diff --git a/.github/workflows/fortify.yml b/.github/workflows/fortify.yml new file mode 100644 index 0000000..657aef3 --- /dev/null +++ b/.github/workflows/fortify.yml @@ -0,0 +1,129 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +################################################################################################################################################ +# Fortify Application Security provides your team with solutions to empower DevSecOps practices, enable cloud transformation, and secure your # +# software supply chain. To learn more about Fortify, start a free trial or contact our sales team, visit fortify.com. # +# # +# Use this starter workflow as a basis for integrating Fortify Application Security Testing into your GitHub workflows. This template # +# demonstrates the steps to package the code+dependencies, initiate a scan, and optionally import SAST vulnerabilities into GitHub Security # +# Code Scanning Alerts. Additional information is available in the workflow comments and the Fortify AST Action / fcli / Fortify product # +# documentation. If you need additional assistance, please contact Fortify support. # +################################################################################################################################################ + +name: Fortify AST Scan + +# Customize trigger events based on your DevSecOps process and/or policy +on: + push: + branches: [ "main" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "main" ] + schedule: + - cron: '40 19 * * 5' + workflow_dispatch: + +jobs: + Fortify-AST-Scan: + # Use the appropriate runner for building your source code. Ensure dev tools required to build your code are present and configured appropriately (MSBuild, Python, etc). + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + # pull-requests: write # Required if DO_PR_COMMENT is set to true + + steps: + # Check out source code + - name: Check Out Source Code + uses: actions/checkout@v4 + + # Perform SAST and/or SCA scan via Fortify on Demand/Fortify Hosted/ScanCentral SAST/Debricked. Based on + # configuration, the Fortify GitHub Action can optionally set up the application version/release, generate + # job summaries and Pull Request comments, and/or export SAST results to the GitHub code scanning dashboard. + # The Fortify GitHub Action provides many customization capabilities, but in case further customization is + # required, you can use sub-actions like fortify/github-action/setup@v1 to set up the various Fortify tools + # and run them directly from within your pipeline. It is recommended to review the Fortify GitHub Action + # documentation at https://github.com/fortify/github-action#readme for more information on the various + # configuration options and available sub-actions. + - name: Run Fortify Scan + # Specify Fortify GitHub Action version to run. As per GitHub starter workflow requirements, this example + # uses the commit id corresponding to version 1.6.2. It is recommended to check whether any later releases + # are available at https://github.com/fortify/github-action/releases. Depending on the amount of stability + # required, you may want to consider using fortify/github-action@v1 instead to use the latest 1.x.y version + # of this action, allowing your workflows to automatically benefit from any new features and bug fixes. + uses: fortify/github-action@ef5539bf4bd9c45c0bd971978f635a69eae55297 + with: + sast-scan: true # Run a SAST scan; if not specified or set to false, no SAST scan will be run + debricked-sca-scan: true # For FoD, run an open-source scan as part of the SAST scan (ignored if SAST scan + # is disabled). For SSC, run a Debricked scan and import results into SSC. + env: + ############################################################# + ##### Fortify on Demand configuration + ##### Remove this section if you're integrating with Fortify Hosted/Software Security Center (see below) + ### Required configuration + FOD_URL: https://ams.fortify.com # Must be hardcoded or configured through GitHub variable, not secret + FOD_TENANT: ${{secrets.FOD_TENANT}} # Either