espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-30 15:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[github-actions] apply step-security updates (#8509)

Browse Source
This commit is contained in:
Jonathan Hui
2022-12-10 16:12:12 -08:00
committed by GitHub
parent 768072a6e0
commit 98e644d538
14 changed files with 448 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+80 -15
View File
@@ -45,7 +45,12 @@ jobs:
pretty:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -61,8 +66,13 @@ jobs:
markdown-lint-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: gaurav-nelson/github-action-markdown-link-check@v1
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
with:
use-verbose-mode: 'yes'
max-depth: 3
@@ -70,7 +80,12 @@ jobs:
cmake-version:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -100,7 +115,12 @@ jobs:
CC: ${{ matrix.compiler_c }}
CXX: ${{ matrix.compiler_cpp }}
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -114,7 +134,12 @@ jobs:
scan-build:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -128,14 +153,19 @@ jobs:
mbedtls3-build:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev
rm -rf third_party/mbedtls/repo
- uses: actions/checkout@v3
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
repository: ARMmbed/mbedtls
ref: v3.2.1
@@ -167,7 +197,12 @@ jobs:
gcc_download_url: https://developer.arm.com/-/media/Files/downloads/gnu-rm/9-2019q4/RC2.1/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2
gcc_extract_dir: gcc-arm-none-eabi-9-2019-q4-major
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -199,7 +234,12 @@ jobs:
CC: gcc-${{ matrix.gcc_ver }}
CXX: g++-${{ matrix.gcc_ver }}
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -227,7 +267,12 @@ jobs:
CC: clang-${{ matrix.clang_ver }}
CXX: clang++-${{ matrix.clang_ver }}
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -260,7 +305,12 @@ jobs:
CXXFLAGS: -m32 -Wconversion
LDFLAGS: -m32
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -283,7 +333,12 @@ jobs:
gn:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -314,7 +369,12 @@ jobs:
CC: ${{ matrix.CC }}
CXX: ${{ matrix.CXX }}
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -332,7 +392,12 @@ jobs:
android:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Build
.github/workflows/codeql.yml
+11 -3
View File
@@ -34,6 +34,9 @@ on:
pull_request:
branches: [ "main" ]
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
analyze:
name: Analyze
@@ -50,15 +53,20 @@ jobs:
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
steps:
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- name: Checkout repository
uses: actions/checkout@v3
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
uses: github/codeql-action/init@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2.1.36
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -72,6 +80,6 @@ jobs:
./script/test build
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
uses: github/codeql-action/analyze@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2.1.36
with:
category: "/language:${{matrix.language}}"
.github/workflows/docker.yml
+11 -3
View File
@@ -40,6 +40,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
cancel-in-progress: true
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
buildx:
@@ -51,7 +54,12 @@ jobs:
include:
- docker_name: environment
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
@@ -75,7 +83,7 @@ jobs:
${TAGS} --file ${DOCKER_FILE} .
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
- name: Docker Buildx (build)
run: |
@@ -83,7 +91,7 @@ jobs:
- name: Login to DockerHub
if: success() && github.repository == 'openthread/openthread' && github.event_name != 'pull_request'
uses: docker/login-action@v2
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
.github/workflows/fuzz.yml
+11 -3
View File
@@ -37,23 +37,31 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
cancel-in-progress: true
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
Fuzzing:
runs-on: ubuntu-20.04
steps:
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- name: Build Fuzzers
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@c0e4bb8d15a68b7f8cc731ea75523e48a2301bcf # master
with:
oss-fuzz-project-name: 'openthread'
dry-run: false
- name: Run Fuzzers
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@c0e4bb8d15a68b7f8cc731ea75523e48a2301bcf # master
with:
oss-fuzz-project-name: 'openthread'
fuzz-seconds: 1800
dry-run: false
- name: Upload Crash
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: failure()
with:
name: artifacts
.github/workflows/makefile-check.yml
+9 -1
View File
@@ -40,11 +40,19 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
cancel-in-progress: true
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
makefile-check:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Check
.github/workflows/otbr.yml
+32 -12
View File
@@ -59,7 +59,12 @@ jobs:
