feat(1.23): Stage 1 OLTP pgbench TPC-B baseline runner + 071 TAP smok… #86
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ---------------------------------------------------------------------- | |
| # .github/workflows/ci.yml | |
| # linkdb CI standard pipeline | |
| # | |
| # Implements CLAUDE.md rule 20 stages 1-3 (Validate / Build / Test) | |
| # of the pgrac project (design specs / docs live in the private | |
| # sqlrush/pgrac repo; this linkdb repo holds only the PG fork code). | |
| # | |
| # Author: SqlRush <sqlrush@gmail.com> | |
| # | |
| # Portions Copyright (c) 2026, pgrac contributors | |
| # | |
| # Triggers: | |
| # - push to main | |
| # - pull_request to main | |
| # | |
| # Jobs: | |
| # 1. validate (~1-2 min, ubuntu): comment headers + commit msg | |
| # 2. build-test (matrix) (~6-10 min): build + PG 219 + cluster_unit + cluster_tap | |
| # 3. build-disable-mode (~5-8 min, ubuntu): regression of native PG path | |
| # | |
| # Total time target: <= 15 min (jobs run in parallel after validate) | |
| # ---------------------------------------------------------------------- | |
| name: linkdb CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Cancel in-progress runs on the same branch when a new commit is pushed. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ==================================================================== | |
| # Stage 1: Validate | |
| # -------------------------------------------------------------------- | |
| # Lightweight checks that catch obvious problems before spinning up | |
| # the heavier build/test matrix. | |
| # ==================================================================== | |
| validate: | |
| name: Validate (comment headers + format + tidy + commit msg) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| # Need full history so check-*.sh can diff against origin/main. | |
| fetch-depth: 0 | |
| - name: Install lint tools | |
| run: | | |
| sudo apt-get update -y | |
| sudo apt-get install -y --no-install-recommends \ | |
| clang-format clang-tidy | |
| - name: Check no test artifacts tracked (spec-1.14.1 F19) | |
| run: | | |
| tracked=$(git ls-files | grep -E '/(tmp_check|log)/|regression\.(diffs|out)$' || true) | |
| if [ -n "$tracked" ]; then | |
| echo "::error::test ephemeral artifacts tracked in git tree:" | |
| echo "$tracked" | |
| echo "::error::run: git rm --cached <file>; .gitignore should already exclude" | |
| exit 1 | |
| fi | |
| echo "OK: no tmp_check / log / regression.diffs in tracked tree" | |
| - name: Check comment headers (CLAUDE.md rule 11) | |
| run: ./scripts/ci/check-comment-headers.sh | |
| - name: Check clang-format (cluster sources) | |
| run: ./scripts/ci/check-format.sh | |
| - name: Check clang-tidy (cluster sources, warn-only stage 0.7) | |
| run: ./scripts/ci/check-tidy.sh | |
| - name: Check SCN cmp gate (spec-1.15 Q8+L4; ban raw SCN comparisons) | |
| run: ./scripts/ci/check-scn-cmp-gate.sh | |
| - name: Lint commit message (strict, stage 0.7 tightened from spec-0.6 Q5) | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| msg=$(git log -1 --pretty=%s) | |
| if ! [[ "$msg" =~ ^(feat|fix|docs|refactor|test|chore|perf|ci|spec|style)(\([^\)]+\))?:\ .+ ]]; then | |
| echo "::error::commit subject does not match conventional pattern: '$msg'" | |
| echo "::error::Expected: type(scope): subject (type in feat|fix|docs|refactor|test|chore|perf|ci|spec|style)" | |
| exit 1 | |
| fi | |
| echo "commit message format OK" | |
| # ==================================================================== | |
| # Stage 2 + 3: Build & Test (matrix Linux + macOS) | |
| # -------------------------------------------------------------------- | |
| # Configure with --enable-cluster --enable-tap-tests, build, install, | |
| # run PG 219 regress + pgrac cluster-check (unit + tap + regress). | |
