Merge pull request #5960 from kmk3/ci-split-jobs

ci: whitelist paths, reorganize workflows & speed-up tests

.github/workflows/build-extra.yml

@@ -1,52 +1,36 @@
-name: Build-extra CI
+# Builds the project with alternative tools.
+
+name: Build-extra
 
 on:
  push:
- paths-ignore:
- - '.github/ISSUE_TEMPLATE/*'
- - 'contrib/syntax/**'
- - 'contrib/vim/**'
- - 'etc/**'
- - 'src/man/*.in'
- - .git-blame-ignore-revs
- - .github/dependabot.yml
- - .github/pull_request_template.md
- - .github/workflows/build.yml
- - .github/workflows/codeql-analysis.yml
- - .github/workflows/codespell.yml
- - .github/workflows/profile-checks.yml
- - .gitignore
- - .gitlab-ci.yml
- - CONTRIBUTING.md
- - COPYING
- - README
- - README.md
- - RELNOTES
- - SECURITY.md
- - src/firecfg/firecfg.config
+ paths:
+ - 'm4/**'
+ - 'src/**.c'
+ - 'src/**.h'
+ - 'src/**.mk'
+ - 'src/**Makefile'
+ - .github/workflows/build-extra.yml
+ - Makefile
+ - ci/printenv.sh
+ - config.mk.in
+ - config.sh.in
+ - configure
+ - configure.ac
  pull_request:
- paths-ignore:
- - '.github/ISSUE_TEMPLATE/*'
- - 'contrib/syntax/**'
- - 'contrib/vim/**'
- - 'etc/**'
- - 'src/man/*.in'
- - .git-blame-ignore-revs
- - .github/dependabot.yml
- - .github/pull_request_template.md
- - .github/workflows/build.yml
- - .github/workflows/codeql-analysis.yml
- - .github/workflows/codespell.yml
- - .github/workflows/profile-checks.yml
- - .gitignore
- - .gitlab-ci.yml
- - CONTRIBUTING.md
- - COPYING
- - README
- - README.md
- - RELNOTES
- - SECURITY.md
- - src/firecfg/firecfg.config
+ paths:
+ - 'm4/**'
+ - 'src/**.c'
+ - 'src/**.h'
+ - 'src/**.mk'
+ - 'src/**Makefile'
+ - .github/workflows/build-extra.yml
+ - Makefile
+ - ci/printenv.sh
+ - config.mk.in
+ - config.sh.in
+ - configure
+ - configure.ac
 
 permissions: # added using https://github.com/step-security/secure-workflows
  contents: read
@@ -86,82 +70,3 @@ jobs:
  run: sudo make install
  - name: print version
  run: command -V firejail && firejail --version
- scan-build:
- runs-on: ubuntu-22.04
- steps:
- - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
- with:
- egress-policy: block
- allowed-endpoints: >
- archive.ubuntu.com:80
- azure.archive.ubuntu.com:80
- github.com:443
- packages.microsoft.com:443
- ppa.launchpadcontent.net:443
- security.ubuntu.com:80
- - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
- - name: update package information
- run: sudo apt-get update -qy
- - name: install clang-tools-14 and dependencies
- run: >
- sudo apt-get install -qy
- clang-tools-14 libapparmor-dev libselinux1-dev
- - name: print env
- run: ./ci/printenv.sh
- - name: configure
- run: >
- CC=clang-14 ./configure --enable-fatal-warnings --enable-apparmor
- --enable-selinux
- || (cat config.log; exit 1)
- - name: scan-build
- run: scan-build-14 --status-bugs make
- cppcheck:
- runs-on: ubuntu-22.04
- steps:
- - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
- with:
- egress-policy: block
- allowed-endpoints: >
- archive.ubuntu.com:80
- azure.archive.ubuntu.com:80
- github.com:443
- packages.microsoft.com:443
- ppa.launchpadcontent.net:443
- security.ubuntu.com:80
- - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
- - name: update package information
- run: sudo apt-get update -qy
- - name: install cppcheck
- run: sudo apt-get install -qy cppcheck
- - run: cppcheck --version
- - name: cppcheck
- run: >
- cppcheck -q --force --error-exitcode=1 --enable=warning,performance
- -i src/firejail/checkcfg.c -i src/firejail/main.c .
- # new cppcheck version currently chokes on checkcfg.c and main.c, therefore
- # scan all files also with older cppcheck version from ubuntu 20.04.
- cppcheck_old:
- runs-on: ubuntu-20.04
- steps:
- - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
- with:
- egress-policy: block
- allowed-endpoints: >
- archive.ubuntu.com:80
- azure.archive.ubuntu.com:80
- github.com:443
- packages.microsoft.com:443
- ppa.launchpad.net:80
- ppa.launchpadcontent.net:443
- security.ubuntu.com:80
- - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
- - name: update package information
- run: sudo apt-get update -qy
- - name: install cppcheck
- run: sudo apt-get install -qy cppcheck
- - run: cppcheck --version
- - name: cppcheck
- run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance .

