Skip to content

Commit 18efd94

Browse files
ludamadludamad
authored
fix: ci-network-scenario label, fix nightly benchmarks (#19140)
## Summary - Split out the handling of per-release scenario tests to be part of ci3.yml. Simplify test-network-scenarios.yml for the workflow_dispatch case. - We now support the label ci-network-scenarios. You may combine this with ci-skip to not also run normal tests. - Nightly spartan benchmarks flow yaml working and simplified. - Work on the redact script, which now handles github's add-mask (needed to use our ci3 logging utils on the parts of the sript) ## Fixes - Allow for overriding namespace in env files - Only pass ETHERSCAN_API_KEY to terraform when VERIFY_CONTRACTS is true - Refactoring for YAML's that call into ci - Use nested logging and k8s URL links for much better deploy_network.sh observability Example workflow_dispatch passing for test-network-scenarios.yml https://github.com/AztecProtocol/aztec-packages/actions/runs/20379119834/job/58564980277 Example ci-network-scenario label passing: https://github.com/AztecProtocol/aztec-packages/actions/runs/20385820878/job/58586990753?pr=19140 (lost track of the one later where teardown was fixed)
2 parents 2039c54 + b738e83 commit 18efd94

35 files changed

+911
-532
lines changed

‎.github/ci3.sh‎

Lines changed: 35 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,36 @@
11
#!/usr/bin/env bash
2+
# Main CI3 entry point. Sets up the environment and forwards to ci.sh.
3+
# CI mode is passed as first argument.
24
set -euo pipefail
35

46
: "${AWS_ACCESS_KEY_ID:?required}"
57
: "${AWS_SECRET_ACCESS_KEY:?required}"
68
: "${GITHUB_TOKEN:?required}"
79

10+
CI_MODE="${1:?CI_MODE must be provided as first argument}"
11+
shift
12+
813
NO_CD=1 source $(git rev-parse --show-toplevel)/ci3/source
914

1015
function setup_environment {
1116
echo_header "Setup"
1217
# Store GCP key
13-
if [ -n "${GCP_SA_KEY:-}" ] && [ -n "${GOOGLE_APPLICATION_CREDENTIALS:-}" ]; then
18+
if [ -n "${GCP_SA_KEY:-}" ]; then
19+
export GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp-key.json
1420
set +x
1521
umask 077
1622
printf '%s' "$GCP_SA_KEY" > "$GOOGLE_APPLICATION_CREDENTIALS"
1723
jq -e . "$GOOGLE_APPLICATION_CREDENTIALS" >/dev/null
1824
echo "GCP key stored"
1925
fi
20-
# Compute target branch
21-
local target_branch
22-
if [ "${GITHUB_EVENT_NAME:-}" == "merge_group" ]; then
23-
target_branch="${MERGE_GROUP_BASE_REF:-}"
24-
elif [ "${GITHUB_EVENT_NAME:-}" == "pull_request" ]; then
25-
target_branch="${PR_BASE_REF:-}"
26-
else
27-
target_branch="${GITHUB_REF_NAME:-}"
28-
fi
29-
target_branch="${target_branch#refs/heads/}"
30-
export TARGET_BRANCH=$target_branch
31-
echo "TARGET_BRANCH=$TARGET_BRANCH" >> $GITHUB_ENV
32-
echo "Target branch: $TARGET_BRANCH"
3326
# To allow full concurrency, we set instance postfix for merge-train PRs
3427
if [[ "${PR_HEAD_REF:-}" == merge-train/* ]]; then
3528
export INSTANCE_POSTFIX=${PR_COMMITS:-}
3629
echo "INSTANCE_POSTFIX=$INSTANCE_POSTFIX" >> $GITHUB_ENV
3730
echo "Instance postfix set to: $INSTANCE_POSTFIX"
3831
fi
3932
# Setup SSH key for connecting to EC2 instances
40-
# Note: The key is used to SSH into instances but is only copied INTO instances when CI_ENABLE_DISK_LOGS=1 (internal CI only)
33+
# Note: The key is used to SSH into instances but is only copied INTO instances when CI_USE_BUILD_INSTANCE_KEY=1 (internal CI only)
4134
if [ -n "${BUILD_INSTANCE_SSH_KEY:-}" ]; then
4235
mkdir -p ~/.ssh
4336
echo "${BUILD_INSTANCE_SSH_KEY}" | base64 --decode > ~/.ssh/build_instance_key
@@ -46,76 +39,32 @@ function setup_environment {
4639
fi
4740
}
4841

