstdc++"
goal: install
- name: x86_64-linux-dbg
host: x86_64-unknown-linux-gnu
os: ubuntu-18.04
packages: bc python3-zmq
run-bench: true
test-script: |
make check $MAKEJOBS VERBOSE=1
qa/pull-tester/install-deps.sh
qa/pull-tester/rpc-tests.py --coverage
check-security: true
check-symbols: false
dep-opts: "DEBUG=1"
config-opts: "--with-gui=qt5 --enable-zmq --enable-glibc-back-compat CPPFLAGS=-DDEBUG_LOCKORDER"
goal: install
- name: i686-win
host: i686-w64-mingw32
arch: "i386"
os: ubuntu-18.04
packages: python3 nsis g++-mingw-w64-i686 wine-stable bc wine-binfmt
postinstall: |
sudo dpkg -s mono-runtime && sudo apt-get remove mono-runtime || echo "Very nothing to uninstall."
sudo update-alternatives --set i686-w64-mingw32-gcc /usr/bin/i686-w64-mingw32-gcc-posix
sudo update-alternatives --set i686-w64-mingw32-g++ /usr/bin/i686-w64-mingw32-g++-posix
sudo update-binfmts --import /usr/share/binfmts/wine
run-bench: false
test-script: |
make check $MAKEJOBS VERBOSE=1
check-security: true
check-symbols: true
dep-opts: ""
config-opts: "--enable-gui=qt5"
goal: install
- name: x86_64-win
host: x86_64-w64-mingw32
arch: "i386"
os: ubuntu-18.04
packages: python3 nsis g++-mingw-w64-x86-64 wine64 bc wine-binfmt
postinstall: |
sudo dpkg -s mono-runtime && sudo apt-get remove mono-runtime || echo "Very nothing to uninstall."
sudo update-alternatives --set x86_64-w64-mingw32-gcc /usr/bin/x86_64-w64-mingw32-gcc-posix
sudo update-alternatives --set x86_64-w64-mingw32-g++ /usr/bin/x86_64-w64-mingw32-g++-posix
sudo update-binfmts --import /usr/share/binfmts/wine
run-bench: false
test-script: |
make check $MAKEJOBS VERBOSE=1
check-security: true
check-symbols: true
dep-opts: ""
config-opts: "--enable-gui=qt5"
goal: install
- name: x86_64-win-experimental
host: x86_64-w64-mingw32
arch: "i386"
os: ubuntu-18.04
packages: python3 nsis g++-mingw-w64-x86-64 wine64 bc wine-binfmt
postinstall: |
sudo dpkg -s mono-runtime && sudo apt-get remove mono-runtime || echo "Very nothing to uninstall."
sudo update-alternatives --set x86_64-w64-mingw32-gcc /usr/bin/x86_64-w64-mingw32-gcc-posix
sudo update-alternatives --set x86_64-w64-mingw32-g++ /usr/bin/x86_64-w64-mingw32-g++-posix
sudo update-binfmts --import /usr/share/binfmts/wine
run-bench: false
test-script: |
make check $MAKEJOBS VERBOSE=1
check-security: true
check-symbols: false
dep-opts: "AVX2=1 MINGW=1"
config-opts: "--enable-experimental --enable-scrypt-sse2 --with-intel-avx2 --with-gui=qt5"
goal: install
- name: x86_64-macos
host: x86_64-apple-darwin11
os: ubuntu-18.04
packages: cmake imagemagick libcap-dev librsvg2-bin libz-dev libtiff-tools libtinfo5 xorriso
run-bench: false
check-security: true
check-symbols: false
dep-opts: ""
config-opts: "--with-gui=qt5 --disable-tests"
goal: deploy
sdk: 10.11
sdk-shasum: "bec9d089ebf2e2dd59b1a811a38ec78ebd5da18cbbcd6ab39d1e59f64ac5033f"
- name: x86_64-linux-experimental
host: x86_64-linux-gnu
os: ubuntu-18.04
packages: bc python3-zmq
run-bench: true
test-script: |
make check $MAKEJOBS VERBOSE=1
qa/pull-tester/install-deps.sh
qa/pull-tester/rpc-tests.py --coverage
dep-opts: "AVX2=1"