.github/workflows/build.yml

@@ -1,68 +1,69 @@
-name: Build CI
+# Checks that `make dist` works and builds the project with the default
+# configuration.
 
+name: Build
+
+# Note: Keep this list in sync with DISTFILES in ../../Makefile.
 on:
  push:
- paths-ignore:
- - '.github/ISSUE_TEMPLATE/*'
- - .git-blame-ignore-revs
- - .github/dependabot.yml
- - .github/pull_request_template.md
- - .github/workflows/build-extra.yml
- - .github/workflows/codeql-analysis.yml
- - .github/workflows/codespell.yml
- - .github/workflows/profile-checks.yml
- - .gitignore
- - .gitlab-ci.yml
- - CONTRIBUTING.md
+ paths:
+ - 'contrib/**'
+ - 'etc/**'
+ - 'm4/**'
+ - 'platform/**'
+ - 'src/**'
+ - 'test/**'
+ - .github/workflows/build.yml
  - COPYING
+ - Makefile
  - README
- - README.md
  - RELNOTES
- - SECURITY.md
+ - ci/printenv.sh
+ - config.mk.in
+ - config.sh.in
+ - configure
+ - configure.ac
+ - install.sh
+ - mkdeb.sh
+ - mketc.sh
  pull_request:
- paths-ignore:
- - '.github/ISSUE_TEMPLATE/*'
- - .git-blame-ignore-revs
- - .github/dependabot.yml
- - .github/pull_request_template.md
- - .github/workflows/build-extra.yml
- - .github/workflows/codeql-analysis.yml
- - .github/workflows/codespell.yml
- - .github/workflows/profile-checks.yml
- - .gitignore
- - .gitlab-ci.yml
- - CONTRIBUTING.md
+ paths:
+ - 'contrib/**'
+ - 'etc/**'
+ - 'm4/**'
+ - 'platform/**'
+ - 'src/**'
+ - 'test/**'
+ - .github/workflows/build.yml
  - COPYING
+ - Makefile
  - README
- - README.md
  - RELNOTES
- - SECURITY.md
+ - ci/printenv.sh
+ - config.mk.in
+ - config.sh.in
+ - configure
+ - configure.ac
+ - install.sh
+ - mkdeb.sh
+ - mketc.sh
 
 permissions: # added using https://github.com/step-security/secure-workflows
  contents: read
 
 jobs:
- build_and_test:
+ build:
  runs-on: ubuntu-22.04
- env:
- SHELL: /bin/bash
  steps:
  - name: Harden Runner
  uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
  with:
  egress-policy: block
  allowed-endpoints: >
- 1.1.1.1:1025
  azure.archive.ubuntu.com:80
- debian.org:80
- dns.quad9.net:53
  github.com:443
  packages.microsoft.com:443
  ppa.launchpadcontent.net:443
- whois.pir.org:43
- www.debian.org:443
- www.debian.org:80
- yahoo.com:1025
  - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
  - name: update package information
  run: sudo apt-get update -qy
@@ -84,19 +85,3 @@ jobs:
  run: sudo make install
  - name: print firejail version
  run: command -V firejail && firejail --version
- - run: make lab-setup
- - run: make test-seccomp-extra
- - run: make test-firecfg
- - run: make test-capabilities
- - run: make test-apparmor
- - run: make test-appimage
- - run: make test-chroot
- - run: make test-sysutils
- - run: make test-private-etc
- - run: make test-profiles
- - run: make test-fcopy
- - run: make test-fnetfilter
- - run: make test-fs
- - run: make test-utils
- - run: make test-environment
- - run: make test-network