Skip to content
CI Checks

Follow Security Guide to update release.yml (#1202) #6708

Sign in to view logs

Follow Security Guide to update release.yml (#1202)

Follow Security Guide to update release.yml (#1202) #6708

Workflow file for this run

.github/workflows/ci.yml at 9af3768
name: CI Checks
on:
push:
branches: ["**"]
pull_request:
branches: ["**"]
workflow_dispatch:
env:
bashPass: \033[32;1mPASSED -
bashInfo: \033[33;1mWINFO -
bashFail: \033[31;1mFAILED -
bashEnd: \033[0m
jobs:
unittest:
runs-on: ubuntu-latest
steps:
- name: Clone This Repo
uses: actions/checkout@v4
with:
submodules: recursive
- env:
stepName: Install Dependencies
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
git submodule update --checkout --init --recursive
sudo apt-get update -y
sudo apt-get install -y lcov
sudo apt-get install -y unifdef
sudo apt-get install -y ninja-build
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
# Separate builds for sanitizers and coverage:
# These can currently not be combined without branch coverage dilution.
- env:
stepName: Build Unit Tests (aubsan build)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake --fresh -G Ninja -S test/unit-test -B test/unit-test/build/ -DSANITIZE=address,undefined
ninja -C test/unit-test/build/
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Run Unit Tests (aubsan build)
name: ${{ env.stepName }}
shell: bash
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
env ASAN_OPTIONS=detect_odr_violation=0 ctest --test-dir test/unit-test/build/ -E system --output-on-failure
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build Unit Tests (coverage build)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake --fresh -G Ninja -S test/unit-test -B test/unit-test/build/ -DSANITIZE=
ninja -C test/unit-test/build/
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Run Unit Tests (coverage build)
name: ${{ env.stepName }}
shell: bash
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
find test/unit-test/build/ -name '*.gcda' -delete
ctest --test-dir test/unit-test/build/ -E system --output-on-failure
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Test Line and Branch Coverage
name: ${{ env.stepName }}
shell: bash
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake --build test/unit-test/build/ --target coverage
echo "::endgroup::"
echo -e "${{ env.bashPass }} Built Coverage Tests ${{ env.bashEnd }}"
lcov --list --rc lcov_branch_coverage=1 test/unit-test/build/coverage.info
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- name: Check Coverage
uses: FreeRTOS/CI-CD-Github-Actions/coverage-cop@main
with:
coverage-file: ./test/unit-test/build/coverage.info
branch-coverage-min: 100
line-coverage-min: 100
spell-check:
runs-on: ubuntu-latest
steps:
- name: Clone This Repo
uses: actions/checkout@v4
- name: Run spellings check
uses: FreeRTOS/CI-CD-Github-Actions/spellings@main
with:
path: ./
exclude-dirs: source/portable/NetworkInterface/STM32
formatting:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v4
- name: Check formatting
uses: FreeRTOS/CI-CD-Github-Actions/formatting@main
with:
path: ./
exclude-dirs: source/portable/NetworkInterface/STM32
doxygen:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run doxygen build
uses: FreeRTOS/CI-CD-Github-Actions/doxygen@main
with:
path: ./
verify-manifest:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: true
fetch-depth: 0
# At time of writing the gitmodules are set not to pull
# Even when using fetch submodules. Need to run this command
# To force it to grab them.
- name: Perform Recursive Clone
shell: bash
run: git submodule update --checkout --init --recursive
- name: Run manifest verifier
uses: FreeRTOS/CI-CD-GitHub-Actions/manifest-verifier@main
with:
path: ./
fail-on-incorrect-version: true
link-verifier:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Check Links
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
uses: FreeRTOS/CI-CD-Github-Actions/link-verifier@main
build-checks:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- env:
stepName: Build Install Dependencies
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
sudo apt-get update -y
sudo apt-get install -y libpcap-dev
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Enable all functionalities)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=ENABLE_ALL
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Enable all functionalities IPv4)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=ENABLE_ALL_IPV4
