gate

feat(s031): complete slice 031 (session search, FTS5) #246

Workflow file for this run

	# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
	# SPDX-License-Identifier: Apache-2.0
	name: gate

	on:
	push:
	pull_request:

	jobs:
	gate:
	runs-on: ubuntu-latest
	env:
	MIX_ENV: test
	TRINITY_DB: sqlite
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
	with:
	fetch-depth: 0 # plan_check rule 8 reads the whole history
	# On a pull request the default checkout is a merge commit GitHub makes on the fly,
	# authored by nobody and signed off by nobody. plan_check rule 8 refused it on the
	# first pull request this repository ever had (run 35477492177). The branch head is
	# what was written and signed, so that is what the gate reads. The ruleset's strict
	# policy requires the branch to be current with main before it can merge, so the
	# head is also what main will contain.
	ref: ${{ github.event.pull_request.head.sha \|\| github.sha }}

	- uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
	with:
	version-file: .tool-versions
	version-type: strict

	- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
	with:
	path: \|
	deps
	_build
	key: ${{ runner.os }}-mix-${{ hashFiles('mix.lock') }}
	restore-keys: ${{ runner.os }}-mix-

	- run: mix deps.get

	# The plan's own consistency, checked before the code's.
	- run: ./scripts/plan_check.sh

	# DCO. plan_check rule 8 also asserts every commit is signed off; this fails earlier
	# and more legibly on a pull request.
	- name: DCO sign-off present on every commit
	run: \|
	git log --format=%B ${{ github.event.pull_request.base.sha \|\| 'HEAD~1' }}..HEAD 2>/dev/null \
	\| grep -q '^Signed-off-by: ' \|\| {
	echo "::error::a commit in this range has no Signed-off-by line"; exit 1; }

	- run: mix gate

	# Slice 010 AC1 and AC2: the same migrations and the same suite on Postgres. A second job
	# rather than a matrix entry so the required check keeps its context name, `gate`. This job
	# is not required by the ruleset until it has run green on main once; then it is added.
	# Tests tagged :sqlite read SQLite pragmas and are excluded here by tag, never by skip.
	postgres:
	runs-on: ubuntu-latest
	services:
	postgres:
	image: postgres:17
	env:
	POSTGRES_USER: trinity
	POSTGRES_PASSWORD: trinity
	POSTGRES_DB: trinity_test
	ports: ['5432:5432']
	options: >-
	--health-cmd "pg_isready -U trinity"
	--health-interval 5s
	--health-timeout 5s
	--health-retries 10
	env:
	MIX_ENV: test
	TRINITY_DB: postgres
	DATABASE_URL: postgres://trinity:trinity@localhost:5432/trinity_test
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

	- uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
	with:
	version-file: .tool-versions
	version-type: strict

	- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
	with:
	path: \|
	deps
	_build
	key: ${{ runner.os }}-mix-postgres-${{ hashFiles('mix.lock') }}
	restore-keys: ${{ runner.os }}-mix-postgres-

	- run: mix deps.get

	# The adapter is chosen at compile time (config/config.exs); this proves the build
	# under TRINITY_DB=postgres links the Postgres adapter and nothing SQLite.
	- name: The compiled adapter is Postgres
	run: mix run -e 'Ecto.Adapters.Postgres = Trinity.Repo.__adapter__()'

	- run: mix ecto.reset
	- run: mix test --exclude sqlite

	# Slice 003: the same gate on an OTP built from source with --enable-fips, in FIPS mode,
	# against the FIPS provider of a UBI9 container (docs/fips-leg.md). A second job rather than
	# a matrix entry, as `postgres` is, so `gate` keeps its context name. The image is built by
	# fips-image.yml and pulled here by the tag scripts/fips_image_tag.sh derives from the
	# files that define it; this job never builds it.
	fips-tag:
	runs-on: ubuntu-latest
	outputs:
	ref: ${{ steps.tag.outputs.ref }}
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
	- id: tag
	run: echo "ref=$(scripts/fips_image_tag.sh --ref)" >> "$GITHUB_OUTPUT"