# of OMR prefix and Domain prefix is not deterministic.
BORDER_ROUTING: 0
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Build OTBR Docker
@@ -83,11 +88,11 @@ jobs:
export CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS -e COVERAGE"
echo "CI_ENV=${CI_ENV}"
sudo -E ./script/test cert_suite ./tests/scripts/thread-cert/backbone/*.py || (sudo chmod a+r *.log *.json *.pcap && false)
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-thread-1-3-backbone-docker
path: /tmp/coverage/
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: thread-1-3-backbone-results
@@ -100,7 +105,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-thread-1-3-backbone
path: tmp/coverage.info
@@ -169,7 +174,12 @@ jobs:
NAT64: ${{ matrix.nat64 }}
MAX_JOBS: 3
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Build OTBR Docker
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -192,11 +202,11 @@ jobs:
export CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS -e COVERAGE"
echo "CI_ENV=${CI_ENV}"
sudo -E ./script/test cert_suite ${{ matrix.cert_scripts }} || (sudo chmod a+r *.log *.json *.pcap && false)
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-thread-border-router-docker
path: /tmp/coverage/
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: thread-border-router-results
@@ -209,7 +219,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-thread-border-router
path: tmp/coverage.info
@@ -220,13 +230,18 @@ jobs:
- thread-border-router
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
with:
path: coverage/
- name: Combine Coverage
@@ -235,7 +250,7 @@ jobs:
script/test combine_coverage
- name: Upload Coverage
continue-on-error: true
uses: codecov/codecov-action@v3
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
with:
files: final.info
fail_ci_if_error: true
@@ -244,7 +259,12 @@ jobs:
needs: upload-coverage
runs-on: ubuntu-20.04
steps:
- uses: geekyeggo/delete-artifact@v2
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0
with:
name: cov-*
useGlob: true
.github/workflows/otci.yml
+9 -1
View File
@@ -40,6 +40,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
cancel-in-progress: true
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
cli-sim:
@@ -54,7 +57,12 @@ jobs:
VIRTUAL_TIME: ${{ matrix.virtual_time }}
REAL_DEVICE: 0
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
run: |
sudo rm /etc/apt/sources.list.d/* && sudo apt-get update
.github/workflows/otns.yml
+35 -17
View File
@@ -48,18 +48,26 @@ env:
MAX_NETWORK_SIZE: 999
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
unittests:
name: Unittests
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3.4.0
with:
go-version: '1.14'
- name: Set up Python 3.6
uses: actions/setup-python@v4
uses: actions/setup-python@2c3dd9e7e29afd70cc0950079bde6c979d1f69f9 # v4.3.1
with:
python-version: 3.6
- name: Bootstrap
@@ -75,7 +83,7 @@ jobs:
cd /tmp/otns
./script/test py-unittests
)
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: unittests-pcaps
@@ -85,7 +93,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-otns-unittests
path: tmp/coverage.info
@@ -94,12 +102,12 @@ jobs:
name: Examples
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3.4.0
with:
go-version: '1.14'
- name: Set up Python 3.6
uses: actions/setup-python@v4
uses: actions/setup-python@2c3dd9e7e29afd70cc0950079bde6c979d1f69f9 # v4.3.1
with:
python-version: 3.6
- name: Bootstrap
@@ -115,7 +123,7 @@ jobs:
cd /tmp/otns
./script/test py-examples
)
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: examples-pcaps
@@ -125,7 +133,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-otns-examples
path: tmp/coverage.info
@@ -152,12 +160,17 @@ jobs:
env:
STRESS_LEVEL: ${{ matrix.stress_level }}
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3.4.0
with:
go-version: '1.14'
- name: Set up Python 3.6
uses: actions/setup-python@v4
uses: actions/setup-python@2c3dd9e7e29afd70cc0950079bde6c979d1f69f9 # v4.3.1
with:
python-version: 3.6
- name: Bootstrap
@@ -173,7 +186,7 @@ jobs:
cd /tmp/otns
./script/test stress-tests ${{ matrix.suite }}
)
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: stress-tests-${{ matrix.suite }}-pcaps
@@ -183,7 +196,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-otns-stress-tests-${{ matrix.suite }}
