| 1 |
// OxygenFlow's own pipeline (docs/m0.md). Runs in Firecracker microVMs on |
| 2 |
// Earth for every push to a bookmark; see the Flow tab on OxygenHub. |
| 3 |
schema-version 1 |
| 4 |
|
| 5 |
sandbox "alpine" { |
| 6 |
runtime "microvm" |
| 7 |
// Alpine 3.24.2 minirootfs, imported on Earth with `flow rootfs import`. |
| 8 |
rootfs "cas://blob/e95d22fb2380b67193f2640a12c2f8c7bae485f6fd14330bdb0c7157faa588dc" |
| 9 |
memory-limit "256MiB" |
| 10 |
cpu-limit 1 |
| 11 |
network "isolated" |
| 12 |
} |
| 13 |
|
| 14 |
// The cheap checks as one WASI module (#96): crates/flow-checks, built by |
| 15 |
// scripts/checks-wasm.sh and committed as .flow/checks.wasm (the fmt job |
| 16 |
// fails if it is not what the source builds). No image and no KVM, so any |
| 17 |
// runner with the WASM tier takes them: the phone, plex, windows-1. |
| 18 |
sandbox "wasm" { |
| 19 |
runtime "wasm" |
| 20 |
memory-limit "64MiB" |
| 21 |
} |
| 22 |
|
| 23 |
job "layout" { |
| 24 |
sandbox "wasm" |
| 25 |
exec ".flow/checks.wasm" "layout" "Cargo.toml" "docs/m0.md" "crates/flow-core/src/pipeline.rs" "crates/flow-init/src/main.rs" "crates/flow/src/microvm.rs" |
| 26 |
} |
| 27 |
|
| 28 |
job "todos" { |
| 29 |
sandbox "wasm" |
| 30 |
scope "crates/**" ".flow/checks.wasm" |
| 31 |
exec ".flow/checks.wasm" "todos" "crates" |
| 32 |
} |
| 33 |
|
| 34 |
// The changelog's shape, and a section for the version Cargo.toml says, so |
| 35 |
// a release never finds its notes missing. |
| 36 |
job "changelog" { |
| 37 |
sandbox "wasm" |
| 38 |
scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm" |
| 39 |
exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml" |
| 40 |
} |
| 41 |
|
| 42 |
job "size" { |
| 43 |
sandbox "wasm" |
| 44 |
scope "crates/**" ".flow/checks.wasm" |
| 45 |
exec ".flow/checks.wasm" "size" "crates" |
| 46 |
} |
| 47 |
|
| 48 |
job "isolation" { |
| 49 |
sandbox "alpine" |
| 50 |
exec "sh" "-eu" ".flow/jobs/isolation.sh" |
| 51 |
} |
| 52 |
|
| 53 |
// The build image (images/rust): Rust with rustfmt and clippy, Node, and the |
| 54 |
// vendored crates. oxygen comes from the pinned subrepo in deps/. |
| 55 |
sandbox "rust" { |
| 56 |
runtime "microvm" |
| 57 |
rootfs "cas://blob/e52c41a173956b6bacc270eb81208a1b118b652412b84d15fa24708e6f8ec392" |
| 58 |
memory-limit "8GiB" |
| 59 |
cpu-limit 4 |
| 60 |
network "loopback" |
| 61 |
} |
| 62 |
|
| 63 |
sandbox "rust-small" { |
| 64 |
runtime "microvm" |
| 65 |
rootfs "cas://blob/e52c41a173956b6bacc270eb81208a1b118b652412b84d15fa24708e6f8ec392" |
| 66 |
memory-limit "1GiB" |
| 67 |
cpu-limit 1 |
| 68 |
network "isolated" |
| 69 |
} |
| 70 |
|
| 71 |
job "fmt" { |
| 72 |
sandbox "rust-small" |
| 73 |
// This workspace only (--all would reach the pinned oxygen in deps/), |
| 74 |
// and the checks' committed WASI module is what its source builds (#96). |
| 75 |
