| 1 |
// Oxygen's own pipeline (OxygenFlow, docs in the oxygenflow repository). |
| 2 |
// Every push to a bookmark on OxygenHub runs it in Firecracker microVMs on |
| 3 |
// Earth; the jobs appear as checks on the change. |
| 4 |
schema-version 1 |
| 5 |
|
| 6 |
// The OxygenFlow build image: Rust with rustfmt and clippy, Node, and every |
| 7 |
// crate of Cargo.lock vendored (oxygenflow/images/rust). Rebuild and re-pin |
| 8 |
// it when Cargo.lock changes. |
| 9 |
sandbox "rust" { |
| 10 |
runtime "microvm" |
| 11 |
rootfs "cas://blob/7705d699a4fc06862e4297b7069396cf3b5b35b1d3f15191c46dc2031af17133" |
| 12 |
memory-limit "8GiB" |
| 13 |
cpu-limit 4 |
| 14 |
// Tests serve and connect on 127.0.0.1; nothing leaves the guest. |
| 15 |
network "loopback" |
| 16 |
// CI builds are thrown away: no incremental state and no debug info, |
| 17 |
// so less to compile, link and write (as in oxygenhub's pipeline). |
| 18 |
env { |
| 19 |
CARGO_INCREMENTAL "0" |
| 20 |
CARGO_PROFILE_DEV_DEBUG "0" |
| 21 |
CARGO_PROFILE_TEST_DEBUG "0" |
| 22 |
CARGO_PROFILE_RELEASE_DEBUG "0" |
| 23 |
} |
| 24 |
} |
| 25 |
|
| 26 |
sandbox "rust-small" { |
| 27 |
runtime "microvm" |
| 28 |
rootfs "cas://blob/7705d699a4fc06862e4297b7069396cf3b5b35b1d3f15191c46dc2031af17133" |
| 29 |
memory-limit "1GiB" |
| 30 |
cpu-limit 1 |
| 31 |
network "isolated" |
| 32 |
} |
| 33 |
|
| 34 |
job "fmt" { |
| 35 |
sandbox "rust-small" |
| 36 |
exec "cargo" "fmt" "--all" "--check" |
| 37 |
} |
| 38 |
|
| 39 |
job "clippy" { |
| 40 |
sandbox "rust" |
| 41 |
depends-on "fmt" |
| 42 |
mount { |
| 43 |
source "ephemeral://disk" |
| 44 |
target "/src/target" |
| 45 |
size "24GiB" |
| 46 |
} |
| 47 |
exec "sh" ".flow/warm-target.sh" "cargo" "clippy" "--workspace" "--all-targets" "--locked" "--" "-D" "warnings" |
| 48 |
} |
| 49 |
|
| 50 |
// The tests, run under cargo-llvm-cov so the hub's Coverage tab |
| 51 |
// (oxygenhub#113) gets a report: the same tests, instrumented, and an LCOV |
| 52 |
// file kept as the job's `coverage` artifact. |
| 53 |
job "test" { |
| 54 |
sandbox "rust" |
| 55 |
depends-on "fmt" |
| 56 |
mount { |
| 57 |
source "ephemeral://disk" |
| 58 |
target "/src/target" |
| 59 |
size "24GiB" |
| 60 |
} |
| 61 |
exec "cargo" "llvm-cov" "--workspace" "--locked" "--lcov" "--output-path" "/src/target/lcov.info" |
| 62 |
output { |
| 63 |
artifact "coverage" { |
| 64 |
path "/src/target/lcov.info" |
| 65 |
} |
| 66 |
} |
| 67 |
} |
| 68 |
|
| 69 |
job "build" { |
| 70 |
sandbox "rust" |
| 71 |
depends-on "fmt" |
| 72 |
mount { |
| 73 |
source "ephemeral://disk" |
| 74 |
target "/src/target" |
| 75 |
size "24GiB" |
| 76 |
} |
| 77 |
exec "sh" ".flow/warm-target.sh" "cargo" "build" "--release" "--locked" |
| 78 |
// The binary, kept as a blob of this repository and named by the |
| 79 |
// job's signed receipt; the run page links it. |
| 80 |
output { |
| 81 |
artifact "oxy" { |
| 82 |
path "/src/target/release/oxy" |
| 83 |
} |
| 84 |
} |
| 85 |
} |
| 86 |
|
| 87 |
// Release files for every platform (oxygen#59): scripts/dist.sh in the |
| 88 |
// build image's cross toolchains. A push runs it only when it touches |
| 89 |
// these paths (a release moves Cargo.toml's version); "Run pipeline" and |
| 90 |
// reruns always do. The files are kept as this run's artifacts, named by |
| 91 |
// its signed receipt, and attached to the release from there, so the |
| 92 |
// release's trust page shows each as built here. |
| 93 |
job "dist" { |
| 94 |
sandbox "rust" |
| 95 |
depends-on "fmt" |
| 96 |
scope "Cargo.toml" "scripts/dist.sh" "packaging/**" |
| 97 |
mount { |
| 98 |
source "ephemeral://disk" |
| 99 |
target "/src/target" |
| 100 |
size "24GiB" |
| 101 |
} |
| 102 |
env { |
| 103 |
DIST_FLAT "/src/target/dist-flat" |
| 104 |
ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache" |
| 105 |
} |
| 106 |
exec "bash" "scripts/dist.sh" |
| 107 |
output { |
| 108 |
artifact "oxy-linux-x86_64.tar.gz" { |
| 109 |
path "/src/target/dist-flat/oxy-linux-x86_64.tar.gz" |
| 110 |
} |
| 111 |
artifact "oxy-linux-arm64.tar.gz" { |
| 112 |
path "/src/target/dist-flat/oxy-linux-arm64.tar.gz" |
| 113 |
} |
| 114 |
artifact "oxy-linux-riscv64.tar.gz" { |
| 115 |
path "/src/target/dist-flat/oxy-linux-riscv64.tar.gz" |
| 116 |
} |
| 117 |
artifact "oxy-macos-x86_64.tar.gz" { |
| 118 |
path "/src/target/dist-flat/oxy-macos-x86_64.tar.gz" |
| 119 |
} |
| 120 |
artifact "oxy-macos-arm64.tar.gz" { |
| 121 |
path "/src/target/dist-flat/oxy-macos-arm64.tar.gz" |
| 122 |
} |
| 123 |
artifact "oxy-windows-x86_64.zip" { |
| 124 |
path "/src/target/dist-flat/oxy-windows-x86_64.zip" |
| 125 |
} |
| 126 |
artifact "oxy_amd64.deb" { |
| 127 |
path "/src/target/dist-flat/oxy_amd64.deb" |
| 128 |
} |
| 129 |
artifact "oxy_arm64.deb" { |
| 130 |
path "/src/target/dist-flat/oxy_arm64.deb" |
| 131 |
} |
| 132 |
artifact "oxy_riscv64.deb" { |
| 133 |
path "/src/target/dist-flat/oxy_riscv64.deb" |
| 134 |
} |
| 135 |
artifact "SHA256SUMS" { |
| 136 |
path "/src/target/dist-flat/SHA256SUMS" |
| 137 |
} |
| 138 |
} |
| 139 |
} |