CI #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| - cron: "20 4 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Jobs that read the private edgeandnode/amp releases mint a short-lived | |
| # GitHub App token via .github/actions/ci-token, using the org-provided | |
| # AMP_APP_ID variable and AMP_APP_KEY secret (same mechanism as the amp | |
| # repository's own CI). | |
| jobs: | |
| lint: | |
| name: Lint (actionlint + shellcheck) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run actionlint | |
| # Pinned to the same actionlint version as .github/pre-commit-config.yaml | |
| run: | | |
| bash <(curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12 | |
| ./actionlint -color | |
| - name: Setup just | |
| uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 | |
| - name: Extract, syntax-check, and shellcheck action scripts | |
| run: just test-scripts | |
| - name: Upload extracted scripts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: action-scripts | |
| path: extracted/ | |
| dry-run: | |
| name: Script dry-run (${{ matrix.version }}) | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| # Fork PRs don't receive the AMP_APP_KEY secret needed to mint a token | |
| # that can read the private edgeandnode/amp releases; skip rather than | |
| # fail (lint still runs). | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # NOTE: 'nightly' is not tested — edgeandnode/amp currently publishes | |
| # nightly binaries only on draft releases, so published nightly tags | |
| # have no assets and resolution fails. Re-add once the release | |
| # pipeline publishes assets on non-draft nightlies. | |
| version: [stable, latest, none] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Mint CI token | |
| id: ci-token | |
| uses: ./.github/actions/ci-token | |
| with: | |
| app-id: ${{ vars.AMP_APP_ID }} | |
| app-key: ${{ secrets.AMP_APP_KEY }} | |
| - name: Download extracted scripts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: action-scripts | |
| path: extracted | |
| - name: Dry-run platform detection | |
| run: | | |
| out="$(mktemp)" | |
| envfile="$(mktemp)" | |
| GITHUB_OUTPUT="${out}" GITHUB_ENV="${envfile}" bash extracted/platform.sh | |
| grep -q '^platform=linux$' "${out}" | |
| grep -q '^arch=x86_64$' "${out}" | |
| grep -q '^amp-dir=' "${out}" | |
| grep -q '^AMP_DIR=' "${envfile}" | |
| - name: Dry-run version resolution (${{ matrix.version }}) | |
| env: | |
| SETUP_AMP_VERSION: ${{ matrix.version }} | |
| GITHUB_TOKEN: ${{ steps.ci-token.outputs.token }} | |
| run: | | |
| out="$(mktemp)" | |
| GITHUB_OUTPUT="${out}" bash extracted/version.sh | |
| case "${SETUP_AMP_VERSION}" in | |
| nightly) grep -q '^version=nightly-' "${out}" ;; | |
| none) grep -q '^version=none$' "${out}" ;; | |
| *) grep -q '^version=v' "${out}" ;; | |
| esac | |
| - name: Dry-run version resolution (unknown version) | |
| env: | |
| SETUP_AMP_VERSION: v999.999.999 | |
| GITHUB_TOKEN: ${{ steps.ci-token.outputs.token }} | |
| run: | | |
| out="$(mktemp)" | |
| if GITHUB_OUTPUT="${out}" bash extracted/version.sh; then | |
| echo "Expected version resolution to fail for an unknown version" | |
| exit 1 | |
| fi | |
| test: | |
| name: Install ${{ matrix.version || 'default' }} (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - ubuntu-24.04-arm | |
| - macos-latest | |
| - macos-15-intel | |
| version: | |
| # Empty string exercises the default version handling. | |
| # NOTE: 'nightly' is not tested — see the dry-run matrix note. | |
| - "" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Mint CI token | |
| id: ci-token | |
| uses: ./.github/actions/ci-token | |
| with: | |
| app-id: ${{ vars.AMP_APP_ID }} | |
| app-key: ${{ secrets.AMP_APP_KEY }} | |
| - name: Run setup-amp | |
| id: setup | |
| uses: ./ | |
| with: | |
| version: ${{ matrix.version }} | |
| github-token: ${{ steps.ci-token.outputs.token }} | |
| - name: Check resolved version output | |
| env: | |
| VERSION_INPUT: ${{ matrix.version }} | |
| VERSION_RESOLVED: ${{ steps.setup.outputs.version }} | |
| run: | | |
| echo "Resolved: '${VERSION_INPUT}' -> '${VERSION_RESOLVED}'" | |
| case "${VERSION_INPUT}" in | |
| nightly) | |
| case "${VERSION_RESOLVED}" in | |
| nightly-*) ;; | |
| *) echo "Expected a nightly-* tag"; exit 1 ;; | |
| esac | |
| ;; | |
| *) | |
| case "${VERSION_RESOLVED}" in | |
| v*) ;; | |
| *) echo "Expected a v* tag"; exit 1 ;; | |
| esac | |
| ;; | |
| esac | |
| - name: Check binaries are on PATH | |
| run: | | |
| command -v ampup | |
| command -v ampd | |
| ampd --version | |
| # ampctl and ampsql are optional per-release binaries | |
| if command -v ampctl > /dev/null; then | |
| ampctl --version | |
