Repository navigation
Update mise and other tools #164
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: k3s | |
| # Linux only, because k3s is a Linux Kubernetes distribution. | |
| # There is no Windows or macOS k3s to run this against, so that is a property of the thing under test rather | |
| # than a platform being switched off: the manifests are still generated on every platform by | |
| # `regen-verification`, drift-checked by `verification-check`, and schema-validated by `kubeconform-check`, all | |
| # of which run in the full check matrix. Only applying them to a live cluster is confined here. | |
| # | |
| # Path-gated because the job builds two release images from this repository (the hub and the web runner, the | |
| # latter linking V8) and that dominates its runtime. Running it on every pull request would add that cost to | |
| # changes that cannot affect the outcome. | |
| "on": | |
| pull_request: | |
| paths: | |
| # install-mise-tools and the two actions it runs on Linux before anything else. | |
| - .github/actions/add-swap/** | |
| - .github/actions/free-disk-space/** | |
| - .github/actions/install-mise-tools/** | |
| - .github/workflows/k3s.yaml | |
| # The `k3s-verify` task itself lives here. | |
| # A change to it must re-trigger this job rather than letting an edit to the verification steps ship | |
| # without ever having run them. | |
| - .mise/config.toml | |
| - services/ws-server/Dockerfile | |
| - services/ws-web-runner/Dockerfile | |
| - services/ws-test-server/src/bin/verify-math1.rs | |
| - utilities/cli/src/deployment_types/k3s.rs | |
| - utilities/cli/src/deployment_types/k3s_recovery.rs | |
| # What decides which machine runs what, and the compose stack `compose-verify` starts from it. | |
| - utilities/cli/src/deployment_types/docker_compose.rs | |
| - utilities/cli/src/placement.rs | |
| - verification/local/input/math1-multi.yaml | |
| - verification/local/output/math1-multi/Dockerfile | |
| - verification/local/output/math1-multi/compose.yaml | |
| - verification/local/output/math1-multi/k3s.yaml | |
| # What the limits are and how each format renders them, and the scenario both formats are held to. | |
| - utilities/cli/src/limits.rs | |
| - verification/local/input/math1-limits.yaml | |
| - verification/local/output/math1-limits/Dockerfile | |
| - verification/local/output/math1-limits/compose.yaml | |
| - verification/local/output/math1-limits/containerd-config-v3.toml.tmpl | |
| - verification/local/output/math1-limits/k3s.yaml | |
| # The published job's generator and the deployment it runs, for the same reason. | |
| - utilities/cli/src/deployment_types/mise.rs | |
| - verification/local/output/math1/Dockerfile | |
| - verification/local/output/math1/k3s.yaml | |
| - verification/published/output/math1/mise.toml | |
| # What the published-k3s job applies and builds, for the same reason as the local pair above. | |
| - verification/published/output/math1/Dockerfile | |
| - verification/published/output/math1/k3s.yaml | |
| - verification/published/input/math1-multi.yaml | |
| - verification/published/output/math1-multi/Dockerfile | |
| - verification/published/output/math1-multi/k3s.yaml | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: "${{ github.workflow }}-${{ github.ref }}" | |
| cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }} | |
| defaults: | |
| run: | |
| shell: bash --noprofile --norc -euo pipefail {0} | |
| env: | |
| MISE_ENV: dart,dotnet,java,js,kotlin,python,r,rust,zig | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| # Read-only pull of the maintainer-published ghcr.io mise-tools store (install-mise-tools restore step). | |
| # Never write: the stores are published only from a maintainer's machine via `mise run push-mise-tools`. | |
| permissions: | |
| contents: read | |
| packages: read | |
| # Two release image builds plus a cluster run, on a generous bound. | |
| # Neither Dockerfile is built by any other workflow, so this figure has no prior measurement to lean on; | |
| # the root-image builds in docker-linux.yaml take 39-47m for a comparable amount of work, and this leaves | |
| # room for the cluster on top. The multi-machine k3s and compose runs that follow reuse those builds from | |
| # the BuildKit cache, so they add the two runs and little else. | |
| timeout-minutes: 150 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Show MISE_ENV | |
| run: echo "MISE_ENV=$MISE_ENV" | |
| - name: Install mise + tools | |
| uses: $/.github/actions/install-mise-tools | |
| timeout-minutes: 60 | |
| with: | |
| github-token: ${{ github.token }} | |
| # The scenario image stages each module's built `pkg/`, which is a wasm-pack artifact and gitignored. | |
| # A fresh checkout has neither, so the image build fails on its own COPY: | |
| # failed to calculate checksum of ref ...: "/services/ws-modules/math1/pkg": not found | |
| # Only this scenario's two modules are built, not the whole `build-modules` glob, which would compile | |
| # every guest language's module for a job that stages two of them. | |
| - name: Build the math1 modules | |
| timeout-minutes: 30 | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: | | |
| mise run build-ws-math1-module | |
| mise run build-ws-math1-sender-module | |
| # The hub is built first and handed to the scenario image by reference. | |
| # That image takes the hub as a named build context rather than building it, so a plain build of the | |
| # scenario Dockerfile fails on its `FROM hub`. | |
| - name: Build the hub image | |
| timeout-minutes: 60 | |
| run: docker build -t et-ws-server-hub:latest -f services/ws-server/Dockerfile . | |
| - name: Build the math1 scenario image | |
| run: | | |
| dockerfile=verification/local/output/math1/Dockerfile | |
| hub=docker-image://et-ws-server-hub:latest | |
| docker build --build-context "hub=$hub" -t et-ws-server-math1:latest -f "$dockerfile" . | |
| - name: Build the web runner image | |
| timeout-minutes: 60 | |
| run: docker build -t et-ws-web-runner:latest -f services/ws-web-runner/Dockerfile . | |
| - name: Apply the manifests and verify the stored model | |
| timeout-minutes: 20 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| run: mise run k3s-verify | |