exec "sh" "-euc" "cargo fmt --check -p flow -p flow-core -p flow-init -p flow-casfs -p flow-checks && sh scripts/checks-wasm.sh --check" |
| 76 |
} |
| 77 |
|
| 78 |
job "clippy" { |
| 79 |
sandbox "rust" |
| 80 |
depends-on "fmt" |
| 81 |
mount { |
| 82 |
source "ephemeral://disk" |
| 83 |
target "/src/target" |
| 84 |
size "16GiB" |
| 85 |
} |
| 86 |
env { |
| 87 |
CARGO_INCREMENTAL "0" |
| 88 |
} |
| 89 |
exec "sh" ".flow/warm-target.sh" "cargo" "clippy" "--workspace" "--all-targets" "--locked" "--" "-D" "warnings" |
| 90 |
} |
| 91 |
|
| 92 |
job "test" { |
| 93 |
sandbox "rust" |
| 94 |
depends-on "fmt" |
| 95 |
mount { |
| 96 |
source "ephemeral://disk" |
| 97 |
target "/src/target" |
| 98 |
size "16GiB" |
| 99 |
} |
| 100 |
env { |
| 101 |
CARGO_INCREMENTAL "0" |
| 102 |
} |
| 103 |
// The tests under cargo-nextest and cargo-llvm-cov (#82): a test report |
| 104 |
// (JUnit, kept whether or not they pass) and line coverage (LCOV) from |
| 105 |
// one run, for the hub's Tests and Coverage tabs. |
| 106 |
exec "sh" ".flow/warm-target.sh" "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info" |
| 107 |
output { |
| 108 |
artifact "junit" { |
| 109 |
path "/src/target/nextest/ci/junit.xml" |
| 110 |
when "always" |
| 111 |
} |
| 112 |
artifact "coverage" { |
| 113 |
path "/src/target/lcov.info" |
| 114 |
} |
| 115 |
} |
| 116 |
} |
| 117 |
|
| 118 |
// Runner builds for releases (oxygenhub#322): flow-linux-ARCH for x86_64, |
| 119 |
// aarch64 and riscv64, which runners that update themselves are offered. |
| 120 |
job "dist" { |
| 121 |
sandbox "rust" |
| 122 |
depends-on "fmt" |
| 123 |
scope "Cargo.toml" "scripts/dist.sh" |
| 124 |
mount { |
| 125 |
source "ephemeral://disk" |
| 126 |
target "/src/target" |
| 127 |
size "24GiB" |
| 128 |
cache "target" |
| 129 |
key "Cargo.lock" |
| 130 |
} |
| 131 |
env { |
| 132 |
DIST_FLAT "/src/target/dist-flat" |
| 133 |
ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache" |
| 134 |
} |
| 135 |
exec "bash" "scripts/dist.sh" |
| 136 |
output { |
| 137 |
artifact "flow-linux-x86_64" { |
| 138 |
path "/src/target/dist-flat/flow-linux-x86_64" |
| 139 |
} |
| 140 |
artifact "flow-linux-aarch64" { |
| 141 |
path "/src/target/dist-flat/flow-linux-aarch64" |
| 142 |
} |
| 143 |
artifact "flow-linux-riscv64" { |
| 144 |
path "/src/target/dist-flat/flow-linux-riscv64" |
| 145 |
} |
| 146 |
artifact "flow-windows-x86_64.exe" { |
| 147 |
path "/src/target/dist-flat/flow-windows-x86_64.exe" |
| 148 |
} |
| 149 |
artifact "SHA256SUMS" { |
| 150 |
path "/src/target/dist-flat/SHA256SUMS" |
| 151 |
} |
| 152 |
} |
| 153 |
} |
| 154 |
|
| 155 |
job "summary" { |
| 156 |
sandbox "wasm" |
| 157 |
depends-on "layout" "todos" "size" "isolation" "clippy" "test" |
| 158 |
env { |
| 159 |
PROJECT "OxygenFlow" |
| 160 |
} |
| 161 |
exec ".flow/checks.wasm" "summary" |
| 162 |
} |