Skip to content
CI

CI #37

Sign in to view logs

CI

CI #37

Workflow file for this run

.github/workflows/ci.yml at 6254ee2
name: CI
on:
push:
branches: [ main, dev ]
pull_request:
branches: [ main ]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
# ---------------------------------------------------------------------------
# Standard build + test (Linux + macOS)
# ---------------------------------------------------------------------------
build-test:
name: Build & Test (${{ matrix.os }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ ubuntu-24.04, macos-14 ]
steps:
- uses: actions/checkout@v6
- name: Install Ninja (Ubuntu)
if: startsWith(matrix.os, 'ubuntu')
run: sudo apt-get install -y ninja-build
- name: Install Ninja (macOS)
if: startsWith(matrix.os, 'macos')
run: brew install ninja
- name: Configure
run: cmake --preset ci
- name: Build
run: cmake --build --preset ci --parallel
- name: Test
run: ctest --preset ci
# ---------------------------------------------------------------------------
# AddressSanitizer + UndefinedBehaviorSanitizer (Ubuntu only)
# ---------------------------------------------------------------------------
asan:
name: ASan + UBSan (Ubuntu)
runs-on: ubuntu-24.04
env:
CC: clang-18
CXX: clang++-18
steps:
- uses: actions/checkout@v6
- name: Install Clang 18 + Ninja
run: |
sudo apt-get install -y ninja-build clang-18
- name: Configure
run: cmake --preset asan
- name: Build
run: cmake --build --preset asan --parallel
- name: Test
run: ctest --preset asan
env:
ASAN_OPTIONS: detect_leaks=1:halt_on_error=1
UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
# ---------------------------------------------------------------------------
# ThreadSanitizer (Ubuntu only — TSan + macOS is unreliable)
# ---------------------------------------------------------------------------
tsan:
name: TSan (Ubuntu)
runs-on: ubuntu-24.04
env:
CC: clang-18
CXX: clang++-18
steps:
- uses: actions/checkout@v6
- name: Install Clang 18 + Ninja
run: |
sudo apt-get install -y ninja-build clang-18
- name: Configure
run: cmake --preset tsan
- name: Build
run: cmake --build --preset tsan --parallel
- name: Test
run: ctest --preset tsan
env:
TSAN_OPTIONS: halt_on_error=1
# ---------------------------------------------------------------------------
# UBSan standalone — stricter flags, all-recover=no (Ubuntu)
# ---------------------------------------------------------------------------
ubsan:
name: UBSan (Ubuntu)
runs-on: ubuntu-24.04
env:
CC: clang-18
CXX: clang++-18
steps:
- uses: actions/checkout@v6
- name: Install Clang 18 + Ninja
run: |
sudo apt-get install -y ninja-build clang-18
- name: Configure
run: cmake --preset ubsan
- name: Build
run: cmake --build --preset ubsan --parallel
- name: Test
run: ctest --preset ubsan
env:
UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
# ---------------------------------------------------------------------------
# Windows (MSVC) — header-only core only, no sanitizers
# ---------------------------------------------------------------------------
windows:
name: Build & Test (Windows / MSVC)
runs-on: windows-2022
steps:
- uses: actions/checkout@v6
- name: Configure
run: cmake -B build-win -G "Visual Studio 17 2022" -A x64
-DSIGNET_BUILD_TESTS=ON -DSIGNET_BUILD_EXAMPLES=ON
- name: Build
run: cmake --build build-win --config Debug --parallel
- name: Test
run: ctest --test-dir build-win -C Debug --output-on-failure
# ---------------------------------------------------------------------------
# Server codecs: ZSTD + LZ4 + Gzip enabled (Ubuntu)
# ---------------------------------------------------------------------------
server-codecs:
name: Server Codecs (Ubuntu)
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v6
- name: Install Ninja + codec libraries
run: |
sudo apt-get update -q
sudo apt-get install -y ninja-build libzstd-dev liblz4-dev zlib1g-dev
- name: Configure
run: |
cmake -S . -B build-server -G Ninja \
-DCMAKE_BUILD_TYPE=RelWithDebInfo \
-DSIGNET_BUILD_TESTS=ON \
-DSIGNET_BUILD_EXAMPLES=ON \
-DSIGNET_ENABLE_ZSTD=ON \
-DSIGNET_ENABLE_LZ4=ON \
-DSIGNET_ENABLE_GZIP=ON \
-DSIGNET_BUILD_AI_AUDIT=ON
- name: Build
run: cmake --build build-server --parallel
- name: Test
run: ctest --test-dir build-server --output-on-failure
# ---------------------------------------------------------------------------
# Post-quantum: real Kyber-768 + Dilithium-3 via liboqs (Ubuntu)
# ---------------------------------------------------------------------------
post-quantum:
name: Post-Quantum PQ (Ubuntu)
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v6
- name: Install Ninja + build deps
run: |
sudo apt-get update -q