| else | |
| echo "ampctl is not included in this release" | |
| fi | |
| if command -v ampsql > /dev/null; then | |
| ampsql --version | |
| else | |
| echo "ampsql is not included in this release" | |
| fi | |
| test-explicit-version: | |
| name: Install explicit version tag | |
| runs-on: ubuntu-latest | |
| # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Mint CI token | |
| id: ci-token | |
| uses: ./.github/actions/ci-token | |
| with: | |
| app-id: ${{ vars.AMP_APP_ID }} | |
| app-key: ${{ secrets.AMP_APP_KEY }} | |
| - name: Pick the current stable tag | |
| id: pick | |
| env: | |
| GH_TOKEN: ${{ steps.ci-token.outputs.token }} | |
| run: echo "tag=$(gh api repos/edgeandnode/amp/releases/latest --jq .tag_name)" >> "$GITHUB_OUTPUT" | |
| - name: Run setup-amp | |
| id: setup | |
| uses: ./ | |
| with: | |
| version: ${{ steps.pick.outputs.tag }} | |
| github-token: ${{ steps.ci-token.outputs.token }} | |
| - name: Check the pinned version was installed | |
| env: | |
| EXPECTED: ${{ steps.pick.outputs.tag }} | |
| RESOLVED: ${{ steps.setup.outputs.version }} | |
| run: | | |
| [ "${RESOLVED}" = "${EXPECTED}" ] | |
| ampd --version | |
| test-ampup-only: | |
| name: Install ampup only (version none) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| # No github-token needed: 'none' only bootstraps ampup from its public repo | |
| - name: Run setup-amp | |
| id: setup | |
| uses: ./ | |
| with: | |
| version: none | |
| - name: Check only ampup is installed and on PATH | |
| env: | |
| VERSION_RESOLVED: ${{ steps.setup.outputs.version }} | |
| CACHE_HIT: ${{ steps.setup.outputs.cache-hit }} | |
| run: | | |
| command -v ampup | |
| ampup --version | |
| [ "${VERSION_RESOLVED}" = "none" ] | |
| [ "${CACHE_HIT}" = "false" ] | |
| if command -v ampd > /dev/null; then | |
| echo "Expected ampd to NOT be installed with version 'none'" | |
| exit 1 | |
| fi | |
| test-cache-save: | |
| name: Cache (save) | |
| runs-on: ubuntu-latest | |
| # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| outputs: | |
| version: ${{ steps.setup.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Mint CI token | |
| id: ci-token | |
| uses: ./.github/actions/ci-token | |
| with: | |
| app-id: ${{ vars.AMP_APP_ID }} | |
| app-key: ${{ secrets.AMP_APP_KEY }} | |
| - name: Run setup-amp | |
| id: setup | |
| uses: ./ | |
| with: | |
| github-token: ${{ steps.ci-token.outputs.token }} | |
| # No run_attempt in the key: 'Re-run failed jobs' must be able to | |
| # restore the cache saved by a previous attempt | |
| cache-key: setup-amp-ci-cache-test-${{ github.run_id }} | |
| - run: ampd --version | |
| test-cache-hit: | |
| name: Cache (hit) | |
| runs-on: ubuntu-latest | |
| needs: test-cache-save | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Mint CI token | |
| id: ci-token | |
| uses: ./.github/actions/ci-token | |
| with: | |
| app-id: ${{ vars.AMP_APP_ID }} | |
| app-key: ${{ secrets.AMP_APP_KEY }} | |
| - name: Run setup-amp | |
| id: setup | |
| uses: ./ | |
| with: | |
| version: ${{ needs.test-cache-save.outputs.version }} | |
| github-token: ${{ steps.ci-token.outputs.token }} | |
| cache-key: setup-amp-ci-cache-test-${{ github.run_id }} | |
| - name: Check the cache was hit | |
| env: | |
| CACHE_HIT: ${{ steps.setup.outputs.cache-hit }} | |
| run: | | |
| [ "${CACHE_HIT}" = "true" ] | |
| ampd --version | |
| test-cache-disabled: | |
| name: Cache (disabled) | |
| runs-on: ubuntu-latest | |
| # Fork PRs cannot read the private edgeandnode/amp releases; see dry-run | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Mint CI token | |
| id: ci-token | |
| uses: ./.github/actions/ci-token | |
| with: | |
| app-id: ${{ vars.AMP_APP_ID }} | |
| app-key: ${{ secrets.AMP_APP_KEY }} | |
| - name: Run setup-amp | |
| id: setup | |
| uses: ./ | |
| with: | |
| github-token: ${{ steps.ci-token.outputs.token }} | |
| cache: false | |
| - name: Check no cache was used | |
| env: | |
| CACHE_HIT: ${{ steps.setup.outputs.cache-hit }} | |
| run: | | |
| [ "${CACHE_HIT}" = "false" ] | |
| ampd --version | |
| test-unsupported-platform: | |
| name: Fails cleanly on Windows | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| # No token needed: the action fails at platform detection before any | |
| # release API access | |
| - name: Run setup-amp (expected to fail) | |
| id: setup | |
| continue-on-error: true | |
| uses: ./ | |
| - name: Check the action failed with a clear error | |
| shell: bash | |
| env: | |
| OUTCOME: ${{ steps.setup.outcome }} | |
| run: | | |
| if [ "${OUTCOME}" != "failure" ]; then | |
| echo "Expected the action to fail on Windows, but the outcome was '${OUTCOME}'" | |
| exit 1 | |
| fi |