path: tmp/coverage.info
@@ -195,11 +208,16 @@ jobs:
- stress-tests
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
with:
path: coverage/
- name: Upload Coverage
.github/workflows/posix.yml
+66 -21
View File
@@ -48,7 +48,12 @@ jobs:
CFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15
CXXFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y expect ninja-build lcov socat
@@ -63,7 +68,7 @@ jobs:
CRASHED=$(./script/test check_crash | tail -1)
[[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
echo "CRASHED_RCP=$CRASHED" >> $GITHUB_ENV
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() && env.CRASHED_RCP == '1' }}
with:
name: core-expect-rcp
@@ -72,7 +77,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-expects-linux-1
path: tmp/coverage.info
@@ -94,13 +99,13 @@ jobs:
CRASHED=$(./script/test check_crash | tail -1)
[[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
echo "CRASHED_TUN=$CRASHED" >> $GITHUB_ENV
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() && env.CRASHED_TUN == '1' }}
with:
name: core-expect-linux
path: |
./ot-core-dump/*
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: syslog-expect-linux
@@ -108,7 +113,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-expects-linux-2
path: tmp/coverage.info
@@ -116,7 +121,12 @@ jobs:
tcplp-buffering:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Build
@@ -135,7 +145,12 @@ jobs:
VIRTUAL_TIME: 1
VIRTUAL_TIME_UART: 1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -151,7 +166,7 @@ jobs:
- name: Run
run: |
VERBOSE=1 OT_CLI_PATH="$PWD/output/posix/bin/ot-cli -v" RADIO_DEVICE="$PWD/output/simulation/bin/ot-rcp" make -f src/posix/Makefile-posix check
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: thread-cert
@@ -159,7 +174,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-thread-cert
path: tmp/coverage.info
@@ -169,7 +184,12 @@ jobs:
env:
COVERAGE: 1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -186,7 +206,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-ncp-rcp-migrate
path: tmp/coverage.info
@@ -203,7 +223,12 @@ jobs:
OT_DAEMON: ${{ matrix.OT_DAEMON }}
OT_READLINE: 'readline'
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
run: |
sudo rm /etc/apt/sources.list.d/* && sudo apt-get update
@@ -231,7 +256,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-pty-linux-${{ matrix.DAEMON }}
path: tmp/coverage.info
@@ -247,7 +272,12 @@ jobs:
OT_DAEMON: ${{ matrix.OT_DAEMON }}
OT_READLINE: 'off'
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
run: |
rm -f '/usr/local/bin/2to3'
@@ -263,7 +293,12 @@ jobs:
rcp-stack-reset:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -279,7 +314,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-rcp-stack-reset
path: tmp/coverage.info
@@ -292,20 +327,25 @@ jobs:
- thread-cert
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
with:
path: coverage/
- name: Combine Coverage
run: |
script/test combine_coverage
- name: Upload Coverage
uses: codecov/codecov-action@v3
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
with:
files: final.info
fail_ci_if_error: true
@@ -314,7 +354,12 @@ jobs:
needs: upload-coverage
runs-on: ubuntu-20.04
steps:
- uses: geekyeggo/delete-artifact@v2
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0
with:
name: cov-*
useGlob: true
.github/workflows/simulation-1.1.yml
+75 -25
View File
@@ -51,7 +51,12 @@ jobs:
THREAD_VERSION: 1.1
VIRTUAL_TIME: 1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -77,7 +82,12 @@ jobs:
VIRTUAL_TIME: 1
MULTIPLY: 3
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -94,7 +104,7 @@ jobs:
- name: Run
run: |
./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: packet-verification-pcaps
@@ -104,7 +114,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-packet-verification
path: tmp/coverage.info
@@ -120,7 +130,12 @@ jobs:
THREAD_VERSION: 1.1
VIRTUAL_TIME: 1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -135,7 +150,7 @@ jobs:
- name: Run
run: |
VERBOSE=1 make -f examples/Makefile-simulation check
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: cli-ftd-thread-cert
@@ -143,7 +158,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-cli-ftd