tenant/user/password or client id/secret are required; + FOD_USER: ${{secrets.FOD_USER}} # these should be configured through GitHub secrets. + FOD_PASSWORD: ${{secrets.FOD_PAT}} + # FOD_CLIENT_ID: ${{secrets.FOD_CLIENT_ID}} + # FOD_CLIENT_SECRET: ${{secrets.FOD_CLIENT_SECRET}} + ### Optional configuration + # FOD_LOGIN_EXTRA_OPTS: --socket-timeout=60s # Extra 'fcli fod session login' options + # FOD_RELEASE: MyApp:MyRelease # FoD release name, default: /: + # DO_SETUP: true # Setup FoD application, release & static scan configuration + # SETUP_ACTION: # Customize setup action + # Pass extra options to setup action: + # SETUP_EXTRA_OPTS: --copy-from "${{ github.repository }}:${{ github.event.repository.default_branch }}" + # PACKAGE_EXTRA_OPTS: -oss -bt mvn # Extra 'scancentral package' options + # FOD_SAST_SCAN_EXTRA_OPTS: # Extra 'fcli fod sast-scan start' options + # DO_WAIT: true # Wait for successful scan completion (implied if post-scan actions enabled) + # DO_POLICY_CHECK: true # Fail pipeline if security policy outcome is FAIL + # POLICY_CHECK_ACTION: # Customize security policy checks + # POLICY_CHECK_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to policy check action + # DO_JOB_SUMMARY: true # Generate workflow job summary + # JOB_SUMMARY_ACTION: # Customize job summary + # JOB_SUMMARY_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to job summary action + # DO_PR_COMMENT: true # Generate PR comments, only used on pull_request triggers + # PR_COMMENT_ACTION: # Customize PR comments + # PR_COMMENT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to PR comment action + # DO_EXPORT: true # Export vulnerability data to GitHub code scanning dashboard + # EXPORT_ACTION: # Customize export action + # EXPORT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to export action + # TOOL_DEFINITIONS: # URL from where to retrieve Fortify tool definitions + + ############################################################# + ##### Fortify Hosted / Software Security Center & ScanCentral + ##### Remove this section if you're integrating with Fortify on Demand (see above) + ### Required configuration + SSC_URL: ${{vars.SSC_URL}} # Must be hardcoded or configured through GitHub variable, not secret + SSC_TOKEN: ${{secrets.SSC_TOKEN}} # SSC CIToken; credentials should be configured through GitHub secrets + SC_SAST_TOKEN: ${{secrets.SC_CLIENT_AUTH_TOKEN}} # ScanCentral SAST client_auth_token, required if SAST scan is enabled + DEBRICKED_TOKEN: ${{secrets.DEBRICKED_TOKEN}} # Debricked token, required if Debricked scan is enabled + SC_SAST_SENSOR_VERSION: 24.4.0 # Sensor version to use for the scan, required if SAST scan is enabled + ### Optional configuration + # SSC_LOGIN_EXTRA_OPTS: --socket-timeout=60s # Extra 'fcli ssc session login' options + # SC_SAST_LOGIN_EXTRA_OPTS: --socket-timeout=60s # Extra 'fcli sc-sast session login' options + # SSC_APPVERSION: MyApp:MyVersion # SSC application version name, default: /: + # DO_SETUP: true # Set up SSC application & version + # SETUP_ACTION: # Customize setup action + # SETUP_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to setup action + # PACKAGE_EXTRA_OPTS: -bt mvn # Extra 'scancentral package' options + # EXTRA_SC_SAST_SCAN_OPTS: # Extra 'fcli sc-sast scan start' options + # DO_WAIT: true # Wait for successful scan completion (implied if post-scan actions enabled) + # DO_POLICY_CHECK: true # Fail pipeline if security policy outcome is FAIL + # POLICY_CHECK_ACTION: # Customize security policy checks + # POLICY_CHECK_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to policy check action + # DO_JOB_SUMMARY: true # Generate workflow job summary + # JOB_SUMMARY_ACTION: # Customize job summary + # JOB_SUMMARY_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to job summary action + # DO_PR_COMMENT: true # Generate PR comments, only used on pull_request triggers + # PR_COMMENT_ACTION: # Customize PR comments + # PR_COMMENT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to PR comment action + # DO_EXPORT: true # Export vulnerability data to GitHub code scanning