python/cpython
Publicmirrored from https://github.com/python/cpythonAvailable
.github/workflows/build.yml
731lines · modecode
| 1 | name: Tests |
| 2 | |
| 3 | on: |
| 4 | workflow_dispatch: |
| 5 | push: |
| 6 | branches: |
| 7 | - 'main' |
| 8 | - '3.*' |
| 9 | pull_request: |
| 10 | branches: |
| 11 | - 'main' |
| 12 | - '3.*' |
| 13 | |
| 14 | permissions: |
| 15 | contents: read |
| 16 | |
| 17 | concurrency: |
| 18 | # https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#concurrency |
| 19 | # 'group' must be a key uniquely representing a PR or push event. |
| 20 | # github.workflow is the workflow name |
| 21 | # github.actor is the user invoking the workflow |
| 22 | # github.head_ref is the source branch of the PR or otherwise blank |
| 23 | # github.run_id is a unique number for the current run |
| 24 | group: ${{ github.workflow }}-${{ github.actor }}-${{ github.head_ref || github.run_id }} |
| 25 | cancel-in-progress: true |
| 26 | |
| 27 | env: |
| 28 | FORCE_COLOR: 1 |
| 29 | |
| 30 | jobs: |
| 31 | build-context: |
| 32 | name: Change detection |
| 33 | # To use boolean outputs from this job, parse them as JSON. |
| 34 | # Here's some examples: |
| 35 | # |
| 36 | # if: fromJSON(needs.build-context.outputs.run-docs) |
| 37 | # |
| 38 | # ${{ |
| 39 | # fromJSON(needs.build-context.outputs.run-tests) |
| 40 | # && 'truthy-branch' |
| 41 | # || 'falsy-branch' |
| 42 | # }} |
| 43 | # |
| 44 | uses: ./.github/workflows/reusable-context.yml |
| 45 | |
| 46 | check-docs: |
| 47 | name: Docs |
| 48 | needs: build-context |
| 49 | if: fromJSON(needs.build-context.outputs.run-docs) |
| 50 | uses: ./.github/workflows/reusable-docs.yml |
| 51 | |
| 52 | check-autoconf-regen: |
| 53 | name: 'Check if Autoconf files are up to date' |
| 54 | # Don't use ubuntu-latest but a specific version to make the job |
| 55 | # reproducible: to get the same tools versions (autoconf, aclocal, ...) |
| 56 | runs-on: ubuntu-24.04 |
| 57 | container: |
| 58 | image: ghcr.io/python/autoconf:2025.01.02.12581854023 |
| 59 | timeout-minutes: 60 |
| 60 | needs: build-context |
| 61 | if: needs.build-context.outputs.run-tests == 'true' |
| 62 | steps: |
| 63 | - name: Install Git |
| 64 | run: | |
| 65 | apt update && apt install git -yq |
| 66 | git config --global --add safe.directory "$GITHUB_WORKSPACE" |
| 67 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 68 | with: |
| 69 | fetch-depth: 1 |
| 70 | persist-credentials: false |
| 71 | - name: Check Autoconf and aclocal versions |
| 72 | run: | |
| 73 | grep "Generated by GNU Autoconf 2.72" configure |
| 74 | grep "aclocal 1.16.5" aclocal.m4 |
| 75 | grep -q "runstatedir" configure |
| 76 | grep -q "PKG_PROG_PKG_CONFIG" aclocal.m4 |
| 77 | - name: Regenerate autoconf files |
| 78 | # Same command used by Tools/build/regen-configure.sh ($AUTORECONF) |
| 79 | run: autoreconf -ivf -Werror |
| 80 | - name: Check for changes |
| 81 | run: | |
| 82 | git add -u |
| 83 | changes=$(git status --porcelain) |
| 84 | # Check for changes in regenerated files |
| 85 | if test -n "$changes"; then |
| 86 | echo "Generated files not up to date." |
| 87 | echo "Perhaps you forgot to run make regen-configure ;)" |
| 88 | echo "configure files must be regenerated with a specific version of autoconf." |
| 89 | echo "$changes" |
| 90 | echo "" |
| 91 | git diff --staged || true |
| 92 | exit 1 |
| 93 | fi |
| 94 | |
| 95 | check-generated-files: |
| 96 | name: 'Check if generated files are up to date' |
| 97 | # Don't use ubuntu-latest but a specific version to make the job |
| 98 | # reproducible: to get the same tools versions (autoconf, aclocal, ...) |
| 99 | runs-on: ubuntu-24.04 |
| 100 | timeout-minutes: 60 |
| 101 | needs: build-context |
