misc-dailies.yml

name: "Various daily checks"

on:
  schedule:
    - cron: '34 4 * * *'

permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
  contents: read

env:
  CLANG_VERSION: '12'

jobs:
  el7-devtoolset:
    if: ${{ vars.SCHEDULED_MISC_DAILIES }}
    runs-on: ubuntu-22.04

    steps:
    - name: Check whether a newer devtoolset exists
      run: |
        if docker run --rm centos:7 bash -c 'yum install -y centos-release-scl-rh && yum info devtoolset-12-gcc-c++'
        then
          echo "::warning file=builder-support/dockerfiles/Dockerfile.rpmbuild::A newer devtoolset exists. Please edit builder-support/dockerfiles/Dockerfile.rpmbuild, builder-support/dockerfiles/Dockerfile.rpmbuild, and .github/workflows/dailies.yml"
          exit 1
        else
          echo "::notice ::No newer devtoolset exists (good)"
          exit 0
        fi

  check-debian-autoremovals:
    if: ${{ vars.SCHEDULED_MISC_DAILIES }}
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 5
        submodules: recursive

    - name: Check if Debian is about to toss us off a balcony
      run: ./build-scripts/check-debian-autoremovals.py

  coverity-auth:
    name: coverity scan of the auth
    if: ${{ vars.SCHEDULED_MISC_DAILIES }}
    uses: PowerDNS/pdns/.github/workflows/coverity.yml@master
    with:
      product: 'authoritative'
    secrets:
      COVERITY_TOKEN: ${{ secrets.coverity_auth_token }}
      COVERITY_EMAIL: ${{ secrets.coverity_email }}

  coverity-dnsdist:
    name: coverity scan of dnsdist
    if: ${{ vars.SCHEDULED_MISC_DAILIES }}
    uses: PowerDNS/pdns/.github/workflows/coverity.yml@master
    with:
      product: 'dnsdist'
    secrets:
      COVERITY_TOKEN: ${{ secrets.coverity_dnsdist_token }}
      COVERITY_EMAIL: ${{ secrets.coverity_email }}

  coverity-rec:
    name: coverity scan of the rec
    if: ${{ vars.SCHEDULED_MISC_DAILIES }}
    uses: PowerDNS/pdns/.github/workflows/coverity.yml@master
    with:
      product: 'recursor'
    secrets:
      COVERITY_TOKEN: ${{ secrets.coverity_rec_token }}
      COVERITY_EMAIL: ${{ secrets.coverity_email }}

  # The jobs below check that only the pinned version of Python3 packages are installed with pip. Running in a container, a
  # pip proxy registers all requests for installing packages with pip.  Then, the downloaded packages and their versions are compared
  # with the list used for the installation (i.e. docs/requirements.txt, pdns/recursordist/docs/requirements.txt, etc). If a package
  # is missing or a version does not match the one expected, this job fails, which makes the workflow fail.
  #
  # The pinned version plus hashes are generated using pip-compile using an input file that includes the original list of packages
  # (pip-compile --generate-hashes -U requirements.in). "pip-compile" can be installed via pip-tools with Python 3.11, which is the version
  # used in the CI. Any other Python version would end up with different versions for packages and could result in workflow failures.
  #
  # One recurring error thrown by this validation is when a new version of a pinned package is released for a "setup-requires" dependency
  # of one of the packages in the list (see https://github.com/PowerDNS/pdns/pull/14596). The package version in “requirements.in” should
  # be modified to solve this issue. In some cases, it is enough to generate again the list of packages, making sure to add the -U flag
  # to force the upgrade: "pip-compile --generate-hashes -U requirements.in" (this could include upgrading other packages).

  list-pip-requirement-files:
    if: ${{ vars.SCHEDULED_MISC_DAILIES }}
    runs-on: ubuntu-22.04
    outputs:
      req-files: ${{ steps.get-list-requirements.outputs.files }}
    steps:
    - uses: actions/checkout@v4
    - name: Get all requirements.txt files and export them as outputs
      id: get-list-requirements
      run: |
        echo "files=$(find . -name 'requirements.txt' | jq -R -s -c 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT"

  validate-pip-hashes:
    if: ${{ vars.SCHEDULED_MISC_DAILIES }}
    name: ${{ matrix.requirements-file }} - Validate list of packages and hashes
    runs-on: ubuntu-22.04
    needs: list-pip-requirement-files
    env:
      SERVICE_IP_ADDR: 127.0.0.1
    services:
      database:
        image: epicwink/proxpi
        ports:
          - 5000:5000
        options: >-
          --restart always
    strategy:
      fail-fast: false
      matrix:
        requirements-file: ${{ fromJson(needs.list-pip-requirement-files.outputs.req-files) }}
    steps:
      - run: echo "${{ matrix.requirements-file }}"
      - uses: PowerDNS/pdns/set-ubuntu-mirror@meta
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      # Configure pip index-url set to proxpi
      - run: pip config set global.index-url http://${{ env.SERVICE_IP_ADDR }}:5000/index/
      - run: pip config set global.trusted-host ${{ env.SERVICE_IP_ADDR }}
      - id: proxpi-docker
        run: echo "id=$(docker ps | grep "epicwink/proxpi" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
      - run: pip install -r ${{ matrix.requirements-file }}
      - name: Get the list of packages requested to the pip proxy
        run: |
          docker logs ${{ steps.proxpi-docker.outputs.id }} 2>&1 | grep whl | awk '{print $8}' | cut -d "/" -f 4 | awk -F'-' '{print $1"=="$2}' | sort -u --ignore-case | sed 's/_/-/' | egrep -v "pip==|setuptools==|wheel==|setuptools-git==" > /tmp/proxpi.log
          cat /tmp/proxpi.log
      - name: check only listed packages were installed
        run: for i in `cat /tmp/proxpi.log`; do grep -qq -i $i ${{ matrix.requirements-file }} || ( echo "$i not found" && exit 1 ); done