-
Notifications
You must be signed in to change notification settings - Fork 146
213 lines (213 loc) · 7.45 KB
/
build.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
name: "Build and test Drakvuf Sandbox"
on:
push:
branches:
- master
pull_request:
branches:
- master
jobs:
build_docs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up Python 3.8
uses: actions/setup-python@v4
with:
python-version: 3.8
- name: Install dependencies
working-directory: docs
run: pip install -r requirements.txt
- name: Build docs
working-directory: docs
run: make html
lint_drakrun_frontend:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Install web dependencies
working-directory: drakrun/drakrun/web/frontend
run: npm ci
- name: Check with prettier
working-directory: drakrun/drakrun/web/frontend
run: npx prettier --check src/
lint_drakrun:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: CERT-Polska/lint-python-action@v2
with:
python-version: 3.8
working-directory: drakrun
package_drakvuf_bundle:
strategy:
fail-fast: false
matrix:
include:
- distro: debian
version: bullseye
runs-on: ubuntu-latest
container: "${{ matrix.distro }}:${{matrix.version}}"
steps:
- name: Install git and wget
run: |
export DEBIAN_FRONTEND=noninteractive
apt-get update && apt-get install -y -q git wget
- uses: actions/checkout@v3
with:
submodules: recursive
- name: Get Drakvuf commit id
run: |
# Workaround for fatal: detected dubious ownership
# https://git-scm.com/docs/git-config/2.35.2#Documentation/git-config.txt-safedirectory
git config --global --add safe.directory "$(pwd)"
export DRAKVUF_COMMIT=$(git ls-tree HEAD drakvuf | awk '{ print $3 }')
echo "Drakvuf commit is ${DRAKVUF_COMMIT}"
echo "DRAKVUF_COMMIT=$DRAKVUF_COMMIT" >> $GITHUB_ENV
- name: Restored cached Drakvuf bundle
id: cache-drakvuf-bundle-restore
uses: actions/cache/restore@v3
with:
path: |
/out/drakvuf-bundle*.deb
/build/usr/lib/libvmi*
/build/usr/include/libvmi/*
key: drakvuf-bundle-${{ env.DRAKVUF_COMMIT }}-${{ matrix.distro }}-${{ matrix.version }}
- if: ${{ steps.cache-drakvuf-bundle-restore.outputs.cache-hit != 'true' }}
name: Build Drakvuf bundle
run: |
cp -ra . /build
cd /build
sh drakvuf/package/depends.sh
bash ci/build_bundle.sh "${{ matrix.distro }}:${{matrix.version}}"
ls -r /out
- if: ${{ steps.cache-drakvuf-bundle-restore.outputs.cache-hit != 'true' }}
name: Save Drakvuf bundle cache
id: cache-drakvuf-bundle-save
uses: actions/cache/save@v3
with:
path: |
/out/drakvuf-bundle*.deb
/build/usr/lib/libvmi*
/build/usr/include/libvmi/*
key: drakvuf-bundle-${{ env.DRAKVUF_COMMIT }}-${{ matrix.distro }}-${{ matrix.version }}
- name: Build draksetup tools
run: |
apt install -y make pkg-config gcc libglib2.0-dev libjson-c-dev
cp -v /build/usr/lib/libvmi* /usr/lib/
mkdir /usr/include/libvmi
cp -v /build/usr/include/libvmi/* /usr/include/libvmi/
make -C ./drakrun/drakrun/tools
- uses: actions/upload-artifact@v4
with:
name: drakvuf-bundle-debs-${{ matrix.distro }}-${{ matrix.version }}
path: |
/out/drakvuf-bundle*.deb
- uses: actions/upload-artifact@v4
with:
name: draksetup-tools-${{ matrix.distro }}-${{ matrix.version }}
path: |
drakrun/drakrun/tools/*
package_drakrun:
needs: [ package_drakvuf_bundle ]
runs-on: ubuntu-latest
container: "python:3.8"
steps:
- uses: actions/checkout@v3
with:
submodules: recursive
- name: Use Node.js 16.x
uses: actions/setup-node@v4
with:
node-version: '16'
- name: Download draksetup compiled tools from artifacts
uses: actions/download-artifact@v4
with:
name: draksetup-tools-debian-bullseye
path: drakrun/drakrun/tools
- name: Build drakrun
run: |
chmod +x drakrun/drakrun/tools/* # gh artifacts don't keep file permissions
cd drakrun
make DIST=1
- uses: actions/upload-artifact@v4
with:
name: drakvuf-sandbox-whl
path: ./drakrun/dist/drakvuf_sandbox-*.whl
test_e2e:
needs: [ package_drakrun, package_drakvuf_bundle ]
strategy:
fail-fast: false
matrix:
include:
- distro: debian
version: bullseye
version_number: 11
runs-on: self-hosted
container: python:3.8-bullseye
# Prevent concurrent jobs trying to reach the same VM
concurrency: ci-${{ github.ref }}-${{ matrix.distro }}-${{ matrix.version_number }}
steps:
- uses: actions/checkout@v3
with:
submodules: recursive
- name: Download drakrun debs from artifacts
uses: actions/download-artifact@v4
with:
name: drakvuf-sandbox-whl
path: /debs
- name: Download drakvuf-bundle debs from artifacts
uses: actions/download-artifact@v4
with:
name: drakvuf-bundle-debs-${{ matrix.distro }}-${{ matrix.version }}
path: /debs
- name: Install git
run: |
export DEBIAN_FRONTEND=noninteractive
apt-get update && apt-get install -y -q git
- name: Restore cached MinIO server
id: cache-minio-server-restore
uses: actions/cache/restore@v3
with:
path: |
/tmp/minio
key: minio-server-bin
- if: ${{ steps.cache-minio-server-restore.outputs.cache-hit != 'true' }}
name: Download MinIO server
run: |
wget https://dl.min.io/server/minio/release/linux-amd64/minio -O /tmp/minio
- if: ${{ steps.cache-minio-server-restore.outputs.cache-hit != 'true' }}
name: Save cached MinIO server
id: cache-minio-server-save
uses: actions/cache/save@v3
with:
path: |
/tmp/minio
key: minio-server-bin
- name: Start tests
run: |
git config --global --add safe.directory "$(pwd)"
cd test
pip install -r requirements.txt
pytest -v --capture=no
python3 -m vm_runner_client destroy
env:
DRAKVUF_DEBS_PATH: "/debs"
BASE_IMAGE: "${{ matrix.distro }}-${{ matrix.version_number }}-generic-amd64"
SNAPSHOT_VERSION: "win7-20210922"
MINIO_HOST: "192.168.100.1:8181"
MINIO_SERVER_BIN_PATH: "/tmp/minio"
VM_RUNNER_API_URL: "http://127.0.0.1:8080"
VM_SUFFIX: "${{ matrix.distro }}-${{ matrix.version_number }}"
# It's local Minio readonly account accessible from local runner
# I don't really know how to make unauthenticated access so let's
# keep that dummy account
MINIO_ACCESS_KEY: "drakvuf-ci-user"
MINIO_SECRET_KEY: "Ectrj8GnJbfZu4J"
- name: Job failed - suspending VM (if possible)
if: ${{ failure() }}
run: |
python3 -m vm_runner_client suspend
env:
VM_RUNNER_API_URL: "http://127.0.0.1:8080"
VM_SUFFIX: "${{ matrix.distro }}-${{ matrix.version_number }}"