Repository navigation
Backport virtio activation #337
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: [pull_request, merge_group] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| preflight: | |
| name: preflight | |
| runs-on: ubuntu-latest | |
| outputs: | |
| full: ${{ steps.classify.outputs.full }} | |
| rust: ${{ steps.changes.outputs.rust }} | |
| cargo: ${{ steps.changes.outputs.cargo }} | |
| openapi: ${{ steps.changes.outputs.openapi }} | |
| dockerfile: ${{ steps.changes.outputs.dockerfile }} | |
| shell: ${{ steps.changes.outputs.shell }} | |
| ci: ${{ steps.changes.outputs.ci }} | |
| docs: ${{ steps.changes.outputs.docs }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - id: changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| with: | |
| filters: | | |
| rust: | |
| - '**/*.rs' | |
| - 'build.rs' | |
| - '**/Cargo.toml' | |
| - '**/Cargo.lock' | |
| - 'rust-toolchain.toml' | |
| cargo: | |
| - '**/Cargo.toml' | |
| - '**/Cargo.lock' | |
| openapi: | |
| - 'vmm/src/api/openapi/**' | |
| dockerfile: | |
| - 'resources/Dockerfile' | |
| shell: | |
| - '**/*.sh' | |
| - 'scripts/**' | |
| ci: | |
| - '.github/workflows/**' | |
| docs: | |
| - 'docs/**' | |
| - '**/*.md' | |
| - '.github/ISSUE_TEMPLATE/**' | |
| - 'LICENSES/**' | |
| - 'CODEOWNERS' | |
| - id: classify | |
| name: Classify changes | |
| run: | | |
| set -eufo pipefail | |
| full=false | |
| if [[ "${{ steps.changes.outputs.rust }}" == "true" \ | |
| || "${{ steps.changes.outputs.dockerfile }}" == "true" \ | |
| || "${{ steps.changes.outputs.shell }}" == "true" \ | |
| || "${{ steps.changes.outputs.ci }}" == "true" ]]; then | |
| full=true | |
| fi | |
| echo "full=$full" >> "$GITHUB_OUTPUT" | |
| echo "full=$full" | |
| dco: | |
| name: dco | |
| needs: [preflight] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python 3.x | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.x' | |
| - name: Check DCO | |
| if: github.event_name == 'pull_request' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -eufo pipefail | |
| pip3 install -U dco-check | |
| dco-check -e "49699333+dependabot[bot]@users.noreply.github.com" | |
| gitlint: | |
| name: gitlint | |
| needs: [preflight] | |
| # PR-only: gitlint needs GITHUB_BASE_REF, unset on merge_group. | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| # PR head, not the merge ref, so gitlint sees the PR's commits. | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| - name: Set up Python 3.10 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.10" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install --upgrade gitlint | |
| - name: Lint git commit messages | |
| run: | | |
| gitlint --commits "origin/$GITHUB_BASE_REF.." | |
| taplo: | |
| name: taplo | |
| needs: [preflight] | |
| if: needs.preflight.outputs.cargo == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Code checkout | |
| uses: actions/checkout@v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install build dependencies | |
| run: sudo apt-get update && sudo apt-get -yqq install build-essential libssl-dev | |
| - name: Install taplo | |
| run: cargo install taplo-cli --locked | |
| - name: Check formatting | |
| run: taplo fmt --check | |
| audit: | |
| name: audit | |
| needs: [preflight] | |
| if: needs.preflight.outputs.cargo == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions-rust-lang/audit@v1 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| shlint: | |
| name: shlint | |
| needs: [preflight] | |
| if: needs.preflight.outputs.shell == 'true' || needs.preflight.outputs.ci == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Run the shell script checkers | |
| uses: luizm/action-sh-checker@883217215b11c1fabbf00eb1a9a041f62d74c744 # v0.10.0 | |
| env: | |
| SHFMT_OPTS: -i 4 -d | |
| SHELLCHECK_OPTS: -x --source-path scripts | |
| hadolint: | |
| name: hadolint | |
| needs: [preflight] | |
| if: needs.preflight.outputs.dockerfile == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Lint Dockerfile | |
| uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 | |
| with: | |
| dockerfile: ./resources/Dockerfile | |
| format: tty | |
| no-fail: false | |
| verbose: true | |
| failure-threshold: info | |
| reuse: | |
| name: reuse | |
| needs: [preflight] | |
| if: needs.preflight.outputs.full == 'true' || needs.preflight.outputs.cargo == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: REUSE Compliance Check | |
| uses: fsfe/reuse-action@v6 | |
| formatting: | |
| name: formatting | |
| needs: [preflight] | |
| if: needs.preflight.outputs.full == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| rust: [nightly] | |
| target: | |
| - x86_64-unknown-linux-gnu | |
| - aarch64-unknown-linux-musl | |
| env: | |
| RUSTFLAGS: -D warnings | |
| steps: | |
| - name: Code checkout | |
| uses: actions/checkout@v6 | |
| - name: Install Rust toolchain (${{ matrix.rust }}) | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| components: rustfmt | |