sudo apt-get install -y ninja-build cmake
- name: Build + install liboqs (minimal Kyber-768 + Dilithium-3)
run: |
git clone --depth 1 https://github.com/open-quantum-safe/liboqs.git /tmp/liboqs
cmake -S /tmp/liboqs -B /tmp/liboqs-build \
-G Ninja \
-DCMAKE_BUILD_TYPE=Release \
-DOQS_BUILD_ONLY_LIB=ON \
-DOQS_MINIMAL_BUILD="KEM_kyber_768;KEM_ml_kem_768;SIG_dilithium_3;SIG_ml_dsa_65" \
-DOQS_USE_OPENSSL=OFF
cmake --build /tmp/liboqs-build --parallel
sudo cmake --install /tmp/liboqs-build
- name: Configure (PQ enabled)
run: |
cmake -S . -B build-pq -G Ninja \
-DCMAKE_BUILD_TYPE=RelWithDebInfo \
-DSIGNET_BUILD_TESTS=ON \
-DSIGNET_ENABLE_PQ=ON \
-DSIGNET_BUILD_AI_AUDIT=ON
- name: Build
run: cmake --build build-pq --parallel
- name: Test (PQ tag first, then full suite)
run: |
ctest --test-dir build-pq --output-on-failure -L "pq"
ctest --test-dir build-pq --output-on-failure
# ---------------------------------------------------------------------------
# Fuzz testing (libFuzzer + ASan, Clang-18, 60s per harness)
# ---------------------------------------------------------------------------
fuzz:
name: Fuzz (Ubuntu, Clang-18)
runs-on: ubuntu-24.04
env:
CC: clang-18
CXX: clang++-18
steps:
- uses: actions/checkout@v6
- name: Install Clang 18 + Ninja
run: sudo apt-get install -y ninja-build clang-18
- name: Configure
run: cmake --preset fuzz
- name: Build
run: cmake --build --preset fuzz --parallel
- name: Run fuzzers (60s each)
run: |
mkdir -p fuzz-artifacts
for target in fuzz_parquet_reader fuzz_thrift_decoder fuzz_wal_reader \
fuzz_rle_decoder fuzz_delta_decoder fuzz_arrow_import; do
echo "=== Fuzzing $target for 60s ==="
mkdir -p fuzz-artifacts/$target
./build-fuzz/$target \
-max_total_time=60 \
-print_final_stats=1 \
-artifact_prefix=fuzz-artifacts/$target/ \
|| true
done
- name: Upload crash artifacts
if: always()
uses: actions/upload-artifact@v7
with:
name: fuzz-crash-artifacts
path: fuzz-artifacts/
if-no-files-found: ignore
retention-days: 90
- name: Fail if crashes found
if: always()
run: |
crashes=$(find fuzz-artifacts -name 'crash-*' -o -name 'leak-*' -o -name 'timeout-*' 2>/dev/null)
if [ -n "$crashes" ]; then
echo "::error::Fuzz crashes detected — check fuzz-crash-artifacts"
echo "$crashes"
exit 1
fi
# ---------------------------------------------------------------------------
# Code coverage (Clang source-based → Codecov)
# ---------------------------------------------------------------------------
coverage:
name: Coverage (Ubuntu, Clang-18)
runs-on: ubuntu-24.04
env:
CC: clang-18
CXX: clang++-18
steps:
- uses: actions/checkout@v6
- name: Install Clang 18 + Ninja + llvm-tools
run: |
sudo apt-get install -y ninja-build clang-18 llvm-18
- name: Configure
run: cmake --preset coverage
- name: Build
run: cmake --build --preset coverage --parallel
- name: Test
run: ctest --preset coverage
env:
LLVM_PROFILE_FILE: "${{ github.workspace }}/build-coverage/default-%p.profraw"
- name: Merge profiles + export LCOV
run: |
llvm-profdata-18 merge -sparse build-coverage/*.profraw \
-o build-coverage/merged.profdata
llvm-cov-18 export \
--format=lcov \
--instr-profile=build-coverage/merged.profdata \
build-coverage/signet_tests \
> build-coverage/lcov.info
- name: Upload to Codecov
uses: codecov/codecov-action@v4
with:
files: build-coverage/lcov.info
flags: unittests
fail_ci_if_error: false
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
# ---------------------------------------------------------------------------
# Benchmark regression detection (push to main only)
# ---------------------------------------------------------------------------
benchmarks:
name: Benchmarks (Ubuntu)
runs-on: ubuntu-24.04
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v6
- name: Install Ninja
run: sudo apt-get install -y ninja-build
- name: Configure
run: cmake --preset benchmarks
- name: Build
run: cmake --build --preset benchmarks --parallel
- name: Run benchmarks
run: |
./build-benchmarks/signet_benchmarks "[bench]" \
--benchmark-samples 50 \
--reporter console::out=benchmark_results.txt
- name: Ensure gh-pages branch exists
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
if ! git ls-remote --exit-code origin gh-pages >/dev/null 2>&1; then
git checkout --orphan gh-pages
git reset --hard
git commit --allow-empty -m "Initialize gh-pages"
git push origin gh-pages
git checkout main
fi
- name: Store benchmark result
uses: benchmark-action/github-action-benchmark@v1
with:
tool: catch2
output-file-path: benchmark_results.txt
github-token: ${{ secrets.GITHUB_TOKEN }}
gh-pages-branch: gh-pages
benchmark-data-dir-path: dev/bench
auto-push: true
alert-threshold: "120%"
comment-on-alert: true
fail-on-alert: false