Redact absolute trace_path from public runtime decisions #20
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: bpfcompat-example-hosted | |
| # Zero-infrastructure on-ramp: this runs the full QEMU VM compatibility gate on a | |
| # stock GitHub-hosted runner. No self-hosted runner is required. GitHub-hosted | |
| # Linux runners now expose /dev/kvm, so VM validation is hardware-accelerated; | |
| # if a runner ever lacks KVM, bpfcompat degrades to TCG software emulation | |
| # (correct results, slower) instead of failing. | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| paths: | |
| - "cmd/**" | |
| - "internal/**" | |
| - "validator/**" | |
| - "examples/**" | |
| - "matrices/**" | |
| - "vm/**" | |
| - "action.yml" | |
| - "Makefile" | |
| - "go.mod" | |
| - "go.sum" | |
| - ".github/workflows/bpfcompat-example-hosted.yml" | |
| permissions: | |
| contents: read | |
| jobs: | |
| compatibility-gate: | |
| name: Compatibility Gate (hosted runner) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Report KVM acceleration status | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ -e /dev/kvm ]]; then | |
| echo "::notice::/dev/kvm present - VM validation is hardware-accelerated." | |
| # Some hosted images expose /dev/kvm but the runner user is not in | |
| # the kvm group; loosen perms so QEMU can open it. | |
| sudo chmod 0666 /dev/kvm || true | |
| ls -l /dev/kvm || true | |
| else | |
| echo "::warning::/dev/kvm not found - falling back to TCG software emulation (slower, still correct)." | |
| fi | |
| - name: Install host dependencies | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| qemu-system-x86 qemu-utils clang llvm libbpf-dev libelf-dev zlib1g-dev \ | |
| pkg-config jq | |
| - name: Build validator and fixture artifacts | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| make validator-static | |
| make examples | |
| - name: Fetch VM image for dev-one profile | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| make vm-ubuntu-22 | |
| - name: Run bpfcompat action | |
| uses: ./ | |
| with: | |
| suite: suites/dev-functional.yaml | |
| suite-out: reports/ci-dev-functional-suite.json | |
| suite-markdown: reports/ci-dev-functional-suite.md | |
| # Short while we stabilize hosted-runner guest boot: a stuck VM fails | |
| # in ~5m instead of burning the full budget on the SSH-ready wait. | |
| timeout: 5m | |
| concurrency: "1" | |
| build: "true" | |
| - name: Dump guest serial + validator output on failure | |
| if: failure() | |
| shell: bash | |
| run: | | |
| echo "===== /dev/kvm ====="; ls -l /dev/kvm || true | |
| for f in $(find .bpfcompat -type f \( -name serial.log -o -name qemu.log -o -name validator.stderr -o -name validator-result.json \) 2>/dev/null); do | |
| echo "===== $f =====" | |
| tail -n 120 "$f" || true | |
| done | |
| - name: Upload reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: bpfcompat-reports-${{ github.run_id }} | |
| if-no-files-found: warn | |
| # Allowlist only — never `.bpfcompat/runs/**` wholesale: the per-run | |
| # dir also holds the generated SSH private key (id_ed25519), the | |
| # cloud-init seed, and the disk overlay, none of which belong in a | |
| # downloadable artifact. | |
| path: | | |
| reports/ci-dev-functional-suite.json | |
| reports/ci-dev-functional-suite.md | |
| reports/suites/dev-functional/*.json | |
| reports/suites/dev-functional/*.md | |
| .bpfcompat/runs/**/targets/**/serial.log | |
| .bpfcompat/runs/**/targets/**/qemu.log | |
| .bpfcompat/runs/**/targets/**/libbpf.log | |
| .bpfcompat/runs/**/targets/**/validator-result.json | |
| .bpfcompat/runs/**/targets/**/validator.stderr | |
| .bpfcompat/runs/**/targets/**/validator-exit-code |