| - name: Formatting (rustfmt) | |
| run: cargo fmt --all -- --check | |
| - name: Formatting (fuzz) (rustfmt) | |
| run: cargo fmt --all --manifest-path fuzz/Cargo.toml -- --check | |
| package-consistency: | |
| name: package-consistency | |
| needs: [preflight] | |
| if: needs.preflight.outputs.full == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Code checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install dependencies | |
| run: sudo apt install -y python3 | |
| - name: Install Rust toolchain stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| - name: Check Rust VMM Package Consistency of root Workspace | |
| run: python3 scripts/package-consistency-check.py github.com/rust-vmm | |
| - name: Check Rust VMM Package Consistency of fuzz Workspace | |
| run: | | |
| set -eufo pipefail | |
| pushd fuzz | |
| python3 ../scripts/package-consistency-check.py github.com/rust-vmm | |
| popd | |
| fuzz-build: | |
| name: fuzz-build | |
| needs: [preflight] | |
| if: needs.preflight.outputs.full == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| rust: [nightly] | |
| target: [x86_64-unknown-linux-gnu] | |
| env: | |
| RUSTFLAGS: -D warnings | |
| steps: | |
| - name: Code checkout | |
| uses: actions/checkout@v6 | |
| - name: Install Rust toolchain (${{ matrix.rust }}) | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| - name: Install Cargo fuzz | |
| run: cargo install cargo-fuzz | |
| - name: Fuzz Build | |
| run: cargo fuzz build | |
| - name: Fuzz Check | |
| run: cargo fuzz check | |
| openapi: | |
| name: openapi | |
| needs: [preflight] | |
| if: needs.preflight.outputs.openapi == 'true' | |
| runs-on: ubuntu-latest | |
| container: openapitools/openapi-generator-cli | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Validate OpenAPI | |
| run: | | |
| /usr/local/bin/docker-entrypoint.sh validate -i vmm/src/api/openapi/cloud-hypervisor.yaml | |
| typos: | |
| name: typos | |
| needs: [preflight] | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: crate-ci/typos@5374cbf686e897b15713110e233094e2874de7ef # v1.46.1 | |
| quality: | |
| name: quality | |
| needs: [preflight] | |
| if: needs.preflight.outputs.full == 'true' | |
| runs-on: ubuntu-latest | |
| # Beta clippy is non-blocking; continue-on-error below keeps the | |
| # aggregated needs.quality.result green when only beta fails. | |
| continue-on-error: ${{ matrix.experimental }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| rust: | |
| - stable | |
| target: | |
| - x86_64-unknown-linux-gnu | |
| include: | |
| - rust: stable | |
| experimental: false | |
| steps: | |
| - name: Code checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Rust toolchain (${{ matrix.rust }}) | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| override: true | |
| components: clippy | |
| - name: Bisectability Check (default features) | |
| if: ${{ github.event_name == 'pull_request' && matrix.target == 'x86_64-unknown-linux-gnu' }} | |
| run: | | |
| set -eufo pipefail | |
| commits=$(git rev-list origin/${{ github.base_ref }}..${{ github.sha }}) | |
| for commit in $commits; do git checkout $commit; cargo check --tests --examples --all --target=${{ matrix.target }}; done | |
| git checkout ${{ github.sha }} | |
| - name: Clippy (kvm) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --no-default-features --tests --examples --features "kvm" -- -D warnings | |
| - name: Clippy (mshv) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --no-default-features --tests --examples --features "mshv" -- -D warnings | |
| - name: Clippy (mshv + kvm) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --no-default-features --tests --examples --features "mshv,kvm" -- -D warnings | |
| - name: Clippy (default features) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --tests --examples -- -D warnings | |
| - name: Clippy (default features + guest_debug) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --tests --examples --features "guest_debug" -- -D warnings | |
| - name: Clippy (default features + pvmemcontrol) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --tests --examples --features "pvmemcontrol" -- -D warnings | |
| - name: Clippy (default features + tracing) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --tests --examples --features "tracing" -- -D warnings | |
| - name: Clippy (default features + fw_cfg) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --target=${{ matrix.target }} --locked --all --all-targets --tests --examples --features "fw_cfg" -- -D warnings | |
| - name: Clippy (default features + ivshmem) | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --tests --examples --features "ivshmem" -- -D warnings | |
| - name: Clippy (sev_snp) | |
| if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }} | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --no-default-features --tests --examples --features "sev_snp" -- -D warnings | |