config-opts: "--enable-experimental --enable-scrypt-sse2 --with-intel-avx2 --with-gui=qt5 --enable-zmq --enable-glibc-back-compat --enable-reduce-exports"
goal: install
runs-on: ${{ matrix.os }}
steps:
- name: Add architecture
if: ${{ matrix.arch }}
run: |
sudo dpkg --add-architecture "${{ matrix.arch }}"
- name: Install packages
run: |
sudo apt-get update
sudo apt-get install build-essential libtool autotools-dev automake \
pkg-config bsdmainutils curl ca-certificates ccache rsync git \
procps bison python3 python3-pip python3-setuptools python3-wheel
sudo apt-get install ${{ matrix.packages }}
python3 -m pip install setuptools --upgrade
- name: Install custom lief wheel
if: matrix.os == 'ubuntu-18.04'
run: python3 -m pip install $SDK_URL/$BIONIC_LIEF_WHL
- name: Install standard lief wheel
if: matrix.os != 'ubuntu-18.04'
run: python3 -m pip install lief
- name: Post install
if: ${{ matrix.postinstall }}
run: ${{ matrix.postinstall }}
- name: Checkout
uses: actions/checkout@v3
- name: SDK cache
if: ${{ matrix.sdk }}
uses: actions/cache@v3
env:
cache-name: sdk
with:
path: ./depends/sdk-sources
key: ${{ matrix.name }}-${{ env.cache-name }}-${{ hashFiles('.github/workflows/ci.yml') }}
- name: Install SDK
if: ${{ matrix.sdk }}
env:
sdk-filename: MacOSX${{ matrix.sdk }}.sdk.tar.gz
run: |
mkdir -p ./depends/sdk-sources
mkdir -p ./depends/SDKs
echo "${{ matrix.sdk-shasum }} depends/sdk-sources/${{ env.sdk-filename }}" | sha256sum -c || \
curl --location --fail $SDK_URL/${{ env.sdk-filename }} -o depends/sdk-sources/${{ env.sdk-filename }} &&\
echo "${{ matrix.sdk-shasum }} depends/sdk-sources/${{ env.sdk-filename }}" | sha256sum -c
tar -C depends/SDKs -xf depends/sdk-sources/${{ env.sdk-filename }}
- name: Dependency cache
uses: actions/cache@v3
env:
cache-name: depends
with:
path: ./depends/built
key: ${{ matrix.name }}-${{ env.cache-name }}-${{ hashFiles('depends/packages/*', '.github/workflows/ci.yml') }}
- name: Build depends
run: |
make $MAKEJOBS -C depends HOST=${{ matrix.host }} ${{ matrix.dep-opts }}
- name: CCache
uses: actions/cache@v3
env:
cache-name: ccache
with:
path: ~/.ccache
key: ${{ matrix.name }}-${{ env.cache-name }}-${{ hashFiles('**/configure.ac', '.github/workflows/ci.yml') }}
- name: Build Dogecoin
run: |
depends/${{ matrix.host }}/native/bin/ccache --max-size=$CCACHE_SIZE
./autogen.sh
./configure --prefix=`pwd`/depends/${{ matrix.host }} ${{ matrix.config-opts }} --enable-reduce-exports || ( cat config.log && false)
make $MAKEJOBS ${{ matrix.goal }} || ( echo "Build failure. Verbose build follows." && make ${{ matrix.goal }} V=1 ; false )
- name: Run benchmark
if: ${{ matrix.run-bench }}
run: |
src/bench/bench_dogecoin > ${{ matrix.name }}-bench.csv
cat ${{ matrix.name }}-bench.csv
- name: Run tests
if: ${{ matrix.test-script }}
run: ${{ matrix.test-script }}
- name: Check security
if: ${{ matrix.check-security }}
run: make -C src check-security
- name: Check symbols
if: ${{ matrix.check-symbols }}
run: make -C src check-symbols
- name: Upload artifacts
uses: actions/upload-artifact@v3
with:
name: dogecoin-${{ github.sha }}-${{ matrix.name }}
path: |
depends/${{ matrix.host }}/bin/dogecoin*
dist/Dogecoin-Qt.app
${{ matrix.name }}-bench.csv