64898b2c79
Some checks failed
Code scanning / CodeQL (push) Failing after 15s
Zulip production suite / Ubuntu 22.04 production build (push) Failing after 26s
Zulip production suite / Debian 12 production install with custom db name and user (push) Has been skipped
Zulip production suite / Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga (push) Has been skipped
Zulip production suite / Ubuntu 24.04 production install (push) Has been skipped
Zulip production suite / Ubuntu 26.04 production install (push) Has been skipped
Zulip production suite / Debian 13 production install (push) Has been skipped
Zulip production suite / 7.0 Version Upgrade (push) Has been skipped
Zulip production suite / 8.0 Version Upgrade (push) Has been skipped
Zulip production suite / 6.0 Version Upgrade (push) Has been skipped
Zulip production suite / 10.0 Version Upgrade (push) Has been skipped
Zulip production suite / 9.0 Version Upgrade (push) Has been skipped
Zulip production suite / 12.0 Version Upgrade (push) Has been skipped
Zulip production suite / 11.0 Version Upgrade (push) Has been skipped
GitHub Actions Security Analysis with zizmor / zizmor (push) Failing after 3s
Zulip CI / Debian 12 (Python 3.11, backend + documentation) (push) Failing after 26s
Zulip CI / Ubuntu 22.04 (Python 3.10, backend + frontend) (push) Failing after 3s
Zulip CI / Ubuntu 24.04 (Python 3.12, backend) (push) Failing after 25s
Zulip CI / Ubuntu 26.04 (Python 3.14, backend) (push) Failing after 25s
Zulip CI / Debian 13 (Python 3.13, backend) (push) Failing after 28s
Zulip production suite / Required jobs (push) Has been cancelled
Zulip CI / Required jobs (push) Has been cancelled
API Documentation Update Check / check-feature-level-updated (push) Has been cancelled
API Documentation Update Check / notify-if-api-docs-changed (push) Has been cancelled
355 lines
12 KiB
YAML
355 lines
12 KiB
YAML
name: Zulip production suite
|
|
|
|
on:
|
|
push:
|
|
branches: ["*.x", chat.zulip.org, main]
|
|
tags: ["*"]
|
|
pull_request:
|
|
paths:
|
|
- .github/workflows/production-suite.yml
|
|
- "**/migrations/**"
|
|
- manage.py
|
|
- pnpm-lock.yaml
|
|
- puppet/**
|
|
- scripts/**
|
|
- tools/**
|
|
- uv.lock
|
|
- web/babel.config.js
|
|
- web/postcss.config.js
|
|
- web/third/**
|
|
- web/webpack.config.ts
|
|
- zerver/apps.py
|
|
- zerver/checks.py
|
|
- zerver/worker/queue_processors.py
|
|
- zerver/lib/push_notifications.py
|
|
- zerver/lib/storage.py
|
|
- zerver/decorator.py
|
|
- zproject/**
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: "${{ github.workflow }}-${{ github.head_ref || github.run_id }}"
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
production_build:
|
|
# This job builds a release tarball from the current commit, which
|
|
# will be used for all of the following install/upgrade tests.
|
|
name: Ubuntu 22.04 production build
|
|
runs-on: ubuntu-latest
|
|
|
|
# Docker images are built from 'tools/ci/Dockerfile'; the comments at
|
|
# the top explain how to build and upload these images.
|
|
# Ubuntu 22.04 ships with Python 3.10.12.
|
|
container: zulip/ci:jammy
|
|
|
|
steps:
|
|
- name: Add required permissions
|
|
run: |
|
|
# The checkout actions doesn't clone to ~/zulip or allow
|
|
# us to use the path option to clone outside the current
|
|
# /__w/zulip/zulip directory. Since this directory is owned
|
|
# by root we need to change it's ownership to allow the
|
|
# github user to clone the code here.
|
|
# Note: /__w/ is a docker volume mounted to $GITHUB_WORKSPACE
|
|
# which is /home/runner/work/.
|
|
sudo chown -R github .
