Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ci(tests): Avoid the use of pull_request_target where possible #9899

Merged
merged 1 commit into from
Jun 24, 2024
Merged

ci(tests): Avoid the use of pull_request_target where possible #9899

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
137 changes: 35 additions & 102 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,29 @@
# This file is used to run the runtime tests for the Arduino core for ESP32.
# The tests are run on the hardware, Wokwi and QEMU emulators.
# The QEMU tests are disabled for now as they are redundant with most of the Wokwi tests.
# As the Wokwi tests require access to secrets, they are run in a separate workflow.
# We need to ensure that the artifacts from previous tests in the chain are propagated for publishing the results.
# This is the current trigger sequence for the tests:
# tests.yml -> tests_wokwi.yml -> tests_results.yml
# ⌙> tests_build.yml
# ⌙> tests_hw.yml
# ⌙> tests_qemu.yml

name: Runtime Tests

on:
workflow_dispatch:
pull_request_target:
pull_request:
types: [opened, reopened, closed, synchronize, labeled, unlabeled]
paths:
- '.github/workflows/tests*'
- '.github/scripts/*.sh'
- '!.github/scripts/check-cmakelists.sh'
- '!.github/scripts/find_*'
- '!.github/scripts/on-*.sh'
- '!.github/scripts/set_push_chunks.sh'
- '!.github/scripts/update-version.sh'
- '!.github/scripts/upload_py_tools.sh'
- 'tests/**'
- 'cores/**'
- 'libraries/**'
Expand All @@ -19,14 +38,19 @@ concurrency:
group: tests-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

# To avoid giving elevated permissions to the entire workflow, specify default permissions at the top level
# and then override them for specific jobs.
permissions: { contents: read }

jobs:
push-event-file:
name: Push event file
runs-on: ubuntu-latest
steps:
- name: Upload
uses: actions/upload-artifact@v4
with:
name: event_file
path: ${{ github.event_path }}

gen-matrix:
name: Generate matrix
if: github.event.action != 'closed'
runs-on: ubuntu-latest
outputs:
build-types: ${{ steps.set-matrix.outputs.build-types }}
Expand Down Expand Up @@ -59,9 +83,8 @@ jobs:
call-build-tests:
name: Build
uses: espressif/arduino-esp32/.github/workflows/build_tests.yml@master
uses: ./.github/workflows/tests_build.yml
needs: gen-matrix
if: github.event.action != 'closed'
strategy:
matrix:
type: ${{ fromJson(needs.gen-matrix.outputs.build-types) }}
Expand All @@ -72,11 +95,11 @@ jobs:

call-hardware-tests:
name: Hardware
uses: espressif/arduino-esp32/.github/workflows/hw.yml@master
uses: ./.github/workflows/tests_hw.yml
needs: [gen-matrix, call-build-tests]
if: |
github.repository == 'espressif/arduino-esp32' &&
(github.event_name != 'pull_request_target' ||
(github.event_name != 'pull_request' ||
contains(github.event.pull_request.labels.*.name, 'hil_test'))
strategy:
fail-fast: false
Expand All @@ -87,26 +110,10 @@ jobs:
type: ${{ matrix.type }}
chip: ${{ matrix.chip }}

call-wokwi-tests:
name: Wokwi
uses: espressif/arduino-esp32/.github/workflows/wokwi.yml@master
needs: [gen-matrix, call-build-tests]
if: github.event.action != 'closed'
strategy:
fail-fast: false
matrix:
type: ${{ fromJson(needs.gen-matrix.outputs.wokwi-types) }}
chip: ['esp32', 'esp32s2', 'esp32s3', 'esp32c3', 'esp32c6', 'esp32h2']
secrets:
WOKWI_CLI_TOKEN: ${{ secrets.WOKWI_CLI_TOKEN }}
with:
type: ${{ matrix.type }}
chip: ${{ matrix.chip }}

# This job is disabled for now
call-qemu-tests:
name: QEMU
uses: espressif/arduino-esp32/.github/workflows/qemu.yml@master
uses: ./.github/workflows/tests_qemu.yml
needs: [gen-matrix, call-build-tests]
if: false
strategy:
Expand All @@ -118,78 +125,4 @@ jobs:
type: ${{ matrix.type }}
chip: ${{ matrix.chip }}

unit-test-results:
name: Unit Test Results
needs: [call-hardware-tests, call-wokwi-tests, call-qemu-tests]
if: always() && github.event_name == 'pull_request_target'
runs-on: ubuntu-latest
permissions:
checks: write
pull-requests: write
steps:
- name: Download and Extract HW Artifacts
uses: actions/download-artifact@v4
continue-on-error: true
with:
merge-multiple: true
pattern: tests-results-hw-*
path: ./results/hw

- name: Download and Extract Wokwi Artifacts
uses: actions/download-artifact@v4
continue-on-error: true
with:
merge-multiple: true
pattern: tests-results-wokwi-*
path: ./results/wokwi

- name: Download and Extract QEMU Artifacts
uses: actions/download-artifact@v4
continue-on-error: true
with:
merge-multiple: true
pattern: tests-results-qemu-*
path: ./results/qemu