cmake --build build --target clean
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Enable all functionalities IPv6)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=ENABLE_ALL_IPV6
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Enable all functionalities IPv4 IPv6)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=ENABLE_ALL_IPV4_IPV6
cmake --build build --target clean
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Enable all functionalities IPv4 TCP)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=ENABLE_ALL_IPV4_TCP
cmake --build build --target clean
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Enable all functionalities IPv6 TCP)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=ENABLE_ALL_IPV6_TCP
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Disable all functionalities)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=DISABLE_ALL
cmake --build build --target clean
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Default configuration)
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=DEFAULT_CONF
cmake --build build --target clean
cmake --build build --target freertos_plus_tcp_build_test
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Build checks (Header Self Contain)
shell: bash
run: |
cmake -S . -B build -DFREERTOS_PLUS_TCP_ENABLE_BUILD_CHECKS=ON -DFREERTOS_PLUS_TCP_TEST_CONFIGURATION=HEADER_SELF_CONTAIN
cmake --build build --target clean
cmake --build build --target freertos_plus_tcp_build_test_FreeRTOS_DHCP
cmake --build build --target freertos_plus_tcp_build_test_FreeRTOS_DNS
cmake --build build --target freertos_plus_tcp_build_test_FreeRTOS_IP
cmake --build build --target freertos_plus_tcp_build_test_FreeRTOS_ND
cmake --build build --target freertos_plus_tcp_build_test_FreeRTOS_Routing
cmake --build build --target freertos_plus_tcp_build_test_FreeRTOS_Sockets
cmake --build build --target freertos_plus_tcp_build_test_NetworkBufferManagement
cmake --build build --target freertos_plus_tcp_build_test_NetworkInterface
complexity:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- env:
stepName: Setup
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
sudo apt-get install complexity
sudo apt-get install uncrustify
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Complexity
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
COMPLEXITY_PARAMS="--scores --threshold=10 --horrid-threshold=283"
TEMP_DIR=./temp
mkdir -p ${TEMP_DIR}
for SOURCE_FILE in source/portable/BufferManagement/*.c source/*.c
do
TARGET_DIR=${TEMP_DIR}/`dirname ${SOURCE_FILE}`
TARGET_FILE=${TARGET_DIR}/`basename ${SOURCE_FILE}`
mkdir -p ${TARGET_DIR}
uncrustify -c tools/uncrustify.complexity.cfg -f ${SOURCE_FILE} > ${TARGET_FILE}
done
find ${TEMP_DIR} -iname '*.c' | xargs complexity ${COMPLEXITY_PARAMS}
RESULT=$?
rm -rf ${TEMP_DIR}
echo "::endgroup::"
if [ "${RESULT}" = "0" ]; then
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
exit 0
else
echo -e "${{ env.bashFail }} Sources are too complex, rc = ${RESULT} ${{ env.bashEnd }}"
echo -e "${{ env.bashFail }} ${{ env.stepName }} ${{ env.bashEnd }}"
exit 1
fi
git-secrets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Checkout awslabs/git-secrets
uses: actions/checkout@v4
with:
repository: awslabs/git-secrets
ref: master
path: git-secrets
- env:
stepName: Install git-secrets
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
cd git-secrets && sudo make install && cd ..
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- env:
stepName: Run git-secrets
name: ${{ env.stepName }}
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
git-secrets --register-aws
git-secrets --scan
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
proof_ci:
if: ${{ github.event.pull_request }}
runs-on: cbmc_ubuntu-latest_16-core
steps:
- name: Set up CBMC runner
uses: FreeRTOS/CI-CD-Github-Actions/set_up_cbmc_runner@main
with:
cbmc_version: "6.3.1"
- env:
stepName: Install Dependencies
name: ${{ env.stepName }}
shell: bash
run: |
# ${{ env.stepName }}
echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
git submodule update --init --checkout --recursive
sudo apt-get update
sudo apt-get install --yes --no-install-recommends gcc-multilib
echo "::endgroup::"
echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"
- name: Run CBMC
uses: FreeRTOS/CI-CD-Github-Actions/run_cbmc@main
with:
proofs_dir: test/cbmc/proofs