.gitlab-ci.yml 6.96 KB
Newer Older
1
2
3
4
5
####
# DO NOT EDIT THIS FILE IN MASTER.  ONLY EDIT IT IN THE OLDEST SUPPORTED
# BRANCH, THEN MERGE FORWARD.
####

6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# This file controls how gitlab validates Tor commits and merge requests.
#
# It is primarily based on a set of scripts and configurations by
# Hans-Christoph Steiner.  It only copies parts of those scripts and
# configurations for now.  If you want a new piece of functionality
# (more debians, more fedoras, android support) then you shouldn't
# start from scratch: have a look at the original ticket, at
# https://gitlab.torproject.org/tpo/core/tor/-/issues/32193 !
#
# The file to copy from is
# https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/96/diffs#diff-content-587d266bb27a4dc3022bbed44dfa19849df3044c
#
# Having said that, if there is anything really stupid here, don't
# blame it on Hans-Christoph! Tor probably added it on their own.
#
# Copyright 2020, The Tor Project, Inc.
# See LICENSE for licence information.
23

24
25
26
27
# These variables are set everywhere, unconditionally.
variables:
  TERM: "ansi"
  DEBUG_CI: "yes"
Hiro's avatar
Fix yml    
Hiro committed
28

29
30
31
32
33
34
35
36
37
38
39
# This template is for exporting ephemeral things from the scripts.  By
# convention we expect our scripts to copy stuff into artifacts/, rather than
# having a big list of files that be treated as artifacts.
.artifacts-template: &artifacts-template
  artifacts:
    name: "${CI_PROJECT_PATH}_${CI_JOB_STAGE}_${CI_COMMIT_REF_NAME}_${CI_COMMIT_SHA}"
    expire_in: 1 week
    when: always
    paths:
      - artifacts/

Nick Mathewson's avatar
Nick Mathewson committed
40
# This template should be usable on any system that's based on apt.
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
.apt-template: &apt-template |
      export LC_ALL=C.UTF-8
      echo Etc/UTC > /etc/timezone
      mkdir -p apt-cache
      export APT_CACHE_DIR="$(pwd)/apt-cache"
      echo 'quiet "1";' \
           'APT::Install-Recommends "0";' \
           'APT::Install-Suggests "0";' \
           'APT::Acquire::Retries "20";' \
           'APT::Get::Assume-Yes "true";' \
           'Dpkg::Use-Pty "0";' \
           "Dir::Cache::Archives \"${APT_CACHE_DIR}\"; " \
        >> /etc/apt/apt.conf.d/99gitlab
      apt-get update -qq
      apt-get upgrade -qy

Nick Mathewson's avatar
Nick Mathewson committed
57
# This template sets us up for Debian system in particular.
58
59
60
61
.debian-template: &debian-template
  <<: *artifacts-template
  variables:
    DEBIAN_FRONTEND: "noninteractive"
62
63
64
65
66
  # TODO: Using "cache" in this way speeds up our downloads.  It would be
  # even better, though, to start with a pre-upgraded debian image.
  #
  # TODO: Will we have to do this differently once we have more than one
  # debian version that we're using?
67
68
69
70
71
72
  cache:
    key: apt
    paths:
      - apt-cache
  before_script:
    - *apt-template
73
    # Install patches unconditionally.
74
75
76
    - apt-get install
        automake
        build-essential
77
        ca-certificates
78
79
80
81
82
83
84
85
86
        git
        libevent-dev
        liblzma-dev
        libscrypt-dev
        libseccomp-dev
        libssl-dev
        pkg-config
        python3
        zlib1g-dev
87
    # Install patches that we only need for some use cases.
88
89
    - if [ "$ASCIIDOC" = yes ]; then apt-get install asciidoc xmlto; fi
    - if [ "$DOXYGEN" = yes ]; then apt-get install doxygen; fi
90
91
    - if [ "$STEM" = yes ]; then apt-get install timelimit; fi
    - if [ "$CC" = clang ]; then apt-get install clang; fi
Nick Mathewson's avatar
Nick Mathewson committed
92
    - if [ "$NSS" = yes ]; then apt-get install libnss3 libnss3-dev; fi
93
    # TODO: This next line should not be debian-only.
94
    - if [ "$STEM" = yes ]; then git clone --depth 1 https://git.torproject.org/stem.git ; export STEM_PATH="$(pwd)/stem"; fi
95
    # TODO: This next line should not be debian-only.
96
    - if [ "$CHUTNEY" = yes ]; then git clone --depth 1 https://git.torproject.org/chutney.git ;  export CHUTNEY_PATH="$(pwd)/chutney"; fi
97
    - if [ "$TRACING" = yes ]; then apt install liblttng-ust-dev; fi
98