49-
function has_label {
50-
local label="$1"
51-
if [[ ",$LABELS," == *",$label,"* ]]; then
52-
echo "Label '$label' found" >&2
53-
return 0
54-
fi
55-
return 1
56-
}
57-
58-
function determine_ci_mode {
59-
echo_header "CI Mode Determination"
60-
echo "Labels: ${LABELS}"
61-
# Handle fail-fast override
62-
if has_label "ci-no-fail-fast"; then
63-
export NO_FAIL_FAST=1
64-
echo "NO_FAIL_FAST=$NO_FAIL_FAST" >> $GITHUB_ENV
65-
fi
66-
# Determine CI mode based on event, labels, and target branch
67-
if [ "${GITHUB_EVENT_NAME:-}" == "merge_group" ] || has_label "ci-merge-queue"; then
68-
CI_MODE="merge-queue"
69-
elif has_label "ci-release-pr"; then
70-
CI_MODE="release-pr"
71-
elif has_label "ci-full"; then
72-
CI_MODE="full"
73-
elif has_label "ci-full-no-test-cache"; then
74-
CI_MODE="full-no-test-cache"
75-
elif has_label "ci-docs" || [ "${TARGET_BRANCH:-}" == "merge-train/docs" ]; then
76-
CI_MODE="docs"
77-
elif has_label "ci-barretenberg" || [ "${TARGET_BRANCH:-}" == "merge-train/barretenberg" ]; then
78-
CI_MODE="barretenberg"
79-
elif has_label "ci-barretenberg-full"; then
80-
CI_MODE="barretenberg-full"
81-
# We don't distinguish nightlies currently.
82-
# elif [[ "${GITHUB_REF:-}" == *"-nightly."* ]] || [[ "${GITHUB_REF:-}" == *"-rc."* ]]; then
83-
# CI_MODE="nightly"
84-
elif [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
85-
CI_MODE="release"
86-
else
87-
CI_MODE="fast"
88-
fi
89-
echo "CI_MODE=$CI_MODE" >> $GITHUB_ENV
90-
echo "CI mode: $CI_MODE"
91-
# Determine if benchmarks should be uploaded (merge-queue, full, or full-no-test-cache modes)
92-
if [[ "$CI_MODE" == "merge-queue" || "$CI_MODE" == "full" || "$CI_MODE" == "full-no-test-cache" ]]; then
93-
echo "SHOULD_UPLOAD_BENCHMARKS=1" >> $GITHUB_ENV
94-
fi
95-
}
96-
9742
function check_cache {
9843
echo_header "Cache Check"
9944
local tree_hash=$(git rev-parse HEAD^{tree})
10045
local cache_name="ci-success-${CI_MODE}-${tree_hash}.tar.gz"
101-
# Export for use by ci3-post.sh
46+
# Export for use by ci3_success.sh
10247
echo "CI_CACHE_NAME=$cache_name" >> $GITHUB_ENV
103-
# Skip cache for release builds - they must always produce versioned images
104-
if [ "$CI_MODE" == "release" ]; then
105-
echo "Cache disabled for release builds"
106-
return
107-
fi
108-
if has_label "no-cache"; then
109-
export NO_CACHE=1
110-
echo "NO_CACHE=$NO_CACHE" >> $GITHUB_ENV
111-
echo "Cache disabled by label"
112-
return
113-
fi
114-
if cache_download "$cache_name" . 2>/dev/null && [ -f ".ci-success.txt" ]; then
115-
echo "Cache hit! Previous run: $(cat ".ci-success.txt")"
116-
exit 0
48+
# Only whitelist some ci modes for cache.
49+
# E.g. we skip cache for release builds - they must always produce versioned images
50+
cached_ci_modes=(
51+
"fast"
52+
"full"
53+
"full-no-test-cache"
54+
"docs"
55+
"barretenberg"
56+
"ci-release-pr"
57+
)
58+
# Check if CI_MODE is in cached_ci_modes
59+
if [[ " ${cached_ci_modes[@]} " =~ " ${CI_MODE} " ]]; then
60+
if cache_download "$cache_name" . 2>/dev/null && [ -f ".ci-success.txt" ]; then
61+
echo "Cache hit in .github/ci3.sh! Previous run: $(cat ".ci-success.txt")"
62+
exit 0
63+
fi
64+
echo "Cache miss in .github/ci3.sh, running CI in ${CI_MODE} mode..."
65+
else
66+
echo "Not using the .github/ci3.sh CI cache for mode $CI_MODE."
11767
fi
118-
echo "Cache miss, running CI in ${CI_MODE} mode..."
11968
}
12069

12170
function handle_release_pr {
@@ -131,18 +80,22 @@ function handle_release_pr {
13180
}
13281

13382
function main {
134-
LABELS="${1:-}"
13583
echo_header "CI3 Main Script"
84+
echo "CI mode: $CI_MODE"
13685
setup_environment
137-
determine_ci_mode
13886
# Handle release-pr mode separately (creates tag instead of running CI)
87+
88+
if [ "${CI_MODE}" == "skip" ]; then
89+
echo_stderr "WARNING: CI is being skipped in this PR."
90+
exit 0
91+
fi
13992
if [ "${CI_MODE}" == "release-pr" ]; then
14093
handle_release_pr
14194
exit 0
14295
fi
14396
check_cache
14497
echo_header "Run ${CI_MODE} CI"
145-
exec ./ci.sh "${CI_MODE}"
98+
exec ./ci.sh "${CI_MODE}" "$@"
14699
}
147100