|
|
|
|
# This is the GitHub Actions specific cache directory the
|
|
# the current github user must be able to access for the
|
|
# cache action to work. It is owned by root currently.
|
|
sudo chmod -R 0777 /__w/_temp/
|
|
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Create cache directories
|
|
run: |
|
|
dirs=(/srv/zulip-emoji-cache)
|
|
sudo mkdir -p "${dirs[@]}"
|
|
sudo chown -R github "${dirs[@]}"
|
|
|
|
- name: Restore pnpm store
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
# zizmor: ignore[cache-poisoning]
|
|
with:
|
|
path: /__w/.pnpm-store
|
|
key: v1-pnpm-store-jammy-${{ hashFiles('pnpm-lock.yaml') }}
|
|
|
|
- name: Restore uv cache
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
# zizmor: ignore[cache-poisoning]
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-jammy-${{ hashFiles('uv.lock') }}
|
|
restore-keys: uv-jammy-
|
|
|
|
- name: Restore emoji cache
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
# zizmor: ignore[cache-poisoning]
|
|
with:
|
|
path: /srv/zulip-emoji-cache
|
|
key: v1-emoji-jammy-${{ hashFiles('tools/setup/emoji/emoji_map.json') }}-${{ hashFiles('tools/setup/emoji/build_emoji') }}-${{ hashFiles('tools/setup/emoji/emoji_setup_utils.py') }}-${{ hashFiles('tools/setup/emoji/emoji_names.py') }}-${{ hashFiles('package.json') }}
|
|
restore-keys: v1-emoji-jammy
|
|
|
|
- name: Build production tarball
|
|
run: ./tools/ci/production-build
|
|
|
|
- name: Upload production build artifacts for install jobs
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: production-tarball
|
|
path: /tmp/production-build
|
|
retention-days: 1
|
|
|
|
- name: Verify pnpm store path
|
|
run: |
|
|
set -x
|
|
path="$(pnpm store path)"
|
|
[[ "$path" == /__w/.pnpm-store/* ]]
|
|
|
|
- name: Minimize uv cache
|
|
run: uv cache prune --ci
|
|
|
|
- name: Generate failure report string
|
|
id: failure_report_string
|
|
if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
|
|
run: tools/ci/generate-failure-message >> $GITHUB_OUTPUT
|
|
|
|
- name: Report status to CZO
|
|
if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
|
|
uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
|
|
with:
|
|
api-key: ${{ secrets.ZULIP_BOT_KEY }}
|
|
email: "github-actions-bot@chat.zulip.org"
|
|
organization-url: "https://chat.zulip.org"
|
|
to: "automated testing"
|
|
topic: ${{ steps.failure_report_string.outputs.topic }}
|
|
type: "stream"
|
|
content: ${{ steps.failure_report_string.outputs.content }}
|
|
|
|
production_install:
|
|
# This job installs the server release tarball built above on a
|
|
# range of platforms, and does some basic health checks on the
|
|
# resulting installer Zulip server.
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# Docker images are built from 'tools/ci/Dockerfile'; the comments at
|
|
# the top explain how to build and upload these images.
|
|
- docker_image: zulip/ci:jammy
|
|
name: Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga
|
|
os: jammy
|
|
extra-args: ""
|
|
|
|
- docker_image: zulip/ci:noble
|
|
name: Ubuntu 24.04 production install
|
|
os: noble
|
|
extra-args: ""
|
|
|
|
- docker_image: zulip/ci:resolute
|
|
name: Ubuntu 26.04 production install
|
|
os: resolute
|
|
extra-args: ""
|
|
|
|
- docker_image: zulip/ci:bookworm
|
|
name: Debian 12 production install with custom db name and user
|
|
os: bookworm
|
|
extra-args: --test-custom-db
|
|
|
|
- docker_image: zulip/ci:trixie
|
|
name: Debian 13 production install
|
|
os: trixie
|
|
extra-args: ""
|
|
|
|
name: ${{ matrix.name }}
|
|
container:
|
|
image: ${{ matrix.docker_image }}
|
|
options: --init
|
|
runs-on: ubuntu-latest
|
|
needs: production_build
|
|
|
|
steps:
|
|
- name: Download built production tarball
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: production-tarball
|
|
path: /tmp
|
|
|
|
- name: Add required permissions and setup
|
|
run: |
|
|
# This is the GitHub Actions specific cache directory the
|
|
# the current github user must be able to access for the
|
|
# cache action to work. It is owned by root currently.
|
|
sudo chmod -R 0777 /__w/_temp/
|
|
|
|
# Since actions/download-artifact@v6 loses all the permissions
|
|
# of the tarball uploaded by the upload artifact fix those.
|
|
chmod +x /tmp/production-upgrade-pg
|
|
chmod +x /tmp/production-pgroonga
|
|
chmod +x /tmp/production-install
|
|
chmod +x /tmp/production-verify
|
|
chmod +x /tmp/generate-failure-message
|
|
|
|
- name: Create cache directories
|
|
run: |
|
|
dirs=(/srv/zulip-emoji-cache)
|
|
sudo mkdir -p "${dirs[@]}"
|
|
sudo chown -R github "${dirs[@]}"
|
|
|
|
- name: Install production
|
|
run: sudo /tmp/production-install ${{ matrix.extra-args }}
|
|
|
|
- name: Verify install
|
|
run: sudo /tmp/production-verify ${{ matrix.extra-args }}
|
|
|
|
- name: Install pgroonga
|
|
if: ${{ matrix.os == 'jammy' }}
|
|
run: sudo /tmp/production-pgroonga
|
|
|
|
- name: Verify install after installing pgroonga
|
|
if: ${{ matrix.os == 'jammy' }}
|
|
run: sudo /tmp/production-verify ${{ matrix.extra-args }}
|
|
|
|
- name: Upgrade postgresql
|
|
if: ${{ matrix.os == 'jammy' }}
|
|
run: sudo /tmp/production-upgrade-pg
|
|
|
|
- name: Verify install after upgrading postgresql
|
|
if: ${{ matrix.os == 'jammy' }}
|
|
run: sudo /tmp/production-verify ${{ matrix.extra-args }}
|
|
|
|
- name: Generate failure report string
|
|
id: failure_report_string
|
|
if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
|
|
run: /tmp/generate-failure-message >> $GITHUB_OUTPUT
|
|
|
|
- name: Report status to CZO
|
|
if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
|
|
uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
|
|
with:
|
|
api-key: ${{ secrets.ZULIP_BOT_KEY }}
|
|
email: "github-actions-bot@chat.zulip.org"
|
|
organization-url: "https://chat.zulip.org"
|
|
to: "automated testing"
|
|
topic: ${{ steps.failure_report_string.outputs.topic }}
|
|
type: "stream"
|
|
content: ${{ steps.failure_report_string.outputs.content }}
|
|
|
|
production_upgrade:
