fix(codeapi-chart): make package PVC argo-safe (#7) #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Standalone CI for the public ClickHouse/code-interpreter repo, which is | |
| # published from services/codeapi as snapshot commits (see | |
| # .github/workflows/publish-codeapi.yml in the monorepo). This file is | |
| # inert inside the monorepo — GitHub only runs workflows from the repo | |
| # root — and becomes the root workflow in the published repo. Keep it in | |
| # sync with ci-codeapi.yml. | |
| name: CI | |
| on: | |
| push: | |
| # sync/** is included because the sync PR is opened by the GitHub Actions | |
| # bot, whose events don't trigger pull_request workflows — the push-event | |
| # runs on the branch satisfy the PR's checks instead. | |
| branches: [main, 'sync/**'] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| api-unit-tests: | |
| name: API Unit Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: api | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.13 | |
| - name: Cache Bun packages | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-codeapi-api-bun-1.3.13-${{ hashFiles('api/bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-codeapi-api-bun-1.3.13- | |
| - name: Install dependencies | |
| run: bun ci | |
| - name: Build API | |
| run: bun run build | |
| - name: Compile + smoke spec-guard | |
| # spec-guard.c is otherwise only compiled by api/Dockerfile, which | |
| # the helm workflow builds post-merge. Catching syntax errors and | |
| # exec-semantic regressions pre-merge prevents broken sandbox | |
| # binaries from reaching the image build. | |
| working-directory: api/src | |
| run: | | |
| gcc -O2 -static -Wall -Wextra -Werror -o /tmp/spec-guard spec-guard.c | |
| chmod 0555 /tmp/spec-guard | |
| # Smoke: spec-guard must execvp its argument cleanly. Use a | |
| # parent process with a known FD population so we also assert | |
| # the close-inherited-FDs path runs (child must see only the | |
| # FDs `ls` itself opens). | |
| PARENT_FDS=$(bash -c 'exec 10<&0 11<&0 12<&0 13<&0 14<&0; ls /proc/self/fd | wc -l') | |
| CHILD_FDS=$(bash -c 'exec 10<&0 11<&0 12<&0 13<&0 14<&0; /tmp/spec-guard /bin/ls /proc/self/fd | wc -l') | |
| echo "parent fds (with 5 extra inherited): $PARENT_FDS" | |
| echo "child fds via spec-guard: $CHILD_FDS" | |
| test "$PARENT_FDS" -ge 8 || { echo "FAIL: parent did not actually inherit extra FDs"; exit 1; } | |
| test "$CHILD_FDS" -le 5 || { echo "FAIL: spec-guard did not close inherited FDs (child saw $CHILD_FDS)"; exit 1; } | |
| - name: Bun tests | |
| run: bun run test | |
| service-unit-tests: | |
| name: Service Unit Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: service | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.13 | |
| - name: Cache Bun packages | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-codeapi-service-bun-1.3.13-${{ hashFiles('service/bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-codeapi-service-bun-1.3.13- | |
| - name: Install dependencies | |
| run: bun ci | |
| - name: Bun tests | |
| run: bun run test |