mirror of
https://github.com/steredbits/pelagia.git
synced 2026-10-23 07:01:50 +02:00
88 lines
3.5 KiB
YAML
88 lines
3.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
# Read-only token for every job (fork pull requests included).
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build-linux:
|
|
name: Linux build + tests
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# No screen or sound card in CI: dummy SDL drivers.
|
|
SDL_VIDEODRIVER: dummy
|
|
SDL_AUDIODRIVER: dummy
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- name: Dependencies (libcurl, ffmpeg, SDL2, python3 for the fake server)
|
|
# The apt mirror is sometimes silent: mirror switch and fast failure (ci/apt-install.sh).
|
|
timeout-minutes: 5
|
|
run: |
|
|
./ci/apt-install.sh libcurl4-openssl-dev \
|
|
libavformat-dev libavcodec-dev libswscale-dev \
|
|
libswresample-dev libavutil-dev \
|
|
libsdl2-dev ffmpeg python3
|
|
- name: Build and tests
|
|
run: ./ci/build-linux.sh
|
|
- name: Smoke test headless (pelagia-play)
|
|
run: |
|
|
ffmpeg -hide_banner -loglevel error -y \
|
|
-f lavfi -i "testsrc2=size=640x360:rate=25:duration=5" \
|
|
-f lavfi -i "sine=frequency=440:sample_rate=48000:duration=5" \
|
|
-c:v libx264 -preset veryfast -pix_fmt yuv420p -c:a aac \
|
|
/tmp/pelagia-smoke.mp4
|
|
./build-linux/pelagia-play --headless /tmp/pelagia-smoke.mp4
|
|
|
|
# Checking build: libstdc++ assertions (_GLIBCXX_ASSERTIONS, enabled by default
|
|
# on Fedora but not on Ubuntu's GCC), AddressSanitizer and UBSan, running the
|
|
# whole ctest suite. Catches std::vector overruns, out-of-bounds accesses,
|
|
# undefined behavior and leaks that the normal build lets through
|
|
# (real case: SoftCanvas read out of its buffer, invisible here).
|
|
sanitizers:
|
|
name: Debug + assertions libstdc++ + ASan/UBSan
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
env:
|
|
SDL_VIDEODRIVER: dummy
|
|
SDL_AUDIODRIVER: dummy
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- name: Dependencies (libcurl, ffmpeg, SDL2, python3 for the fake server)
|
|
# The apt mirror is sometimes silent: mirror switch and fast failure (ci/apt-install.sh).
|
|
timeout-minutes: 5
|
|
run: |
|
|
./ci/apt-install.sh libcurl4-openssl-dev \
|
|
libavformat-dev libavcodec-dev libswscale-dev \
|
|
libswresample-dev libavutil-dev \
|
|
libsdl2-dev ffmpeg python3
|
|
- name: ASan compatibility (ASLR entropy of recent kernels)
|
|
# No effect on kernels that do not need it; avoids the
|
|
# "DEADLYSIGNAL" errors of ASan runtimes older than the kernel.
|
|
run: sudo sysctl -w vm.mmap_rnd_bits=28 || true
|
|
- name: Debug sanitizers build and all tests
|
|
run: ./ci/build-sanitize.sh
|
|
|
|
# Secret scan (gitleaks) of the working tree and the whole history;
|
|
# configuration and fake test tokens are declared in .gitleaks.toml.
|
|
secrets:
|
|
name: Secrets (gitleaks)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
|
with:
|
|
go-version: stable
|
|
- name: Install gitleaks (pinned version)
|
|
# The module still declares its path as github.com/zricethezav/gitleaks/v8 (also on master):
|
|
# `go install` refuses github.com/gitleaks/gitleaks/v8 ("module declares its path as").
|
|
run: go install github.com/zricethezav/gitleaks/v8@v8.30.1
|
|
- name: Scan
|
|
run: ./tools/scan-secrets.sh
|