| - name: Clippy (igvm) | |
| if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }} | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --no-default-features --tests --examples --features "igvm" -- -D warnings | |
| - name: Clippy (kvm + tdx) | |
| if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }} | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --no-default-features --tests --examples --features "tdx,kvm" -- -D warnings | |
| - name: Clippy (kvm + igvm + sev_snp + fw_cfg) | |
| if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }} | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| cross-version: 3e0957637b49b1bbced23ad909170650c5b70635 | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --no-default-features --tests --examples --features "kvm,igvm,sev_snp,fw_cfg" -- -D warnings | |
| - name: Clippy (default features + sev_snp + igvm + fw_cfg) | |
| if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }} | |
| uses: houseabsolute/actions-rust-cross@v1 | |
| with: | |
| command: clippy | |
| cross-version: 3e0957637b49b1bbced23ad909170650c5b70635 | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| args: --locked --all --all-targets --tests --examples --features "sev_snp,igvm,fw_cfg" -- -D warnings | |
| - name: Check build did not modify any files | |
| run: test -z "$(git status --porcelain)" | |
| build: | |
| name: build | |
| needs: [preflight] | |
| if: needs.preflight.outputs.full == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| rust: | |
| - stable | |
| target: | |
| - x86_64-unknown-linux-gnu | |
| steps: | |
| - name: Code checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install musl-gcc | |
| run: sudo apt install -y musl-tools | |
| - name: Install Rust toolchain (${{ matrix.rust }}) | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ matrix.rust }} | |
| target: ${{ matrix.target }} | |
| - name: Build (default features) | |
| run: cargo build --locked --bin cloud-hypervisor | |
| - name: Build (kvm) | |
| run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "kvm" | |
| - name: Build (default features + tdx) | |
| run: cargo build --locked --bin cloud-hypervisor --features "tdx" | |
| - name: Build (default features + dbus_api) | |
| run: cargo build --locked --bin cloud-hypervisor --features "dbus_api" | |
| - name: Build (default features + guest_debug) | |
| run: cargo build --locked --bin cloud-hypervisor --features "guest_debug" | |
| - name: Build (default features + pvmemcontrol) | |
| run: cargo build --locked --bin cloud-hypervisor --features "pvmemcontrol" | |
| - name: Build (default features + fw_cfg) | |
| run: cargo build --locked --bin cloud-hypervisor --features "fw_cfg" | |
| - name: Build (default features + ivshmem) | |
| run: cargo build --locked --bin cloud-hypervisor --features "ivshmem" | |
| - name: Build (mshv) | |
| run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "mshv" | |
| - name: Build (sev_snp) | |
| run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "sev_snp" | |
| - name: Build (kvm + igvm + sev_snp + fw_cfg) | |
| run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "kvm,igvm,sev_snp,fw_cfg" | |
| - name: Build (igvm) | |
| run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "igvm" | |
| - name: Build (mshv + kvm) | |
| run: cargo build --locked --bin cloud-hypervisor --no-default-features --features "mshv,kvm" | |
| - name: Release Build (default features) | |
| run: cargo build --locked --all --release --target=${{ matrix.target }} | |
| - name: Check build did not modify any files | |
| run: test -z "$(git status --porcelain)" | |
| integration-x86-64-pr: | |
| name: integration-x86-64-pr | |
| needs: [preflight, dco, quality, build] | |
| if: >- | |
| needs.preflight.outputs.full == 'true' && needs.dco.result == 'success' && needs.quality.result == 'success' && needs.build.result == 'success' | |
| timeout-minutes: 30 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Code checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run unit tests | |
| run: scripts/dev_cli.sh tests --unit --libc gnu | |
| # The single required-status check. Branch protection requires this one job. | |
| all-green: | |
| name: all-green | |
| needs: | |
| - audit | |
| - build | |
| - dco | |
| - formatting | |
| - fuzz-build | |
| - gitlint | |
| - hadolint | |
| - integration-x86-64-pr | |
| - openapi | |
| - package-consistency | |
| - preflight | |
| - quality | |
| - reuse | |
| - shlint | |
| - taplo | |
| - typos | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify all dependencies succeeded or were skipped | |
| env: | |
| NEEDS_JSON: ${{ toJson(needs) }} | |
| run: | | |
| set -eufo pipefail | |
| echo "$NEEDS_JSON" | jq . | |
| # success or skipped = pass; failure or cancelled = red. | |
| echo "$NEEDS_JSON" | jq -e ' | |
| to_entries | |
| | map(select(.value.result != "success" and .value.result != "skipped")) | |
| | length == 0 | |
| ' >/dev/null |