dashboard + # EXPORT_ACTION: # Customize export action + # EXPORT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to export action + # TOOL_DEFINITIONS: # URL from where to retrieve Fortify tool definitions diff --git a/.github/workflows/google-cloudrun-source.yml/from b/.github/workflows/google-cloudrun-source.yml/from new file mode 100644 index 0000000..f0191b9 --- /dev/null +++ b/.github/workflows/google-cloudrun-source.yml/from @@ -0,0 +1,75 @@ +# This workflow will deploy source code on Cloud Run when a commit is pushed to +# the "main" branch. +# +# To configure this workflow: +# +# 1. Enable the following Google Cloud APIs: +# +# - Artifact Registry (artifactregistry.googleapis.com) +# - Cloud Build (cloudbuild.googleapis.com) +# - Cloud Run (run.googleapis.com) +# - IAM Credentials API (iamcredentials.googleapis.com) +# +# You can learn more about enabling APIs at +# https://support.google.com/googleapi/answer/6158841. +# +# 2. Create and configure a Workload Identity Provider for GitHub: +# https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation. +# +# Depending on how you authenticate, you will need to grant an IAM principal +# permissions on Google Cloud: +# +# - Artifact Registry Administrator (roles/artifactregistry.admin) +# - Cloud Run Source Developer (roles/run.sourceDeveloper) +# +# You can learn more about setting IAM permissions at +# https://cloud.google.com/iam/docs/manage-access-other-resources. +# +# 3. Change the values in the "env" block to match your values. + +name: 'Deploy to Cloud Run from Source' + +on: + push: + branches: + - '"main"' + +env: + PROJECT_ID: 'my-project' # TODO: update to your Google Cloud project ID + REGION: 'us-central1' # TODO: update to your region + SERVICE: 'my-service' # TODO: update to your service name + +jobs: + deploy: + runs-on: 'ubuntu-latest' + + permissions: + contents: 'read' + id-token: 'write' + + steps: + - name: 'Checkout' + uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4 + + # Configure Workload Identity Federation and generate an access token. + # + # See https://github.com/google-github-actions/auth for more options, + # including authenticating via a JSON credentials file. + - id: 'auth' + name: 'Authenticate to Google Cloud' + uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2 + with: + workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: replace with your workload identity provider + + - name: 'Deploy to Cloud Run' + uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2 + with: + service: '${{ env.SERVICE }}' + region: '${{ env.REGION }}' + # NOTE: If using a different source folder, update the image name below: + source: './' + + # If required, use the Cloud Run URL output in later steps + - name: 'Show output' + run: |- + echo ${{ steps.deploy.outputs.url }} diff --git a/multi-platform b/multi-platform new file mode 100644 index 0000000..2bb00f2 --- /dev/null +++ b/multi-platform @@ -0,0 +1,76 @@ +# This starter workflow is for a CMake project running on multiple platforms. There is a different starter workflow if you just want a single platform. +# See: https://github.com/actions/starter-workflows/blob/main/ci/cmake-single-platform.yml +name: CMake multi-platform + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + +jobs: + build: + runs-on: ${{ matrix.os }} + + strategy: + # Set fail-fast to false to ensure that feedback is delivered for all matrix combinations. Consider changing this to true when your workflow is stable. + fail-fast: false + max-parallel: 2 + + # Set up a matrix to run the following 3 configurations: + # 1. + # 2. + # 3. + # + # To add more build types (Release, Debug, RelWithDebInfo, etc.) customize the build_type list. + matrix: + os: [ubuntu-latest, windows-latest] + build_type: [Release] + c_compiler: [gcc, clang, cl] + include: + - os: windows-latest + c_compiler: cl + cpp_compiler: cl + - os: ubuntu-latest + c_compiler: gcc + cpp_compiler: g++ + - os: ubuntu-latest + c_compiler: clang + cpp_compiler: clang++ + exclude: + - os: windows-latest + c_compiler: gcc + - os: windows-latest + c_compiler: clang + - os: ubuntu-latest + c_compiler: cl + + steps: + - uses: actions/checkout@v4 + + - name: Set reusable strings + # Turn repeated input strings (such as the build output directory) into step outputs. These step outputs can be used throughout the workflow file. + id: strings + shell: bash + run: | + echo "build-output-dir=${{ github.workspace }}/build" >> "$GITHUB_OUTPUT" + + - name: Configure CMake + # Configure CMake in a 'build' subdirectory. `CMAKE_BUILD_TYPE` is only required if you are using a single-configuration generator such as make. + # See https://cmake.org/cmake/help/latest/variable/CMAKE_BUILD_TYPE.html?highlight=cmake_build_type + run: > + cmake -B ${{ steps.strings.outputs.build-output-dir }} + -DCMAKE_CXX_COMPILER=${{ matrix.cpp_compiler }} + -DCMAKE_C_COMPILER=${{ matrix.c_compiler }} + -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} + -S ${{ github.workspace }} + + - name: Build + # Build your program with the given configuration. Note that --config is needed because the default Windows generator is a multi-config generator (Visual Studio generator). + run: cmake --build ${{ steps.strings.outputs.build-output-dir }} --config ${{ matrix.build_type }} + + - name: Test + working-directory: ${{ steps.strings.outputs.build-output-dir }} + # Execute tests defined by the CMake configuration. Note that --build-config is needed because the default Windows generator is a multi-config generator (Visual Studio generator). + # See https://cmake.org/cmake/help/latest/manual/ctest.1.html for more detail + run: ctest --build-config ${{ matrix.build_type }} diff --git a/test_cpp.yml.txt b/test_cpp.yml.txt new file mode 100644 index 0000000..9c7ab8d --- /dev/null +++ b/test_cpp.yml.txt @@ -0,0 +1,591 @@ +name: C++ Tests + +on: + workflow_call: + inputs: + continuous-run: + required: true + description: "Boolean string denoting whether this run is continuous -- empty string for presubmit, non-empty string for continuous." + type: string + safe-checkout: + required: true + description: "The SHA key for the commit we want to run over" + type: string + continuous-prefix: + required: true + description: "The string continuous-only tests should be prefixed with when displaying test results." + type: string + +permissions: + contents: read + +env: + SCCACHE_CACHE_PREFIX_LINUX_CMAKE: linux-cmake + SCCACHE_CACHE_PREFIX_LINUX_CMAKE_INSTALL: linux-cmake-install + SCCACHE_CACHE_PREFIX_LINUX_CMAKE_GCC: linux-cmake-gcc + SCCACHE_CACHE_PREFIX_LINUX_CMAKE_32BIT: linux-cmake-32-bit + +jobs: + # ============================================================================ + # LINUX JOBS + # ============================================================================ + + linux: + strategy: + fail-fast: false + matrix: + config: + - { name: Optimized, flags: --config=opt } + - { name: Debug, flags: --config=dbg, continuous-only: true } + - { name: ASAN, flags: --config=asan, runner: ubuntu-22-4core } + - { name: MSAN, flags: --config=docker-msan, runner: ubuntu-22-4core, continuous-only: true } + - { name: TSAN, flags: --config=tsan, runner: ubuntu-22-4core, continuous-only: true } + - { name: UBSAN, flags: --config=ubsan, runner: ubuntu-22-4core, continuous-only: true } + - { name: No-RTTI, flags: --cxxopt=-fno-rtti, continuous-only: true } + include: + - image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:8.0.1-a6ca8ba8e77d63471b4ad05f8643e1fc58b30e12 + - targets: //pkg/... //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests + - config: { name: "Bazel8", flags: --cxxopt="-Wno-self-assign-overloaded" } + cache_key: Bazel8 + image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:8.6.0-9dca0d9417f43f5f1e97e59969fb0f3e6ae3bd9c" + targets: "//src/... //third_party/utf8_range/..." + - config: { name: "Bazel9", flags: "--cxxopt=-Wno-self-assign-overloaded" } + cache_key: Bazel9 + image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:9.0.0-9dca0d9417f43f5f1e97e59969fb0f3e6ae3bd9c" + targets: "//src/... //third_party/utf8_range/..." + - config: { name: "TCMalloc" } + cache_key: TcMalloc + image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc:8.0.1-a6ca8ba8e77d63471b4ad05f8643e1fc58b30e12" + targets: "//src/... //third_party/utf8_range/..." + - config: { name: "aarch64", flags: "--platforms=//build_defs:linux-aarch_64" } + cache_key: aarch64-bazel8 + targets: "//src/... //src/google/protobuf/compiler:protoc_aarch64_test //third_party/utf8_range/..." + image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:8.0.1-aarch64-a6ca8ba8e77d63471b4ad05f8643e1fc58b30e12" + name: ${{ matrix.config.