path: tmp/coverage.info
@@ -166,7 +181,12 @@ jobs:
VIRTUAL_TIME: 1
MESSAGE_USE_HEAP: ${{ matrix.message_use_heap }}
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -181,7 +201,7 @@ jobs:
- name: Run
run: |
VERBOSE=1 make -f examples/Makefile-simulation check
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: cli-mtd-thread-cert
@@ -189,7 +209,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-cli-mtd-${{ matrix.message_use_heap }}
path: tmp/coverage.info
@@ -206,7 +226,12 @@ jobs:
TIME_SYNC: 1
VIRTUAL_TIME: 1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -221,7 +246,7 @@ jobs:
- name: Run
run: |
VERBOSE=1 make -f examples/Makefile-simulation check
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: cli-time-sync-thread-cert
@@ -229,7 +254,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-cli-time-sync
path: tmp/coverage.info
@@ -241,7 +266,12 @@ jobs:
CXXFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15
THREAD_VERSION: 1.1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y expect ninja-build lcov socat
@@ -256,7 +286,7 @@ jobs:
CRASHED=$(./script/test check_crash | tail -1)
[[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
echo "CRASHED_CLI=$CRASHED" >> $GITHUB_ENV
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() && env.CRASHED_CLI == '1' }}
with:
name: core-expect-cli
@@ -265,7 +295,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-expects
path: tmp/coverage.info
@@ -275,7 +305,12 @@ jobs:
env:
THREAD_VERSION: 1.1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -308,7 +343,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-ot-commissioner
path: tmp/coverage.info
@@ -323,7 +358,12 @@ jobs:
VIRTUAL_TIME: 1
CXXFLAGS: "-DOPENTHREAD_CONFIG_LOG_PREPEND_UPTIME=0"
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -337,7 +377,7 @@ jobs:
- name: Run
run: |
VERBOSE=1 make -f examples/Makefile-simulation check
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: multiple-instance-thread-cert
@@ -345,7 +385,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-multiple-instance
path: tmp/coverage.info
@@ -361,20 +401,25 @@ jobs:
- multiple-instance
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
with:
path: coverage/
- name: Combine Coverage
run: |
script/test combine_coverage
- name: Upload Coverage
uses: codecov/codecov-action@v3
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
with:
files: final.info
fail_ci_if_error: true
@@ -383,7 +428,12 @@ jobs:
needs: upload-coverage
runs-on: ubuntu-20.04
steps:
- uses: geekyeggo/delete-artifact@v2
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0
with:
name: cov-*
useGlob: true
.github/workflows/simulation-1.2.yml
+60 -22
View File
@@ -40,6 +40,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
cancel-in-progress: true
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
thread-1-3:
@@ -61,7 +64,12 @@ jobs:
compiler: [{c: "gcc", cxx: "g++", gcov: "gcc"}, { c: "clang-10", cxx: "clang++-10", gcov: "llvm"}]
arch: ["m32", "m64"]
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -86,12 +94,12 @@ jobs:
CRASHED=$(./script/test check_crash | tail -1)
[[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
echo "CRASHED=$CRASHED" >> $GITHUB_ENV
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: thread-1-3-${{ matrix.compiler.c }}-${{ matrix.arch }}-pcaps
path: "*.pcap"
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() && env.CRASHED == '1' }}
with:
name: core-packet-verification-thread-1-3
@@ -100,7 +108,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage "${{ matrix.compiler.gcov }}"
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-thread-1-3-${{ matrix.compiler.c }}-${{ matrix.arch }}
path: tmp/coverage.info
@@ -117,7 +125,12 @@ jobs:
INTER_OP: 1
INTER_OP_BBR: 0
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -145,14 +158,14 @@ jobs:
CRASHED=$(./script/test check_crash | tail -1)
[[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
echo "CRASHED=$CRASHED" >> $GITHUB_ENV
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: packet-verification-low-power-pcaps
path: |
*.pcap
*.json
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() && env.CRASHED == '1' }}
with:
name: core-packet-verification-low-power
@@ -161,7 +174,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-packet-verification-low-power
path: tmp/coverage.info
@@ -175,7 +188,12 @@ jobs:
THREAD_VERSION: 1.3
MULTIPLY: 3
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -192,7 +210,7 @@ jobs:
- name: Run
run: |
./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: packet-verification-1.1-on-1.3-pcaps
@@ -202,7 +220,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-packet-verification-1-1-on-1-3
path: tmp/coverage.info
@@ -214,7 +232,12 @@ jobs:
THREAD_VERSION: 1.3
VIRTUAL_TIME: 0
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -231,7 +254,7 @@ jobs:
CRASHED=$(./script/test check_crash | tail -1)
[[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
echo "CRASHED=$CRASHED" >> $GITHUB_ENV
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() && env.CRASHED == '1' }}
with:
name: core-expect-1-3
@@ -240,7 +263,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-expects
path: tmp/coverage.info
@@ -257,7 +280,12 @@ jobs:
VIRTUAL_TIME: 1
INTER_OP: 1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -284,12 +312,12 @@ jobs:
CRASHED=$(./script/test check_crash | tail -1)
[[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
echo "CRASHED=$CRASHED" >> $GITHUB_ENV
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() }}
with:
name: thread-1-3-posix-pcaps
path: "*.pcap"
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: ${{ failure() && env.CRASHED == '1' }}
with:
name: core-thread-1-3-posix
@@ -298,7 +326,7 @@ jobs:
- name: Generate Coverage
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
with:
name: cov-thread-1-3-posix
path: tmp/coverage.info
@@ -312,20 +340,25 @@ jobs:
- thread-1-3-posix
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
with:
path: coverage/
- name: Combine Coverage
run: |
script/test combine_coverage
- name: Upload Coverage
uses: codecov/codecov-action@v3
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
with:
files: final.info
fail_ci_if_error: true
@@ -334,7 +367,12 @@ jobs:
needs: upload-coverage
runs-on: ubuntu-20.04
steps:
- uses: geekyeggo/delete-artifact@v2
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0
with:
name: cov-*
useGlob: true
.github/workflows/size.yml
+6 -1
View File
@@ -45,7 +45,12 @@ jobs:
size-report:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
- name: Bootstrap
if: "github.event_name == 'push'"
run: |
.github/workflows/toranj.yml
+34 -9
View File
@@ -53,7 +53,12 @@ jobs:
COVERAGE: 1
TORANJ_RADIO : ${{ matrix.TORANJ_RADIO }}
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -85,7 +90,7 @@ jobs:
if: "matrix.TORANJ_RADIO != 'multi'"
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: "matrix.TORANJ_RADIO != 'multi'"
with:
name: cov-toranj-ncp-${{ matrix.TORANJ_RADIO }}
@@ -102,7 +107,12 @@ jobs:
TORANJ_RADIO : ${{ matrix.TORANJ_RADIO }}
TORANJ_CLI: 1
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -119,7 +129,7 @@ jobs:
if: "matrix.TORANJ_RADIO != 'multi'"
run: |
./script/test generate_coverage gcc
- uses: actions/upload-artifact@v3
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
if: "matrix.TORANJ_RADIO != 'multi'"
with:
name: cov-toranj-cli-${{ matrix.TORANJ_RADIO }}
@@ -129,7 +139,12 @@ jobs:
name: toranj-unittest
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
@@ -152,20 +167,25 @@ jobs:
- toranj-cli
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
with:
path: coverage/
- name: Combine Coverage
run: |
script/test combine_coverage
- name: Upload Coverage
uses: codecov/codecov-action@v3
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
with:
files: final.info
fail_ci_if_error: true
@@ -174,7 +194,12 @@ jobs:
needs: upload-coverage
runs-on: ubuntu-20.04
steps:
- uses: geekyeggo/delete-artifact@v2
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0
with:
name: cov-*
useGlob: true
.github/workflows/version.yml
+9 -1
View File
@@ -37,11 +37,19 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
cancel-in-progress: true
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
api-version:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v3
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
submodules: true
- name: Check