| 102 | if: needs.build-context.outputs.run-tests == 'true' |
| 103 | steps: |
| 104 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 105 | with: |
| 106 | persist-credentials: false |
| 107 | - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 |
| 108 | with: |
| 109 | python-version: '3.x' |
| 110 | - name: Runner image version |
| 111 | run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV" |
| 112 | - name: Install dependencies |
| 113 | run: sudo ./.github/workflows/posix-deps-apt.sh |
| 114 | - name: Configure CPython |
| 115 | run: | |
| 116 | # Build Python with the libpython dynamic library |
| 117 | ./configure --config-cache --with-pydebug --enable-shared |
| 118 | - name: Build CPython |
| 119 | run: | |
| 120 | make -j4 regen-all |
| 121 | make regen-stdlib-module-names regen-sbom |
| 122 | - name: Check for changes |
| 123 | run: | |
| 124 | git add -u |
| 125 | changes=$(git status --porcelain) |
| 126 | # Check for changes in regenerated files |
| 127 | if test -n "$changes"; then |
| 128 | echo "Generated files not up to date." |
| 129 | echo "Perhaps you forgot to run make regen-all or build.bat --regen. ;)" |
| 130 | echo "configure files must be regenerated with a specific version of autoconf." |
| 131 | echo "$changes" |
| 132 | echo "" |
| 133 | git diff --staged || true |
| 134 | exit 1 |
| 135 | fi |
| 136 | - name: Check exported libpython symbols |
| 137 | run: make smelly |
| 138 | - name: Check limited ABI symbols |
| 139 | run: make check-limited-abi |
| 140 | - name: Check for unsupported C global variables |
| 141 | if: github.event_name == 'pull_request' # $GITHUB_EVENT_NAME |
| 142 | run: make check-c-globals |
| 143 | |
| 144 | check-c-api-docs: |
| 145 | name: C API Docs |
| 146 | needs: build-context |
| 147 | if: >- |
| 148 | needs.build-context.outputs.run-tests == 'true' |
| 149 | || needs.build-context.outputs.run-docs == 'true' |
| 150 | uses: ./.github/workflows/reusable-check-c-api-docs.yml |
| 151 | |
| 152 | build-windows: |
| 153 | name: >- |
| 154 | Windows |
| 155 | ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }} |
| 156 | needs: build-context |
| 157 | if: fromJSON(needs.build-context.outputs.run-windows-tests) |
| 158 | strategy: |
| 159 | fail-fast: false |
| 160 | matrix: |
| 161 | arch: |
| 162 | - x64 |
| 163 | - Win32 |
| 164 | - arm64 |
| 165 | free-threading: |
| 166 | - false |
| 167 | - true |
| 168 | interpreter: |
| 169 | - switch-case |
| 170 | exclude: |
| 171 | # Skip Win32 on free-threaded builds |
| 172 | - { arch: Win32, free-threading: true } |
| 173 | include: |
| 174 | # msvc::musttail is currently only supported on x64, |
| 175 | # and only supported on 3.15+. |
| 176 | - { arch: x64, free-threading: false, interpreter: tail-call } |
| 177 | - { arch: x64, free-threading: true, interpreter: tail-call } |
| 178 | uses: ./.github/workflows/reusable-windows.yml |
| 179 | with: |
| 180 | arch: ${{ matrix.arch }} |
| 181 | free-threading: ${{ matrix.free-threading }} |
| 182 | interpreter: ${{ matrix.interpreter }} |
| 183 | |
| 184 | build-windows-msi: |
| 185 | # ${{ '' } is a hack to nest jobs under the same sidebar category. |
| 186 | name: Windows MSI${{ '' }} # zizmor: ignore[obfuscation] |
| 187 | needs: build-context |
| 188 | if: fromJSON(needs.build-context.outputs.run-windows-msi) |
| 189 | strategy: |
| 190 | fail-fast: false |
| 191 | matrix: |
| 192 | arch: |
| 193 | - x86 |
| 194 | - x64 |
| 195 | - arm64 |
| 196 | uses: ./.github/workflows/reusable-windows-msi.yml |
| 197 | with: |
| 198 | arch: ${{ matrix.arch }} |
| 199 | |
| 200 | build-macos: |
| 201 | name: >- |
| 202 | macOS |
| 203 | ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }} |
| 204 | needs: build-context |
