code-interpreter/.github/workflows/ci.yml at main · uzh-bf/code-interpreter · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Standalone CI for the public ClickHouse/code-interpreter repo, which is
# published from services/codeapi as snapshot commits (see
# .github/workflows/publish-codeapi.yml in the monorepo). This file is
# inert inside the monorepo — GitHub only runs workflows from the repo
# root — and becomes the root workflow in the published repo. Keep it in
# sync with ci-codeapi.yml.
name: CI

on:
  push:
    # sync/** is included because the sync PR is opened by the GitHub Actions
    # bot, whose events don't trigger pull_request workflows — the push-event
    # runs on the branch satisfy the PR's checks instead.
    branches: [main, 'sync/**']
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  api-unit-tests:
    name: API Unit Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: api
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Cache Bun packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-codeapi-api-bun-1.3.13-${{ hashFiles('api/bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-codeapi-api-bun-1.3.13-

      - name: Install dependencies
        run: bun ci

      - name: Build API
        run: bun run build

      - name: Compile + smoke spec-guard
        # spec-guard.c is otherwise only compiled by api/Dockerfile, which
        # the helm workflow builds post-merge. Catching syntax errors and
        # exec-semantic regressions pre-merge prevents broken sandbox
        # binaries from reaching the image build.
        working-directory: api/src
        run: |
          gcc -O2 -static -Wall -Wextra -Werror -o /tmp/spec-guard spec-guard.c
          chmod 0555 /tmp/spec-guard
          # Smoke: spec-guard must execvp its argument cleanly. Use a
          # parent process with a known FD population so we also assert
          # the close-inherited-FDs path runs (child must see only the
          # FDs `ls` itself opens).
          PARENT_FDS=$(bash -c 'exec 10<&0 11<&0 12<&0 13<&0 14<&0; ls /proc/self/fd | wc -l')
          CHILD_FDS=$(bash -c 'exec 10<&0 11<&0 12<&0 13<&0 14<&0; /tmp/spec-guard /bin/ls /proc/self/fd | wc -l')
          echo "parent fds (with 5 extra inherited): $PARENT_FDS"
          echo "child fds via spec-guard:           $CHILD_FDS"
          test "$PARENT_FDS" -ge 8 || { echo "FAIL: parent did not actually inherit extra FDs"; exit 1; }
          test "$CHILD_FDS" -le 5 || { echo "FAIL: spec-guard did not close inherited FDs (child saw $CHILD_FDS)"; exit 1; }

      - name: Bun tests
        run: bun run test

  service-unit-tests:
    name: Service Unit Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: service
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Cache Bun packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-codeapi-service-bun-1.3.13-${{ hashFiles('service/bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-codeapi-service-bun-1.3.13-

      - name: Install dependencies
        run: bun ci

      - name: Bun tests
        run: bun run test