99
100
# Minmal check on debian: just make, make check.
#
101
102
103
debian-minimal:
  image: debian:stable
  <<: *debian-template
Hiro's avatar
Hiro committed
104
  script:
105
106
    - ./scripts/ci/ci-driver.sh

107
108
109
110
#####
# Run "make check" with a hardened clang on debian stable.  This takes
# care of a hardening check, and a compile-with-clang check.
#
111
# TODO: This will be faster once we merge #40098 and #40099.
112
113
114
115
debian-hardened:
  image: debian:testing
  <<: *debian-template
  variables:
116
    ALL_BUGS_ARE_FATAL: "yes"
117
118
119
120
    HARDENING: "yes"
    CC: "clang"
  script:
    - ./scripts/ci/ci-driver.sh
Hiro's avatar
Hiro committed
121

122
123
#####
# Distcheck on debian stable
124
125
126
127
128
129
130
131
132
debian-distcheck:
  image: debian:stable
  <<: *debian-template
  variables:
    DISTCHECK: "yes"
    CHECK: "no"
  script:
    - ./scripts/ci/ci-driver.sh

133
134
#####
# Documentation tests on debian stable: doxygen and asciidoc.
135
136
137
138
debian-docs:
  image: debian:stable
  <<: *debian-template
  variables:
139
140
    DOXYGEN: "yes"
    ASCIIDOC: "yes"
141
    CHECK: "no"
142
    RUN_STAGE_BUILD: "no"
143
144
  script:
    - ./scripts/ci/ci-driver.sh
145

146
147
148
149
150
151
152
#####
# Integration tests on debian stable: chutney and stem.
#
# TODO: It would be cool if this target didn't have to re-build tor, and
#       could instead re-use Tor from debian-minimal.  That can be done
#       with the 'artifacts' mechanism, in theory, but it would be good to
#       avoid having to have a system with hundreds of artifacts.
153
154
155
156
157
158
debian-integration:
  image: debian:stable
  <<: *debian-template
  variables:
    CHECK: "no"
    CHUTNEY: "yes"
159
    CHUTNEY_MAKE_TARGET: "test-network-all"
160
    STEM: "yes"
161
    ALL_BUGS_ARE_FATAL: "yes"
162
163
  script:
    - ./scripts/ci/ci-driver.sh
164
165
166
167
168
169
170
171
172

#####
# Tracing build on Debian stable.
debian-tracing:
  image: debian:stable
  <<: *debian-template
  variables:
    TRACING: "yes"
    CHECK: "no"
173
    DISTCHECK: "yes"
174
175
  script:
    - ./scripts/ci/ci-driver.sh
176
177
178
179
180
181
182
183
184
185
186
187
  # Ensure that we only run tracing when it's implemented.
  #
  # Once versions before 0.4.5 are obsolete, we can remove this test.
  rules:
    # This first "if" check prevents us from running a duplicate version of
    # this pipeline whenever we push and create an MR.  I don't understand why
    # it is necessary, though the following URL purports to explain:
    #
    # https://docs.gitlab.com/ee/ci/yaml/#prevent-duplicate-pipelines
    - if: '$CI_PIPELINE_SOURCE == "push"'
      exists:
        - src/lib/trace/trace_sys.c
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219

#####
# No-authority mode
debian-disable-dirauth:
  image: debian:stable
  <<: *debian-template
  variables:
    DISABLE_DIRAUTH: "yes"
  script:
    - ./scripts/ci/ci-driver.sh

#####
# No-relay mode
debian-disable-relay:
  image: debian:stable
  <<: *debian-template
  variables:
    DISABLE_RELAY: "yes"
  script:
    - ./scripts/ci/ci-driver.sh
  # Ensure that we only run tracing when it's implemented.
  #
  # Once versions before 0.4.3 are obsolete, we can remove this test.
  rules:
    # This first "if" check prevents us from running a duplicate version of
    # this pipeline whenever we push and create an MR.  I don't understand why
    # it is necessary, though the following URL purports to explain:
    #
    # https://docs.gitlab.com/ee/ci/yaml/#prevent-duplicate-pipelines
    - if: '$CI_PIPELINE_SOURCE == "push"'
      exists:
        - src/feature/relay/relay_stub.c
Nick Mathewson's avatar
Nick Mathewson committed
220
221
222
223
224
225
226
227
228
229

#####
# NSS check on debian
debian-nss:
  image: debian:stable
  <<: *debian-template
  variables:
    NSS: "yes"
  script:
    - ./scripts/ci/ci-driver.sh