| 205 | if: needs.build-context.outputs.run-macos == 'true' |
| 206 | strategy: |
| 207 | fail-fast: false |
| 208 | matrix: |
| 209 | # macos-26 is Apple Silicon, macos-26-intel is Intel. |
| 210 | # macos-26-intel only runs tests against the GIL-enabled CPython. |
| 211 | os: |
| 212 | - macos-26 |
| 213 | - macos-26-intel |
| 214 | free-threading: |
| 215 | - false |
| 216 | - true |
| 217 | exclude: |
| 218 | - os: macos-26-intel |
| 219 | free-threading: true |
| 220 | uses: ./.github/workflows/reusable-macos.yml |
| 221 | with: |
| 222 | free-threading: ${{ matrix.free-threading }} |
| 223 | os: ${{ matrix.os }} |
| 224 | |
| 225 | build-ubuntu: |
| 226 | name: >- |
| 227 | Ubuntu |
| 228 | ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }} |
| 229 | ${{ fromJSON(matrix.bolt) && '(bolt)' || '' }} |
| 230 | needs: build-context |
| 231 | if: needs.build-context.outputs.run-ubuntu == 'true' |
| 232 | strategy: |
| 233 | fail-fast: false |
| 234 | matrix: |
| 235 | bolt: |
| 236 | - false |
| 237 | - true |
| 238 | free-threading: |
| 239 | - false |
| 240 | - true |
| 241 | os: |
| 242 | - ubuntu-24.04 |
| 243 | - ubuntu-24.04-arm |
| 244 | exclude: |
| 245 | # Do not test BOLT with free-threading, to conserve resources |
| 246 | - bolt: true |
| 247 | free-threading: true |
| 248 | # BOLT currently crashes during instrumentation on aarch64 |
| 249 | - os: ubuntu-24.04-arm |
| 250 | bolt: true |
| 251 | include: |
| 252 | # Enable CPU-intensive tests on ARM (default build only) |
| 253 | - os: ubuntu-24.04-arm |
| 254 | bolt: false |
| 255 | free-threading: false |
| 256 | test-opts: '-u cpu' |
| 257 | uses: ./.github/workflows/reusable-ubuntu.yml |
| 258 | with: |
| 259 | bolt-optimizations: ${{ matrix.bolt }} |
| 260 | free-threading: ${{ matrix.free-threading }} |
| 261 | os: ${{ matrix.os }} |
| 262 | test-opts: ${{ matrix.test-opts || '' }} |
| 263 | |
| 264 | build-ubuntu-ssltests: |
| 265 | name: 'Ubuntu SSL tests' |
| 266 | runs-on: ${{ matrix.os }} |
| 267 | timeout-minutes: 60 |
| 268 | needs: build-context |
| 269 | if: needs.build-context.outputs.run-ubuntu == 'true' |
| 270 | strategy: |
| 271 | fail-fast: false |
| 272 | matrix: |
| 273 | os: [ubuntu-24.04] |
| 274 | ssllib: |
| 275 | # See Tools/ssl/make_ssl_data.py for notes on adding a new version |
| 276 | ## OpenSSL |
| 277 | # Keep 1.1.1w in our list despite it being upstream EOL and otherwise |
| 278 | # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs |
| 279 | # supported by important vendors such as AWS-LC. |
| 280 | - { name: openssl, version: 1.1.1w } |
| 281 | - { name: openssl, version: 3.0.21 } |
| 282 | - { name: openssl, version: 3.4.6 } |
| 283 | - { name: openssl, version: 3.5.7 } |
| 284 | - { name: openssl, version: 3.6.3 } |
| 285 | - { name: openssl, version: 4.0.1 } |
| 286 | ## AWS-LC |
| 287 | - { name: aws-lc, version: 5.0.0 } |
| 288 | env: |
| 289 | SSLLIB_VER: ${{ matrix.ssllib.version }} |
| 290 | MULTISSL_DIR: ${{ github.workspace }}/multissl |
| 291 | SSLLIB_DIR: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }} |
| 292 | LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}/lib |
| 293 | steps: |
| 294 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 295 | with: |
| 296 | persist-credentials: false |
| 297 | - name: Runner image version |
| 298 | run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV" |
| 299 | - name: Register gcc problem matcher |
| 300 | run: echo "::add-matcher::.github/problem-matchers/gcc.json" |
| 301 | - name: Install dependencies |
| 302 | run: sudo ./.github/workflows/posix-deps-apt.sh |
| 303 | - name: 'Restore SSL library build' |
| 304 | id: cache-ssl-lib |
| 305 | uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 |
| 306 | with: |