148101
main "$@"

‎.github/ci3_labels_to_env.sh‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
#!/usr/bin/env bash
2+
# Determines CI mode from labels and environment variables.
3+
# Called by ci3.yml to set CI_MODE and related environment variables.
4+
# Outputs environment variables to GITHUB_ENV for use in subsequent steps.
5+
set -euo pipefail
6+
7+
function has_label {
8+
local label="$1"
9+
for l in "${LABELS[@]}"; do
10+
if [[ "$l" == "$label" ]]; then
11+
echo "Label '$label' found" >&2
12+
return 0
13+
fi
14+
done
15+
return 1
16+
}
17+
18+
function main {
19+
LABELS=("$@")
20+
echo "Labels: ${LABELS[*]}"
21+
22+
# Compute target branch
23+
local target_branch
24+
if [ "${GITHUB_EVENT_NAME:-}" == "merge_group" ]; then
25+
target_branch="${MERGE_GROUP_BASE_REF:-}"
26+
elif [ "${GITHUB_EVENT_NAME:-}" == "pull_request" ]; then
27+
target_branch="${PR_BASE_REF:-}"
28+
else
29+
target_branch="${GITHUB_REF_NAME:-}"
30+
fi
31+
target_branch="${target_branch#refs/heads/}"
32+
echo "TARGET_BRANCH=$target_branch" >> $GITHUB_ENV
33+
echo "Target branch: $target_branch"
34+
35+
# Handle fail-fast override
36+
if has_label "ci-no-fail-fast"; then
37+
echo "NO_FAIL_FAST=1" >> $GITHUB_ENV
38+
fi
39+
40+
# Determine CI mode based on event, labels, and target branch
41+
local ci_mode
42+
if [ "${GITHUB_EVENT_NAME:-}" == "merge_group" ] || has_label "ci-merge-queue"; then
43+
ci_mode="merge-queue"
44+
elif has_label "ci-release-pr"; then
45+
ci_mode="release-pr"
46+
elif has_label "ci-full"; then
47+
ci_mode="full"
48+
elif has_label "ci-full-no-test-cache"; then
49+
ci_mode="full-no-test-cache"
50+
# elif has_label "ci-test-network"; then
51+
# ci_mode="full-no-test-cache"
52+
elif has_label "ci-docs" || [ "$target_branch" == "merge-train/docs" ]; then
53+
ci_mode="docs"
54+
elif has_label "ci-barretenberg" || [ "$target_branch" == "merge-train/barretenberg" ]; then
55+
ci_mode="barretenberg"
56+
elif has_label "ci-barretenberg-full"; then
57+
ci_mode="barretenberg-full"
58+
elif [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
59+
ci_mode="release"
60+
elif has_label "ci-skip"; then
61+
echo_stderr "WARNING: Skipping CI due to the ci-skip label! Make sure this is intended!"
62+
ci_mode="skip"
63+
else
64+
ci_mode="fast"
65+
fi
66+
echo "CI_MODE=$ci_mode" >> $GITHUB_ENV
67+
echo "CI mode: $ci_mode"
68+
69+
# Determine if benchmarks should be uploaded (merge-queue, full, or full-no-test-cache modes)
70+
if [[ "$ci_mode" == "merge-queue" || "$ci_mode" == "full" || "$ci_mode" == "full-no-test-cache" ]]; then
71+
echo "SHOULD_UPLOAD_BENCHMARKS=1" >> $GITHUB_ENV
72+
fi
73+
74+
# Handle no-cache label
75+
if has_label "no-cache"; then
76+
echo "NO_CACHE=1" >> $GITHUB_ENV
77+
echo "Cache disabled by label"
78+
fi
79+
}
80+
81+
main "$@"

.github/ci3-post.sh renamed to .github/ci3_success.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ function handle_squash_merge {
4141
}
4242

4343
function handle_benchmarks {
44-
if [ "${SHOULD_UPLOAD_BENCHMARKS:-0}" -eq 0 ] || [ "${CI_INTERNAL:-0}" -eq 0 ]; then
44+
if [ "${SHOULD_UPLOAD_BENCHMARKS:-0}" -eq 0 ]; then
4545
return
4646
fi
4747
# Handle benchmarks download (internal only)

‎.github/workflows/ci3-external.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ jobs:
7171
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
7272
GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
7373
BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
74+
# DO NOT allow build instance key access to external jobs.
75+
CI_USE_BUILD_INSTANCE_KEY: "0"
7476
MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
7577
PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
7678
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
@@ -91,4 +93,4 @@ jobs:
9193
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
9294
PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
9395
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
94-
run: ./.github/ci3-post.sh
96+
run: ./.github/ci3_success.sh

0 commit comments

Comments
 (0)