| # ==================================================================== | |
| build-test: | |
| name: Build+Test (${{ matrix.os }}) | |
| needs: validate | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # ---------------------------------------------------------------- | |
| # Install OS dependencies | |
| # ---------------------------------------------------------------- | |
| - name: Install Linux dependencies | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update -y | |
| sudo apt-get install -y --no-install-recommends \ | |
| build-essential \ | |
| libreadline-dev \ | |
| zlib1g-dev \ | |
| libicu-dev \ | |
| liblz4-dev \ | |
| libzstd-dev \ | |
| libssl-dev \ | |
| libxml2-dev \ | |
| libipc-run-perl \ | |
| pkg-config | |
| - name: Install macOS dependencies | |
| if: runner.os == 'macOS' | |
| run: | | |
| # GitHub macos-latest comes with most of these, but be explicit. | |
| brew install readline icu4c lz4 zstd openssl@3 libxml2 cpanminus pkg-config || true | |
| # IO::Tty + IPC::Run for PG TAP tests. | |
| cpanm --local-lib=$HOME/perl5 --notest IPC::Run IO::Tty | |
| # Export environment for subsequent steps. | |
| { | |
| echo "PERL5LIB=$HOME/perl5/lib/perl5" | |
| echo "PKG_CONFIG_PATH=$(brew --prefix icu4c)/lib/pkgconfig:$(brew --prefix openssl@3)/lib/pkgconfig:$(brew --prefix lz4)/lib/pkgconfig:$(brew --prefix zstd)/lib/pkgconfig" | |
| echo "LDFLAGS=-L$(brew --prefix readline)/lib -L$(brew --prefix zstd)/lib -L$(brew --prefix lz4)/lib -L$(brew --prefix openssl@3)/lib -L$(brew --prefix icu4c)/lib" | |
| echo "CPPFLAGS=-I$(brew --prefix readline)/include -I$(brew --prefix zstd)/include -I$(brew --prefix lz4)/include -I$(brew --prefix openssl@3)/include -I$(brew --prefix icu4c)/include" | |
| } >> $GITHUB_ENV | |
| # ---------------------------------------------------------------- | |
| # Configure (enable mode) | |
| # ---------------------------------------------------------------- | |
| - name: Configure | |
| run: | | |
| ./configure \ | |
| --prefix=$HOME/pgrac-install \ | |
| --enable-cassert --enable-debug \ | |
| --with-openssl --with-icu --with-lz4 --with-zstd \ | |
| --enable-cluster --enable-tap-tests | |
| - name: Build | |
| run: | | |
| if [ "$RUNNER_OS" = "Linux" ]; then | |
| make -j$(getconf _NPROCESSORS_ONLN) | |
| else | |
| make -j$(sysctl -n hw.ncpu) | |
| fi | |
| - name: Install | |
| run: make install | |
| # ---------------------------------------------------------------- | |
| # Stage 3: Test | |
| # ---------------------------------------------------------------- | |
| - name: Run PG regression tests (219 tests) | |
| run: make check | |
| - name: Run cluster-check (unit + tap + regress) | |
| run: make -C src/test cluster-check | |
| # ---------------------------------------------------------------- | |
| # On failure, surface key log files via artifacts | |
| # ---------------------------------------------------------------- | |
| - name: Upload regression diffs on failure | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: regression-diffs-${{ matrix.os }} | |
| path: | | |
| src/test/regress/regression.diffs | |
| src/test/regress/regression.out | |
| src/test/regress/log/ | |
| src/test/cluster_tap/tmp_check/log/ | |
| if-no-files-found: ignore | |
| retention-days: 7 | |
| # ==================================================================== | |
| # build-disable-mode: regression of native PG behavior | |
| # -------------------------------------------------------------------- | |
| # Build with --disable-cluster (default) and verify: | |
| # - PG 219 regression still passes (binary identical to upstream) | |
| # - postgres binary contains NO cluster symbols (proves the | |
| # --disable-cluster contract from spec-0.3) | |
| # ==================================================================== | |
| build-disable-mode: | |
| name: Build+Test (--disable-cluster regression) | |