| # The same pair split across two machines needs its own scenario image. | |
| # The hub image names the scenario it was built for. | |
| - name: Build the math1-multi scenario image | |
| run: | | |
| dockerfile=verification/local/output/math1-multi/Dockerfile | |
| hub=docker-image://et-ws-server-hub:latest | |
| docker build --build-context "hub=$hub" -t et-ws-server-math1-multi:latest -f "$dockerfile" . | |
| - name: Apply the multi-machine manifests to a multi-node cluster and verify the stored model | |
| timeout-minutes: 20 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| run: mise run k3s-verify --scenario math1-multi | |
| # Compose has no cluster to join, so each machine's profile is brought up by its own `docker compose up`. | |
| - name: Start the multi-machine compose stack one machine at a time and verify the stored model | |
| timeout-minutes: 30 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| run: mise run compose-verify | |
| # The pair again with resource limits on the hub, the collector and the twin. | |
| # Both formats are held to the same cgroup values and rlimits, read back from inside the containers; the k3s | |
| # half also runs the two container runtime plugins its limits need, with the node set to refuse a pod they miss. | |
| - name: Build the math1-limits scenario image | |
| run: | | |
| dockerfile=verification/local/output/math1-limits/Dockerfile | |
| hub=docker-image://et-ws-server-hub:latest | |
| docker build --build-context "hub=$hub" -t et-ws-server-math1-limits:latest -f "$dockerfile" . | |
| - name: Apply the limited manifests and check every limit holds in the pods | |
| timeout-minutes: 20 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| run: mise run k3s-verify --scenario math1-limits | |
| - name: Start the limited compose stack and check every limit holds in the containers | |
| timeout-minutes: 30 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| run: mise run compose-verify --scenario math1-limits | |
| # Whether what is on crates.io and GitHub Packages actually runs, which no other job asks. | |
| # Every sibling check reads this working tree; this one installs the released hub, runner and module packages | |
| # and runs the math1 exchange on them, so it is the only signal that a release is usable. | |
| # | |
| # Allowed to fail, deliberately. What it exercises is whatever the registries currently hold, so between a | |
| # change landing here and the release that carries it this job reports the old artifacts -- correctly, and | |
| # with nothing the branch can do about it. A red result is a question about outstanding releases, not a | |
| # broken tree, so it must never gate a merge. | |
| published: | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| # `packages: read` is what the scenario's npm installs need. | |
| # GitHub Packages rejects an unauthenticated read even for a public package, so the module packages are | |
| # unreachable without it. | |
| permissions: | |
| contents: read | |
| packages: read | |
| # No image builds, unlike the job above: this installs released binaries rather than building any. | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Install mise + tools | |
| uses: $/.github/actions/install-mise-tools | |
| timeout-minutes: 60 | |
| with: | |
| github-token: ${{ github.token }} | |
| - name: Run the published math1 scenario | |
| timeout-minutes: 30 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: mise run published-verify | |
| # The same cluster check as `verify`, against released images rather than ones this branch built. | |
| # `verify` proves the manifests describe a working deployment when every image comes from this tree. This | |
| # proves the released images still satisfy them, which is a different question: the manifests move with the | |
| # branch while the images move only when someone publishes, so the two drift apart silently in between. | |
| # | |
| # Allowed to fail for the same reason the mise job above is. What it pulls is whatever ghcr currently holds, | |
| # so between a change landing here and the images being republished this job reports the old ones -- | |
| # correctly, and with nothing the branch can do about it. Kept a separate job rather than folded into | |
| # `published` so a red result says which half is stale: the crates or the images. | |
| published-k3s: | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| # `packages: read` is what pulling the released hub and runner images needs. | |
| permissions: | |
| contents: read | |
| packages: read | |
| # No hub, runner or module build, unlike `verify`, because all of them are released. | |
| # Only the scenario image is built, since no release can carry a module set particular to one deployment. | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Install mise + tools | |
| uses: $/.github/actions/install-mise-tools | |
| timeout-minutes: 60 | |
| with: | |
| github-token: ${{ github.token }} | |
| # The scenario Dockerfile names the released hub image, so the build pulls it rather than building one. | |
| # That is the whole point of this job. The modules come from their releases too, fetched with the token, so | |
| # the image builds from the deployment directory alone and nothing in this checkout is built for it. | |
| - name: Build the math1 scenario image on the released hub | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| working-directory: verification/published/output/math1 | |
| run: docker build --secret id=gh_token,env=GITHUB_TOKEN -t et-ws-server-math1:latest . | |
| - name: Apply the published manifests and verify the stored model | |
| timeout-minutes: 20 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| run: mise run k3s-verify published | |
| - name: Build the math1-multi scenario image on the released hub | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| working-directory: verification/published/output/math1-multi | |
| run: docker build --secret id=gh_token,env=GITHUB_TOKEN -t et-ws-server-math1-multi:latest . | |
| - name: Apply the published multi-machine manifests to a multi-node cluster and verify the stored model | |
| timeout-minutes: 20 | |
| env: | |
| CARGO_NET_RETRY: "5" | |
| run: mise run k3s-verify published --scenario math1-multi |