|
|
# The production upgrade job starts with a container with a
|
|
# previous Zulip release installed, and attempts to upgrade it to
|
|
# the release tarball built for the current commit being tested.
|
|
#
|
|
# This is intended to catch bugs that result in the upgrade
|
|
# process failing.
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# Docker images are built from 'tools/ci/Dockerfile.prod'; the comments at
|
|
# the top explain how to build and upload these images.
|
|
- docker_image: zulip/ci:jammy-6.0
|
|
name: 6.0 Version Upgrade
|
|
os: jammy
|
|
- docker_image: zulip/ci:bookworm-7.0
|
|
name: 7.0 Version Upgrade
|
|
os: bookworm
|
|
- docker_image: zulip/ci:bookworm-8.0
|
|
name: 8.0 Version Upgrade
|
|
os: bookworm
|
|
- docker_image: zulip/ci:noble-9.0
|
|
name: 9.0 Version Upgrade
|
|
os: noble
|
|
- docker_image: zulip/ci:noble-10.0
|
|
name: 10.0 Version Upgrade
|
|
os: noble
|
|
- docker_image: zulip/ci:trixie-11.0
|
|
name: 11.0 Version Upgrade
|
|
os: trixie
|
|
- docker_image: zulip/ci:resolute-12.0
|
|
name: 12.0 Version Upgrade
|
|
os: resolute
|
|
|
|
name: ${{ matrix.name }}
|
|
container:
|
|
image: ${{ matrix.docker_image }}
|
|
options: --init
|
|
runs-on: ubuntu-latest
|
|
needs: production_build
|
|
|
|
steps:
|
|
- name: Download built production tarball
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: production-tarball
|
|
path: /tmp
|
|
|
|
- name: Add required permissions and setup
|
|
run: |
|
|
# This is the GitHub Actions specific cache directory the
|
|
# the current github user must be able to access for the
|
|
# cache action to work. It is owned by root currently.
|
|
sudo chmod -R 0777 /__w/_temp/
|
|
|
|
# Since actions/download-artifact@v6 loses all the permissions
|
|
# of the tarball uploaded by the upload artifact fix those.
|
|
chmod +x /tmp/production-upgrade
|
|
chmod +x /tmp/production-verify
|
|
chmod +x /tmp/generate-failure-message
|
|
|
|
- name: Create cache directories
|
|
run: |
|
|
dirs=(/srv/zulip-emoji-cache)
|
|
sudo mkdir -p "${dirs[@]}"
|
|
sudo chown -R github "${dirs[@]}"
|
|
|
|
- name: Upgrade production
|
|
run: sudo /tmp/production-upgrade
|
|
|
|
# TODO: We should be running production-verify here, but it
|
|
# doesn't pass yet.
|
|
#
|
|
# - name: Verify install
|
|
# run: sudo /tmp/production-verify
|
|
|
|
- name: Generate failure report string
|
|
id: failure_report_string
|
|
if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
|
|
run: /tmp/generate-failure-message >> $GITHUB_OUTPUT
|
|
|
|
- name: Report status to CZO
|
|
if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
|
|
uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
|
|
with:
|
|
api-key: ${{ secrets.ZULIP_BOT_KEY }}
|
|
email: "github-actions-bot@chat.zulip.org"
|
|
organization-url: "https://chat.zulip.org"
|
|
to: "automated testing"
|
|
topic: ${{ steps.failure_report_string.outputs.topic }}
|
|
type: "stream"
|
|
content: ${{ steps.failure_report_string.outputs.content }}
|
|
|
|
required-jobs:
|
|
name: "Required jobs"
|
|
if: always()
|
|
needs:
|
|
- production_build
|
|
- production_install
|
|
- production_upgrade
|
|
runs-on: ubuntu-slim
|
|
steps:
|
|
- name: "Check required jobs"
|
|
run: jq 'with_entries(.value |= .result | select(.value | IN("success", "skipped") | not)) | if . != {} then halt_error end' <<<"$NEEDS"
|
|
env:
|
|
NEEDS: ${{ toJSON(needs) }}
|