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.config.name }} + runs-on: ${{ matrix.config.runner || 'ubuntu-latest' }} + steps: + - name: Checkout pending changes + if: ${{ !matrix.config.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Run tests + if: ${{ !matrix.config.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/bazel-docker@v5 + with: + image: ${{ matrix.image }} + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + bazel-cache: cpp_linux/${{ matrix.cache_key }} + bazel: test ${{ matrix.targets }} ${{ matrix.config.flags }} + exclude-targets: ${{ matrix.exclude-targets }} + + linux-gcc: + strategy: + fail-fast: false + matrix: + version: ['10.4', '13.1'] + name: Linux GCC ${{ matrix.version }} + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Run tests + uses: protocolbuffers/protobuf-ci/bazel-docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:8.0.1-${{ matrix.version }}-e78301df86b3e4c46ec9ac4d98be00e19305d8f3 + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + bazel-cache: cpp_linux/gcc-${{ matrix.version }} + bazel: test //pkg/... //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests + + linux-release: + strategy: + fail-fast: false + matrix: + arch: [x86_64, aarch64] + include: + - arch: aarch64 + continuous-only: true + name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux Release ${{ matrix.arch }} + runs-on: ubuntu-22-4core + steps: + - name: Checkout pending changes + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Cross compile protoc for ${{ matrix.arch }} + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + id: cross-compile + uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:8.6.0-9dca0d9417f43f5f1e97e59969fb0f3e6ae3bd9c + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + architecture: linux-${{ matrix.arch }} + - name: Setup sccache + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/sccache@v5 + with: + cache-prefix: linux-release-${{ matrix.arch }} + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + - name: Run tests + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:8.0.1-${{ matrix.arch }}-a6ca8ba8e77d63471b4ad05f8643e1fc58b30e12 + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + entrypoint: bash + command: | + -c "set -ex + sccache -z + cmake . -DWITH_PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }} \ + -Dprotobuf_BUILD_TESTS=ON \ + -Dprotobuf_BUILD_CONFORMANCE=ON \ + -DCMAKE_CXX_STANDARD=17 \ + -Dprotobuf_WITH_ZLIB=OFF \ + ${{ env.SCCACHE_CMAKE_FLAGS }} + cmake --build . --parallel 20 + ctest --no-tests=error --parallel 20 + sccache -s" + + linux-cmake: + strategy: + fail-fast: false + matrix: + include: + - flags: -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=17 -Dprotobuf_BUILD_CONFORMANCE=ON + - name: Ninja + flags: -G Ninja -DCMAKE_CXX_STANDARD=17 + continuous-only: true + - name: Shared + flags: -Dprotobuf_BUILD_SHARED_LIBS=ON -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=17 + continuous-only: true + - name: C++20 + flags: -DCMAKE_CXX_STANDARD=20 + - name: Package + flags: -DCMAKE_CXX_STANDARD=17 -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=ON + - name: Fetch + flags: -DCMAKE_CXX_STANDARD=17 -Dprotobuf_FORCE_FETCH_DEPENDENCIES=ON + name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux CMake ${{ matrix.name }} + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Setup sccache + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/sccache@v5 + with: + cache-prefix: ${{ env.SCCACHE_CACHE_PREFIX_LINUX_CMAKE }} + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + - name: Run tests + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.16.9-9626718698895971df3953d4aa2321d7425f3c5f + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + command: >- + /test.sh ${{ matrix.flags }} ${{ env.SCCACHE_CMAKE_FLAGS }} + -Dprotobuf_BUILD_TESTS=ON ${{ matrix.package_flags }} + + linux-cmake-install: + strategy: + fail-fast: false + matrix: + type: [package, static, fetch] + include: + - type: package + name: Install + flags: -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=ON -Dprotobuf_BUILD_SHARED_LIBS=ON + - type: static + name: Install (static) + flags: -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=ON -Dprotobuf_BUILD_SHARED_LIBS=OFF + - type: fetch + name: Install (Fetch) + flags: -Dprotobuf_FORCE_FETCH_DEPENDENCIES=ON -Dprotobuf_BUILD_SHARED_LIBS=ON + continuous-only: true + name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux CMake ${{ matrix.name }} + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Setup sccache + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/sccache@v5 + with: + cache-prefix: ${{ env.SCCACHE_CACHE_PREFIX_LINUX_CMAKE_INSTALL }} + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + - name: Run tests + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.16.9-9626718698895971df3953d4aa2321d7425f3c5f + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + command: >- + /install.sh -DCMAKE_CXX_STANDARD=17 ${{ env.SCCACHE_CMAKE_FLAGS }} + ${{ matrix.flags }} && + cp build/install_manifest.txt . && + /test.sh ${{ env.SCCACHE_CMAKE_FLAGS }} + -Dprotobuf_REMOVE_INSTALLED_HEADERS=ON + -Dprotobuf_BUILD_PROTOBUF_BINARIES=OFF + -Dprotobuf_BUILD_CONFORMANCE=ON + -DCMAKE_CXX_STANDARD=17 + ${{ matrix.flags }} + - name: Clean up install manifest + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + run: | + set -ex + mkdir manifest + cat install_manifest.txt | sort | sed 's:/usr/local/::g' > manifest/all.txt + cat manifest/all.txt | grep -E '^include/' | grep -vE 'internal' | sed 's:^include/::g' > manifest/include.txt + cat manifest/all.txt | grep -E '^bin/' | grep -vE '\-[0-9]+\.[0-9]+\.[0-9]+$' | sed 's:^bin/::g' > manifest/bin.txt + cat manifest/all.txt | grep -E '^lib/' | grep -vE '\.[0-9]+\.[0-9]+\.[0-9]+$' | sed 's:^lib/::g' > manifest/lib.txt + - name: Upload install manifest + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + with: + name: installed_files_${{ matrix.type }} + path: manifest/*.txt + + install-manifests: + strategy: + fail-fast: false + matrix: + type: [include, bin, lib] + build: [static, package] + include: + - type: lib + build: static + golden: 'lib_static' + - type: lib + build: package + golden: 'lib_shared' + name: Check Installed Files + needs: linux-cmake-install + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Download manifest + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + with: + name: installed_files_${{ matrix.build }} + path: ${{ matrix.build }} + - name: Compare against golden + run: | + set +e + GOLDEN_FILE=cmake/installed_${{ matrix.golden || matrix.type }}_golden.txt + DIFF="$(diff -u ${GOLDEN_FILE} ${{ matrix.build }}/${{ matrix.type }}.txt)" + if [ -n "$DIFF" ]; then + echo "Installed files do not match goldens!" + echo "If this is expected, please update the golden file: ${GOLDEN_FILE}" + echo "The following diffs were found:" + echo "$DIFF" + exit 1 + else + echo "Installed files match goldens." + fi + + linux-cmake-examples: + name: ${{ inputs.continuous-prefix }} Linux CMake Examples + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + if: ${{ inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Setup sccache + if: ${{ inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/sccache@v5 + with: + cache-prefix: linux-cmake-examples + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + - name: Run tests + if: ${{ inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.16.9-9626718698895971df3953d4aa2321d7425f3c5f + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + command: >- + /install.sh -DCMAKE_CXX_STANDARD=17 ${{ env.SCCACHE_CMAKE_FLAGS }} + -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=OFF + -Dprotobuf_BUILD_EXAMPLES=OFF -Dprotobuf_BUILD_TESTS=ON && + mkdir examples/build && + cd examples/build && + cmake .. -DCMAKE_CXX_STANDARD=17 && + cmake --build . + + linux-cmake-gcc: + strategy: + fail-fast: false + matrix: + include: + - name: C++17 + flags: -DCMAKE_CXX_STANDARD=17 + continuous-only: true + - name: C++20 + flags: -DCMAKE_CXX_STANDARD=20 + name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux CMake GCC ${{ matrix.name }} + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Setup sccache + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/sccache@v5 + with: + cache-prefix: ${{ env.SCCACHE_CACHE_PREFIX_LINUX_CMAKE_GCC }} + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + - name: Run tests + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:8.0.1-12.2-168f9c9d015a0fa16611e1e9eede796fe9bfbb69 + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + entrypoint: bash + command: | + -c 'set -ex + cd /workspace + sccache -z + cmake . -Dprotobuf_BUILD_TESTS=ON ${{ matrix.flags }} ${{ env.SCCACHE_CMAKE_FLAGS }} + cmake --build . --parallel 20 + ctest --no-tests=error --verbose --parallel 20 + sccache -s' + + linux-cmake-32-bit: + name: Linux CMake 32-bit + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Setup sccache + uses: protocolbuffers/protobuf-ci/sccache@v5 + with: + cache-prefix: ${{ env.SCCACHE_CACHE_PREFIX_LINUX_CMAKE_32BIT }} + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + - name: Run tests + uses: protocolbuffers/protobuf-ci/docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/test/linux/32bit@sha256:d6028ab408c49932836cdc514116f06886d7f6868a4d430630aa52adc5aee2fc + platform: linux/386 + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + entrypoint: bash + command: | + -c 'set -ex + cd /workspace + sccache -z + cmake . -DCMAKE_CXX_STANDARD=17 -Dprotobuf_BUILD_TESTS=ON ${{ env.SCCACHE_CMAKE_FLAGS }} + cmake --build . --parallel 20 + ctest --no-tests=error --verbose --parallel 20 + sccache -s' + + linux-abseil-head: + name: ${{ inputs.continuous-prefix }} Linux Abseil HEAD + runs-on: ubuntu-latest + steps: + - name: Checkout pending changes + if: ${{ inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Checkout Abseil HEAD + if: ${{ inputs.continuous-run }} + uses: actions/checkout@v5 + with: + repository: abseil/abseil-cpp + path: abseil-cpp-head + - name: Run tests + if: ${{ inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/bazel-docker@v5 + with: + image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:9.0.0-7932bf8b25fb76a111e7257d151a6a58d5c3c671 + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + bazel-cache: cpp_linux/abseil_head + bazel: test //src/... --override_module=abseil-cpp=abseil-cpp-head + + # ============================================================================ + # CROSS-PLATFORM JOBS (macOS & Windows) + # ============================================================================ + + non-linux: + strategy: + fail-fast: false + matrix: + include: + - name: MacOS Bazel + os: macos-14 + cache_key: macos-14-bazel8 + bazel: test //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests + - name: MacOS Intel Bazel + os: macos-14 + cache_key: macos-14-intel + bazel: test --cpu=darwin_x86_64 //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests + - name: Windows Bazel + os: windows-2022 + cache_key: windows-2022-msvc-cl + bazel: test //src/... --config=msvc-cl --test_tag_filters=-conformance --build_tag_filters=-conformance + - name: Windows Bazel C++20 + os: windows-2022 + cache_key: windows-2022-msvc-cl + bazel: test //src/... --config=msvc-cl --cxxopt="-std:c++20" --test_tag_filters=-conformance --build_tag_filters=-conformance + - name: Windows Bazel clang-cl + os: windows-2022 + cache_key: windows-2022-clang-cl + bazel: test //src/... --test_tag_filters=-conformance --build_tag_filters=-conformance + name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} ${{ matrix.name }} + runs-on: ${{ matrix.os }} + steps: + - name: Checkout pending changes + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + - name: Run tests + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/bazel@v5 + with: + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + bazel: ${{ matrix.bazel }} + bazel-cache: cpp_${{ matrix.cache_key }} + version: ${{ matrix.bazel_version || '8.0.1' }} + + non-linux-cmake: + strategy: + fail-fast: false + matrix: + include: + - name: MacOS CMake + os: macos-14 + cache-prefix: macos-cmake + continuous-only: true + - name: Windows CMake + os: windows-2022 + flags: >- + -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF + -Dprotobuf_BUILD_SHARED_LIBS=OFF + -Dprotobuf_BUILD_EXAMPLES=ON + vsversion: '2022' + cache-prefix: windows-2022-cmake + - name: Windows CMake 32-bit + os: windows-2022 + flags: >- + -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF + vsversion: '2022' + windows-arch: 'win32' + cache-prefix: windows-2022-win32-cmake + continuous-only: true + - name: Windows CMake Shared + os: windows-2022 + flags: >- + -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF + -Dprotobuf_BUILD_SHARED_LIBS=ON + vsversion: '2022' + cache-prefix: windows-2022-cmake + - name: Windows CMake Install + os: windows-2022 + install-flags: >- + -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF + flags: >- + -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF + -Dprotobuf_REMOVE_INSTALLED_HEADERS=ON + -Dprotobuf_BUILD_PROTOBUF_BINARIES=OFF + vsversion: '2022' + cache-prefix: windows-2022-cmake + continuous-only: true + name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} ${{ matrix.name }} + runs-on: ${{ matrix.os }} + steps: + - name: Checkout pending changes + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/checkout@v5 + with: + ref: ${{ inputs.safe-checkout }} + + - name: Setup MSVC + if: ${{ runner.os == 'Windows' && (!matrix.continuous-only || inputs.continuous-run) }} + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 + with: + arch: ${{ matrix.windows-arch || 'x64' }} + vsversion: ${{ matrix.vsversion }} + + - name: Setup sccache + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/sccache@v5 + with: + cache-prefix: ${{ matrix.cache-prefix }} + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + + # Install phase (Windows-specific with proper path handling) + - name: Configure CMake for install + if: ${{ matrix.install-flags && (!matrix.continuous-only || inputs.continuous-run) }} + uses: protocolbuffers/protobuf-ci/bash@v5 + with: + bazel-version: 8.0.1 + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + command: >- + cmake . -DCMAKE_CXX_STANDARD=17 -Dprotobuf_BUILD_TESTS=ON + ${{ matrix.install-flags }} + ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON + + - name: Build for install + if: ${{ matrix.install-flags && (!matrix.continuous-only || inputs.continuous-run) }} + shell: bash + run: VERBOSE=1 cmake --build . --parallel 20 + + - name: Install + if: ${{ matrix.install-flags && (!matrix.continuous-only || inputs.continuous-run) }} + shell: bash + run: cmake --build . --target install + + - name: Report and clear sccache stats + if: ${{ matrix.install-flags && (!matrix.continuous-only || inputs.continuous-run) }} + shell: bash + run: sccache -s && sccache -z + + - name: Clear CMake cache + if: ${{ matrix.install-flags && (!matrix.continuous-only || inputs.continuous-run) }} + shell: bash + run: | + cmake --build . --target clean + rm -f CMakeCache.txt + + # Standard test phase + - name: Configure CMake + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + uses: protocolbuffers/protobuf-ci/bash@v5 + with: + credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }} + bazel-version: 8.0.1 + command: >- + cmake . -DCMAKE_CXX_STANDARD=17 -Dprotobuf_BUILD_TESTS=ON + ${{ matrix.flags }} + ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON + + - name: Build + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + shell: bash + run: VERBOSE=1 cmake --build . --parallel 20 + + - name: Test + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + shell: bash + run: ctest --no-tests=error --verbose --parallel 20 -C Debug + + - name: Report sccache stats + if: ${{ !matrix.continuous-only || inputs.continuous-run }} + shell: bash + run: sccache -s \ No newline at end of file