	fips:
	needs: fips-tag
	runs-on: ubuntu-latest
	container:
	image: ${{ needs.fips-tag.outputs.ref }}
	credentials:
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	env:
	MIX_ENV: test
	TRINITY_DB: sqlite
	# test/test_helper.exs includes the :fips tests under this, and test/fips/mode_test.exs
	# asserts the runtime agrees, so a leg that failed to enter the mode is red, not quiet.
	TRINITY_FIPS_LEG: "1"
	# FIPS mode is entered by OTP's own configuration, read by the crypto NIF when it loads,
	# which needs the crypto application loaded first; ERL_AFLAGS is prepended to every
	# erl command line, so every `mix` and `elixir` here runs in the mode. Measured at G1:
	# ERL_FLAGS alone leaves the mode off (the NIF loads before the application does).
	ERL_AFLAGS: "-crypto fips_mode true -eval application:load(crypto)"
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
	with:
	fetch-depth: 0
	ref: ${{ github.event.pull_request.head.sha \|\| github.sha }}

	# The checkout action marks the workspace safe under a temporary HOME it removes when
	# it is done; every later git call in the container (plan_check, the names, secrets and
	# reuse censuses, all of which read `git ls-files`) then hits git's dubious-ownership
	# refusal and reads an empty tree. Found on run 35537462271: plan_check rule 4 named
	# every slice as missing its SLICE.md.
	- run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

	- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
	with:
	path: \|
	deps
	_build
	key: fips-mix-${{ needs.fips-tag.outputs.ref }}-${{ hashFiles('mix.lock') }}
	restore-keys: fips-mix-${{ needs.fips-tag.outputs.ref }}-

	# The one step outside the mode. The fetch, because Hex's client offers TLS 1.0 and 1.1
	# beside 1.2 and ssl in the mode refuses the set (insufficient_crypto_support); the
	# dependency compile, because rustler_precompiled downloads mdex's NIF at compile time
	# and OTP's TLS 1.3 client in the mode fails that host's HelloRetryRequest
	# (erlang/otp#8470). docs/fips-leg.md findings 1 and 2; neither is what the leg
	# measures. The gate's own hex.audit step clears ERL_AFLAGS for the same reason (mix.exs).
	- name: Fetch and compile dependencies (FIPS mode off)
	env:
	ERL_AFLAGS: "-eval application:load(crypto)"
	run: \|
	mix deps.get
	mix deps.compile

	# AC1, before anything else runs: the runtime is in the mode and names the provider.
	- name: The runtime is in FIPS mode
	run: \|
	erl -noshell -eval 'enabled = crypto:info_fips(), io:format("~p~n", [crypto:info()]), halt().'

	# AC3, the default half: the listing with the mode off equals the committed file; the
	# mode-on half is test/fips/mode_test.exs, inside the suite.
	- name: crypto:supports/0 with the mode off matches docs/fips-leg/supports-default.txt
	env:
	ERL_AFLAGS: "-eval application:load(crypto)"
	run: elixir scripts/crypto_supports.exs \| diff - docs/fips-leg/supports-default.txt

	- run: ./scripts/plan_check.sh

	- name: DCO sign-off present on every commit
	run: \|
	git log --format=%B ${{ github.event.pull_request.base.sha \|\| 'HEAD~1' }}..HEAD 2>/dev/null \
	\| grep -q '^Signed-off-by: ' \|\| {
	echo "::error::a commit in this range has no Signed-off-by line"; exit 1; }

	- run: mix gate

	# AC2 and AC3 by test name with this run's id in the log, and AC5's coverage line for
	# this leg. The gate above already ran the suite; this repeats the four FIPS tests with
	# their names printed, then the whole suite once more under the coverage tool.
	- name: The FIPS tests by name, and this leg's coverage
	run: \|
	mix test --trace test/fips
	mix test --cover \| grep -E 'Result:\|\\| *Total'

Navigation Menu

feat(s031): complete slice 031 (session search, FTS5) #246

Workflow file

feat(s031): complete slice 031 (session search, FTS5) #246

Uh oh!

Workflow file for this run