- name: Publish Unit Test Results
uses: EnricoMi/publish-unit-test-result-action@v2
with:
commit: ${{ github.event.pull_request.head.sha || github.sha }}
files: ./results/**/*.xml
clean:
name: Clean objects
needs: unit-test-results
if: always()
permissions:
actions: write
runs-on: ubuntu-latest
steps:
- name: Clean up caches
uses: actions/github-script@v7
with:
script: |
const ref = '${{ github.event.pull_request.number || github.ref }}';
const key_prefix = 'tests-' + ref + '-';
if ('${{ github.event_name }}' == 'pull_request_target' && '${{ github.event.action }}' != 'closed') {
console.log('Skipping cache cleanup for open PR');
return;
}
await github.paginate(github.rest.actions.getActionsCacheList, {
owner: context.repo.owner,
repo: context.repo.repo,
per_page: 100,
key: key_prefix
}).then(caches => {
if (caches) {
for (const cache of caches) {
console.log(`Deleting cache: ${cache.key}`);
github.rest.actions.deleteActionsCacheById({
owner: context.repo.owner,
repo: context.repo.repo,
cache_id: cache.id
});
}
}
});
# Wokwi tests are run after this workflow as it needs access to secrets
19 changes: 2 additions & 17 deletions .github/workflows/build_tests.yml → .github/workflows/tests_build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@ jobs:
id: ${{ github.event.pull_request.number || github.ref }}-${{ github.event.pull_request.head.sha || github.sha }}-${{ inputs.chip }}-${{ inputs.type }}
steps:
- name: Check if already built
if: ${{ github.event.pull_request.number != null }}
id: cache-build-binaries
if: github.event.pull_request.number != null
uses: actions/cache/restore@v4
with:
key: tests-${{ env.id }}-bin
Expand All @@ -46,21 +46,6 @@ jobs:
- name: Checkout user repository
if: ${{ steps.check-build.outputs.enabled == 'true' }}
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false
sparse-checkout-cone-mode: false
sparse-checkout: |
/*
!.github
# To avoid giving unknown scripts elevated permissions, download them from the master branch
- name: Get CI scripts from master
if: ${{ steps.check-build.outputs.enabled == 'true' }}
run: |
mkdir -p .github
cd .github
curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github

- name: Get libs cache
uses: actions/cache@v4
Expand All @@ -83,7 +68,7 @@ jobs:
- name: Upload ${{ inputs.chip }} ${{ inputs.type }} binaries as cache
uses: actions/cache/save@v4
if: ${{ steps.check-build.outputs.enabled == 'true' }}
if: steps.check-build.outputs.enabled == 'true' && github.event.pull_request.number != null
with:
key: tests-${{ env.id }}-bin
path: |
Expand Down
21 changes: 3 additions & 18 deletions .github/workflows/hw.yml → .github/workflows/tests_hw.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ jobs:
image: python:3.10.1-bullseye
options: --privileged
steps:
- name: Check if already built
if: ${{ github.event.pull_request.number != null }}
- name: Check if already passed
id: cache-results
if: github.event.pull_request.number != null
uses: actions/cache/restore@v4
with:
key: tests-${{ env.id }}-results-hw
Expand All @@ -48,21 +48,6 @@ jobs:
- name: Checkout user repository
if: ${{ steps.check-tests.outputs.enabled == 'true' }}
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false
sparse-checkout-cone-mode: false
sparse-checkout: |
/*
!.github
# To avoid giving unknown scripts elevated permissions, download them from the master branch
- name: Get CI scripts from master
if: ${{ steps.check-tests.outputs.enabled == 'true' }}
run: |
mkdir -p .github
cd .github
curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github

# setup-python currently only works on ubuntu images
# - uses: actions/setup-python@v5
Expand Down Expand Up @@ -95,7 +80,7 @@ jobs:
- name: Upload ${{ inputs.chip }} ${{ inputs.type }} hardware results as cache
uses: actions/cache/save@v4
if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
if: steps.check-tests.outputs.enabled == 'true' && github.event.pull_request.number != null
with:
key: tests-${{ env.id }}-results-hw
path: |
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/qemu.yml → .github/workflows/tests_qemu.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ jobs:
QEMU_INSTALL_PATH: "$HOME"
runs-on: ubuntu-latest
steps:
- name: Check if already run
if: ${{ github.event.pull_request.number != null }}
- name: Check if already passed
id: get-cache-results
if: github.event.pull_request.number != null
uses: actions/cache/restore@v4
with:
key: tests-${{ env.id }}-results-qemu
Expand Down Expand Up @@ -97,7 +97,7 @@ jobs:
with:
path: |
~/qemu
key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/qemu.yml') }}
key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/tests_qemu.yml') }}

- name: Download QEMU
if: ${{ steps.cache-qemu.outputs.cache-hit != 'true' && steps.check-tests.outputs.enabled == 'true' }}
Expand Down Expand Up @@ -125,7 +125,7 @@ jobs:

- name: Upload ${{ inputs.chip }} ${{ inputs.type }} QEMU results as cache
uses: actions/cache/save@v4
if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
if: steps.check-tests.outputs.enabled == 'true' && github.event.pull_request.number != null
with:
key: tests-${{ env.id }}-results-qemu
path: |
Expand Down
Loading
Loading