bare.yaml

#
# GitHub actions for building and testing on bare hardware.
# Typically, Windows and macOS builds are done this way.
# Look for the Linux builds in the "docker" workflow.

name: Bare

on:
  push:
    branches: [ master ]
  pull_request:

concurrency:
  group: bare-${{ github.ref }}
  cancel-in-progress: true

# Set to 'yes' to open a tunnel to GitHub's VMs through ngrok/tmate on failures.
# Also increase timeout-minutes for the relevant OS when debugging remotely.
# Version 3 of mxschmitt/action-tmate should also work on Windows.
env:
  TMATE_DEBUG: 'no'
  NGROK_DEBUG: 'no'


jobs:
  windows:
    # The type of runner that the job will run on
    runs-on: windows-latest
    timeout-minutes: 15

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Checks-out the repository under $GITHUB_WORKSPACE, so the job can access it
    - uses: actions/checkout@v2
      with:
        fetch-depth: 2

    # Explicitly run our scripts with Bash, not PowerShell (GitHub's default).
    - name: Build Pythia
      run: bash ./build.sh build

    - name: Test Pythia
      run: bash ./build.sh test

    # To use an RSA key with SFTPPlus, install upstream OpenSSH package,
    # which is more finicky in regards to file permissions.
    # Beware the commands in this step run under PowerShell.
    - name: Prepare SFTP upload
      run: |
        mkdir -p ~/.ssh/
        touch priv_key
        icacls .\priv_key /inheritance:r
        icacls .\priv_key /grant:r runneradmin:"(F)"
        echo "${{ secrets.SFTPPLUS_BIN_PRIV_KEY }}" > priv_key
        echo "${{ secrets.SFTPPLUS_BIN_HOST_KEY }}" > ~/.ssh/known_hosts
        choco install --yes --no-progress openssh

    # Upload using a (per-OS selected) sftp command, then show final links.
    # Remove key in same step to avoid leaving it on disk if publishing fails.
    - name: Upload testing package
      run: bash -c './publish_dist.sh ; rm priv_key'

    # Command line debugging through Tmate. v3 works on Windows too.
    - name: Tmate debug on failure
      if: failure() && env.TMATE_DEBUG == 'yes'
      uses: chevah/action-tmate@v3
      with:
        limit-access-to-actor: true

    # To access the Windows desktop for advanced debugging, as per
    # https://github.com/nelsonjchen/reverse-rdp-windows-github-actions,
    # but using the ngrok token as password for the runnneradmin user.
    # Basically use the ngrok token and the ngrok URL (from ngrok's dashboard).
    - name: Ngrok debugging on failure
      if: failure() && env.NGROK_DEBUG == 'yes'
      env:
        NGROK_TOKEN: ${{ secrets.NGROK_AUTH_TOKEN }}
      run: |
        choco install --yes --no-progress ngrok
        ngrok.exe authtoken $env:NGROK_TOKEN
        Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0
        Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
        Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1
        Set-LocalUser -Name "runneradmin" -Password (ConvertTo-SecureString -AsPlainText "$env:NGROK_TOKEN" -Force)
        ngrok.exe tcp 3389


  macos:
    runs-on: macos-latest
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 2

    # Some Homebrew libs pollute the build.
    # Also make sure binaries depending on these libs are out of the way.
    - name: Hack Homebrew
      run: |
        sudo mv -v /usr/local/bin/git{,.saved}
        sudo chmod -v a-r /usr/local/include/libintl.h
        sudo chmod -v a-r /usr/local/opt/gettext/lib/libintl.*

    - name: Build Pythia
      run: ./build.sh build

    # Fix back Homebrew, for working Shellcheck tests and tmate debugging.
    - name: Unhack Homebrew
      run: |
        sudo chmod -v a+r /usr/local/opt/gettext/lib/libintl*
        sudo chmod -v a+r /usr/local/include/libintl.h
        sudo mv -v /usr/local/bin/git{.saved,}

    - name: Test Pythia
      run: ./build.sh test

    - name: Upload testing package
      run: |
        mkdir -pv ~/.ssh/
        touch priv_key
        chmod 600 priv_key
        echo "${{ secrets.SFTPPLUS_BIN_PRIV_KEY }}" > priv_key
        echo "${{ secrets.SFTPPLUS_BIN_HOST_KEY }}" > ~/.ssh/known_hosts
        ./publish_dist.sh ; rm priv_key

    - name: Tmate debug on failure
      if: ${{ failure() && !cancelled() && runner.debug }}
      uses: chevah/action-tmate@v3
      with:
        limit-access-to-actor: true


  macos-m1:
    runs-on: m1
    timeout-minutes: ${{ matrix.tests.debug == 'yes' && 90 || 30 }}
    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 2

    - name: Build Pythia
      run: ./build.sh build

    - name: Test Pythia
      run: ./build.sh test

    - name: Upload testing package
      run: |
        mkdir -pv ~/.ssh/
        touch priv_key
        chmod 600 priv_key
        echo "${{ secrets.SFTPPLUS_BIN_PRIV_KEY }}" > priv_key
        echo "${{ secrets.SFTPPLUS_BIN_HOST_KEY }}" > ~/.ssh/known_hosts
        ./publish_dist.sh ; rm priv_key