Skip to content

feat: add production headless monitoring #1117

feat: add production headless monitoring

feat: add production headless monitoring #1117

Workflow file for this run

name: Rust
on:
push:
branches: [ "main" ]
paths:
- 'src/**'
- 'crates/**'
- 'Cargo.toml'
- 'Cargo.lock'
- 'build.rs'
- 'benches/**'
- 'tests/**'
- 'Dockerfile'
- '.cargo/audit.toml'
- '.github/workflows/rust.yml'
pull_request:
paths:
- 'src/**'
- 'crates/**'
- 'Cargo.toml'
- 'Cargo.lock'
- 'build.rs'
- 'benches/**'
- 'tests/**'
- 'Dockerfile'
- '.cargo/audit.toml'
- '.github/workflows/rust.yml'
workflow_dispatch:
permissions:
contents: read
env:
CARGO_TERM_COLOR: always
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Setup Linux dependencies
uses: ./.github/actions/setup-linux-deps
- name: Check formatting
run: cargo fmt --check
- name: Validate dependency lockfile
run: cargo check --locked --workspace --all-targets --all-features
- name: Check without default features
run: cargo check --locked --workspace --all-targets --no-default-features
# --workspace --all-targets so the library crates (rustnet-core/-capture/
# -host) are linted, built, and tested too. The workspace root is a real
# package (rustnet-monitor), so a bare `cargo {clippy,build,test}` only
# selects the binary and silently skips the library crates' lints, tests,
# and doctests.
- name: Run clippy
run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
- name: Build
run: cargo build --locked --workspace --all-targets --verbose
- name: Run tests
run: cargo test --locked --workspace --all-features --verbose
- name: Test capture shutdown after loopback traffic stops
run: |
test_executable=$(cargo test --locked -p rustnet-capture --test live_capture --no-run --message-format=json |
jq -r 'select(.reason == "compiler-artifact" and .target.name == "live_capture") | .executable // empty')
test -n "$test_executable"
# Only this BPF-filtered loopback regression needs capture privileges.
# The process watchdog also bounds failures inside the native backend.
sudo timeout 10s "$test_executable" --ignored --exact idle_capture_returns_after_traffic_stops_without_busy_spinning
- name: Test capture capability cleanup before UID drop
run: |
test_executable=$(cargo test --locked -p rustnet-sandbox --lib --features landlock --no-run --message-format=json |
jq -r 'select(.reason == "compiler-artifact" and .target.name == "rustnet_sandbox") | .executable // empty')
test -n "$test_executable"
# Identity changes are isolated to this exact test process.
sudo timeout 10s "$test_executable" --ignored --exact linux::capabilities::tests::capture_capability_drops_preserve_uid_and_gid_changes
- name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Run security audit
# Fail the build on advisories and on yanked crates so a withdrawn
# dependency (e.g. a yanked release pinned in Cargo.lock) is caught in CI.
run: cargo audit
docker:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
- name: Build Docker image
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
with:
context: .
push: false
load: true
tags: rustnet:ci-test
- name: Verify Docker image
run: docker run --rm rustnet:ci-test --version