feat: add production headless monitoring #1117
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| paths: | |
| - 'src/**' | |
| - 'crates/**' | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' | |
| - 'build.rs' | |
| - 'benches/**' | |
| - 'tests/**' | |
| - 'Dockerfile' | |
| - '.cargo/audit.toml' | |
| - '.github/workflows/rust.yml' | |
| pull_request: | |
| paths: | |
| - 'src/**' | |
| - 'crates/**' | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' | |
| - 'build.rs' | |
| - 'benches/**' | |
| - 'tests/**' | |
| - 'Dockerfile' | |
| - '.cargo/audit.toml' | |
| - '.github/workflows/rust.yml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Linux dependencies | |
| uses: ./.github/actions/setup-linux-deps | |
| - name: Check formatting | |
| run: cargo fmt --check | |
| - name: Validate dependency lockfile | |
| run: cargo check --locked --workspace --all-targets --all-features | |
| - name: Check without default features | |
| run: cargo check --locked --workspace --all-targets --no-default-features | |
| # --workspace --all-targets so the library crates (rustnet-core/-capture/ | |
| # -host) are linted, built, and tested too. The workspace root is a real | |
| # package (rustnet-monitor), so a bare `cargo {clippy,build,test}` only | |
| # selects the binary and silently skips the library crates' lints, tests, | |
| # and doctests. | |
| - name: Run clippy | |
| run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings | |
| - name: Build | |
| run: cargo build --locked --workspace --all-targets --verbose | |
| - name: Run tests | |
| run: cargo test --locked --workspace --all-features --verbose | |
| - name: Test capture shutdown after loopback traffic stops | |
| run: | | |
| test_executable=$(cargo test --locked -p rustnet-capture --test live_capture --no-run --message-format=json | | |
| jq -r 'select(.reason == "compiler-artifact" and .target.name == "live_capture") | .executable // empty') | |
| test -n "$test_executable" | |
| # Only this BPF-filtered loopback regression needs capture privileges. | |
| # The process watchdog also bounds failures inside the native backend. | |
| sudo timeout 10s "$test_executable" --ignored --exact idle_capture_returns_after_traffic_stops_without_busy_spinning | |
| - name: Test capture capability cleanup before UID drop | |
| run: | | |
| test_executable=$(cargo test --locked -p rustnet-sandbox --lib --features landlock --no-run --message-format=json | | |
| jq -r 'select(.reason == "compiler-artifact" and .target.name == "rustnet_sandbox") | .executable // empty') | |
| test -n "$test_executable" | |
| # Identity changes are isolated to this exact test process. | |
| sudo timeout 10s "$test_executable" --ignored --exact linux::capabilities::tests::capture_capability_drops_preserve_uid_and_gid_changes | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Run security audit | |
| # Fail the build on advisories and on yanked crates so a withdrawn | |
| # dependency (e.g. a yanked release pinned in Cargo.lock) is caught in CI. | |
| run: cargo audit | |
| docker: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 | |
| - name: Build Docker image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| push: false | |
| load: true | |
| tags: rustnet:ci-test | |
| - name: Verify Docker image | |
| run: docker run --rm rustnet:ci-test --version |