ci #59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| # weekly, so a broken published installer surfaces without a user report | |
| - cron: '17 6 * * 1' | |
| workflow_dispatch: | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: gofmt | |
| run: test -z "$(gofmt -l .)" | |
| - name: vet | |
| run: go vet ./... | |
| - name: build | |
| run: make | |
| # before the tests, not after: make test runs the hook smoke tests and | |
| # each one skips itself when its shell is missing, so installing these | |
| # late would have looked green while testing nothing | |
| - name: shells for the hook tests | |
| run: sudo apt-get update -qq && sudo apt-get install -y -qq zsh fish | |
| - name: unit and end-to-end tests | |
| run: make test | |
| musl: | |
| # glibc-isms in the shim would surface here; informational for now | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| container: alpine:3.22 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: deps | |
| run: apk add --no-cache bash build-base go coreutils diffutils make git | |
| - name: build and test | |
| run: make test | |
| # A shim built on a new glibc records symbol versions that older distros | |
| # do not have, and silently refuses to load there. This catches that at | |
| # PR time instead of from a user's bug report. | |
| glibc-floor: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: build shim and check its glibc floor | |
| run: | | |
| mkdir -p build | |
| gcc -shared -fPIC -O2 -Wall -o build/libundo.so shim/undo_shim.c -ldl -lpthread | |
| max=$(objdump -T build/libundo.so | grep -o 'GLIBC_[0-9.]*' | sort -u -V | tail -1) | |
| echo "highest glibc symbol required: $max" | |
| # even built on a modern runner, nothing newer than 2.34 (dlsym) | |
| # should appear; 2.38 means a C23 symbol crept back in | |
| case "$max" in | |
| GLIBC_2.[0-9]|GLIBC_2.[12][0-9]|GLIBC_2.3[0-4]) ;; | |
| *) echo "::error::shim requires $max, breaks Debian 12 / Ubuntu 22.04 / RHEL 9"; exit 1 ;; | |
| esac | |
| # Proves the advertised curl | sh actually works on real distros, using | |
| # the published release. Scheduled so a bad release surfaces on its own. | |
| # | |
| # Note this exercises the *deployed* script at undo.edaywalid.com, which | |
| # can lag the repo: a fix committed here is not live until the site is | |
| # redeployed. The repo-version job below catches that gap. | |
| installer: | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: ['debian:12', 'ubuntu:22.04', 'fedora:40'] | |
| container: ${{ matrix.image }} | |
| steps: | |
| - name: deps | |
| run: | | |
| if command -v apt-get >/dev/null; then | |
| apt-get update -qq && apt-get install -y -qq curl ca-certificates | |
| else | |
| dnf install -y -q curl tar findutils | |
| fi | |
| # No terminal here, so the installer must not touch any rc file. | |
| - name: install without consent to edit the shell rc | |
| run: | | |
| curl -fsSL https://undo.edaywalid.com/install.sh | sh | |
| ~/.local/bin/undo --version | |
| if [ -f ~/.bashrc ] && grep -q 'share/undo/undo' ~/.bashrc; then | |
| echo "::error::installer edited ~/.bashrc with no terminal to ask at"; exit 1 | |
| fi | |
| # Then the path a user who says yes gets: rc written, hook loads, | |
| # doctor's live capture/restore passes. | |
| - name: install with consent, then verify the hook actually works | |
| run: | | |
| export SHELL=/bin/bash | |
| curl -fsSL https://undo.edaywalid.com/install.sh | UNDO_MODIFY_RC=1 sh | |
| grep -q 'share/undo/undo.bash' ~/.bashrc || | |
| { echo "::error::hook line missing from ~/.bashrc"; exit 1; } | |
| bash -c '. ~/.local/share/undo/undo.bash && ~/.local/bin/undo doctor' | |
| # The installer job above downloads the deployed copy, so a bug fixed in | |
| # this repo still fails there until the site ships. Run the repo's own | |
| # install.sh too: this fails on the commit that introduces a bug rather | |
| # than after a deploy, and catches a stale site/public/install.sh. | |
| installer-from-repo: | |
| runs-on: ubuntu-latest | |
| container: debian:12 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: deps | |
| run: apt-get update -qq && apt-get install -y -qq curl ca-certificates | |
| - name: the served copy must match the repo | |
| run: | | |
| diff install.sh site/public/install.sh || | |
| { echo "::error::site/public/install.sh is stale, re-copy it"; exit 1; } | |
| - name: runs with SHELL unset and no controlling terminal | |
| run: | | |
| env -u SHELL sh -e ./install.sh | |
| ~/.local/bin/undo --version | |
| if [ -f ~/.bashrc ] && grep -q 'share/undo/undo' ~/.bashrc; then | |
| echo "::error::edited the rc with no terminal to ask at"; exit 1 | |
| fi | |
| - name: with consent, the hook lands and works | |
| run: | | |
| export SHELL=/bin/bash | |
| UNDO_MODIFY_RC=1 sh -e ./install.sh | |
| grep -q 'share/undo/undo.bash' ~/.bashrc || | |
| { echo "::error::hook line missing"; exit 1; } | |
| bash -c '. ~/.local/share/undo/undo.bash && ~/.local/bin/undo doctor' |