| needs: validate | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update -y | |
| sudo apt-get install -y --no-install-recommends \ | |
| build-essential libreadline-dev zlib1g-dev libicu-dev \ | |
| liblz4-dev libzstd-dev libssl-dev libxml2-dev pkg-config | |
| - name: Configure (--disable-cluster) | |
| run: | | |
| ./configure \ | |
| --prefix=$HOME/pgrac-install \ | |
| --enable-cassert --enable-debug \ | |
| --with-openssl --with-icu --with-lz4 --with-zstd \ | |
| --disable-cluster | |
| - name: Build + Install | |
| run: | | |
| make -j$(getconf _NPROCESSORS_ONLN) | |
| make install | |
| - name: Run PG regression tests (must remain 219/219) | |
| run: make check | |
| - name: Verify postgres binary has NO cluster symbols | |
| run: | | |
| if nm $HOME/pgrac-install/bin/postgres | grep -E '\bcluster_init\b|\bcluster_shutdown\b|\bpgrac_version_string\b'; then | |
| echo "::error::Disable-mode binary unexpectedly contains cluster symbols" | |
| exit 1 | |
| fi | |
| echo "OK: no cluster symbols in disable-mode binary" | |
| # ==================================================================== | |
| # security-static-analysis: cppcheck (strict) + scan-build (warn-only) | |
| # -------------------------------------------------------------------- | |
| # Spec: pgrac/specs/spec-0.27.5-static-analysis.md (initial接入) | |
| # pgrac/specs/spec-0.30-stage0-acceptance.md §2.3 (strict 切换) | |
| # Design: pgrac/docs/ci-static-analysis.md | |
| # Scope: src/backend/cluster/ + src/include/cluster/ + | |
| # src/test/cluster_unit/ (avoid PG-upstream noise) | |
| # Mode (stage 0.30+): | |
| # - cppcheck: STRICT. scripts/ci/run-cppcheck.sh invokes | |
| # scripts/ci/baseline-diff.py at the end; any new finding vs the | |
| # stage-0 baseline (0 findings, established at spec-0.27.5 §6) | |
| # fails the step and the workflow. | |
| # - scan-build: still warn-only. scripts/ci/run-scan-build.sh wraps | |
| # scan-build with `|| true`, exit 0 regardless of findings; HTML | |
| # report uploaded as artifact for review. Strict切换 deferred | |
| # because scan-build HTML output is non-structured -- baseline | |
| # diff tooling complexity is higher than spec-0.30 budget. | |
| # ==================================================================== | |
| security-static-analysis: | |
| name: Security (cppcheck + scan-build) | |
| needs: validate | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| # Stage 0.30: continue-on-error removed; cppcheck regression fails CI. | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Install tools | |
| run: | | |
| sudo apt-get update -y | |
| sudo apt-get install -y --no-install-recommends \ | |
| cppcheck clang-tools python3 \ | |
| build-essential libreadline-dev zlib1g-dev libicu-dev \ | |
| liblz4-dev libzstd-dev libssl-dev libxml2-dev pkg-config | |
| cppcheck --version | |
| scan-build --help | head -5 | |
| - name: Configure (--enable-cluster) | |
| run: | | |
| ./configure \ | |
| --prefix=$HOME/pgrac-install \ | |
| --enable-cassert --enable-debug \ | |
| --with-openssl --with-icu --with-lz4 --with-zstd \ | |
| --enable-cluster | |
| - name: Generate headers (needed by cppcheck includes) | |
| run: make -C src/backend generated-headers | |
| - name: Run cppcheck | |
| id: cppcheck | |
| run: bash scripts/ci/run-cppcheck.sh | |
| # Always run scan-build even if cppcheck step had a setup error, | |
| # so the artifact carries both reports for review. The two tools | |
| # are independent. | |
| - name: Run scan-build | |
| if: always() && steps.cppcheck.conclusion != 'cancelled' | |
| run: bash scripts/ci/run-scan-build.sh | |
| - name: Upload SARIF / HTML reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: static-analysis-report | |
| path: | | |
| cppcheck.xml | |
| cppcheck-summary.txt | |
| scan-build-report/ | |
| if-no-files-found: warn | |
| retention-days: 30 |