doos/.gitea/workflows/ci.yml

# Gitea Actions. See docs/CI.md for what each job needs, the one-time runner setup, and the
# known gaps between Gitea Actions and GitHub Actions this file was written around (notably:
# timeout-minutes and concurrency are parsed but not enforced by Gitea as of the 1.25 docs, so
# the real cap on every step is the `timeout <seconds>` wrapped around it, not the YAML key).
name: ci

on:
  push:
    branches: ["**"]
  pull_request:

jobs:
  # Needs only a C++20 toolchain and CMake: runs on any Docker-mode act_runner.
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10  # label only on Gitea (see docs/CI.md); the real cap is the `timeout` below
    steps:
      - uses: actions/checkout@v4
      - name: install build dependencies
        run: timeout 180 sh -c 'apt-get update && apt-get install -y --no-install-recommends build-essential cmake'
      - name: build (-Werror)
        run: timeout 300 cmake -S . -B build && timeout 300 cmake --build build
      - name: docs cross-link check
        run: timeout 60 scripts/check-docs.sh

  # No special runner privilege needed: scripts/valgrind.sh only fails on what valgrind itself
  # reports, never on doos's own exit code, so it is still a real check even when this container's
  # own policy blocks the user namespace doos tries to create (see docs/CI.md).
  valgrind:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: install build and valgrind dependencies
        run: timeout 180 sh -c 'apt-get update && apt-get install -y --no-install-recommends build-essential cmake valgrind'
      - name: build
        run: timeout 300 cmake -S . -B build && timeout 300 cmake --build build
      - name: memcheck against the fixed invocation set
        run: timeout 300 scripts/valgrind.sh "$(pwd)/build/doos"
      - name: keep the per-step logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: valgrind-reports
          path: build/valgrind-reports/

  # Real overlayfs, real user/mount/pid namespaces, real cgroup v2 limits, real downloads: needs
  # the self-hosted host-mode runner set up per docs/CI.md (label "doos-host"), not a container.
  test:
    runs-on: [self-hosted, doos-host]
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: build
        run: timeout 300 cmake -S . -B build && timeout 300 cmake --build build
      - name: end-to-end suite
        run: timeout 600 tests/run.sh "$(pwd)/build/doos"

  # Named CVE regression set against the binary this run just built. Same runner requirement as
  # `test`, for the same reason (several checks attach a real container).
  audit:
    runs-on: [self-hosted, doos-host]
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: build
        run: timeout 300 cmake -S . -B build && timeout 300 cmake --build build
      - name: CVE regression checks
        run: timeout 300 make -C audit -j8 test DOOS="$(pwd)/build/doos"