| 307 | path: ./multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }} |
| 308 | key: ${{ matrix.os }}-multissl-${{ matrix.ssllib.name }}-${{ matrix.ssllib.version }} |
| 309 | - name: Install SSL Library |
| 310 | if: steps.cache-ssl-lib.outputs.cache-hit != 'true' |
| 311 | run: | |
| 312 | python3 Tools/ssl/multissltests.py \ |
| 313 | --steps=library \ |
| 314 | --base-directory "$MULTISSL_DIR" \ |
| 315 | '--${{ matrix.ssllib.name }}' '${{ matrix.ssllib.version }}' \ |
| 316 | --system Linux |
| 317 | - name: Configure CPython |
| 318 | run: | |
| 319 | ./configure CFLAGS="-fdiagnostics-format=json" \ |
| 320 | --config-cache \ |
| 321 | --enable-slower-safety \ |
| 322 | --with-pydebug \ |
| 323 | --with-openssl="$SSLLIB_DIR" \ |
| 324 | --with-builtin-hashlib-hashes=blake2 \ |
| 325 | --with-ssl-default-suites=openssl |
| 326 | - name: Build CPython |
| 327 | run: make -j4 |
| 328 | - name: Display build info |
| 329 | run: make pythoninfo |
| 330 | - name: Verify python is linked to the right lib |
| 331 | run: | |
| 332 | ./python -c 'import ssl; print(ssl.OPENSSL_VERSION)' \ |
| 333 | | grep -iE '${{ matrix.ssllib.name }}.*${{ matrix.ssllib.version }}' |
| 334 | - name: SSL tests |
| 335 | run: ./python Lib/test/ssltests.py |
| 336 | |
| 337 | build-android: |
| 338 | name: Android (${{ matrix.arch }}) |
| 339 | needs: build-context |
| 340 | if: needs.build-context.outputs.run-android == 'true' |
| 341 | timeout-minutes: 60 |
| 342 | strategy: |
| 343 | fail-fast: false |
| 344 | matrix: |
| 345 | include: |
| 346 | - arch: aarch64 |
| 347 | runs-on: macos-26 |
| 348 | - arch: x86_64 |
| 349 | runs-on: ubuntu-24.04 |
| 350 | |
| 351 | runs-on: ${{ matrix.runs-on }} |
| 352 | steps: |
| 353 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 354 | with: |
| 355 | persist-credentials: false |
| 356 | - name: Build and test |
| 357 | run: python3 Platforms/Android ci --fast-ci ${{ matrix.arch }}-linux-android |
| 358 | |
| 359 | build-ios: |
| 360 | name: iOS |
| 361 | needs: build-context |
| 362 | if: needs.build-context.outputs.run-ios == 'true' |
| 363 | timeout-minutes: 60 |
| 364 | runs-on: macos-14 |
| 365 | steps: |
| 366 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 367 | with: |
| 368 | persist-credentials: false |
| 369 | |
| 370 | # GitHub recommends explicitly selecting the desired Xcode version: |
| 371 | # https://github.com/actions/runner-images/issues/12541#issuecomment-3083850140 |
| 372 | # This became a necessity as a result of |
| 373 | # https://github.com/actions/runner-images/issues/12541 and |
| 374 | # https://github.com/actions/runner-images/issues/12751. |
| 375 | - name: Select Xcode version |
| 376 | run: | |
| 377 | sudo xcode-select --switch /Applications/Xcode_15.4.app |
| 378 | |
| 379 | - name: Build and test |
| 380 | run: python3 Platforms/Apple ci iOS --fast-ci --simulator 'iPhone SE (3rd generation),OS=17.5' |
| 381 | |
| 382 | build-emscripten: |
| 383 | name: 'Emscripten' |
| 384 | needs: build-context |
| 385 | if: needs.build-context.outputs.run-emscripten == 'true' |
| 386 | uses: ./.github/workflows/reusable-emscripten.yml |
| 387 | |
| 388 | build-wasi: |
| 389 | name: 'WASI' |
| 390 | needs: build-context |
| 391 | if: needs.build-context.outputs.run-wasi == 'true' |
| 392 | uses: ./.github/workflows/reusable-wasi.yml |
| 393 | |
| 394 | test-hypothesis: |
| 395 | name: "Hypothesis tests on Ubuntu" |
| 396 | runs-on: ubuntu-24.04 |
| 397 | timeout-minutes: 60 |
| 398 | needs: build-context |
| 399 | if: needs.build-context.outputs.run-ubuntu == 'true' |
| 400 | env: |
| 401 | OPENSSL_VER: 3.5.7 |
| 402 | PYTHONSTRICTEXTENSIONBUILD: 1 |
| 403 | steps: |
| 404 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 405 | with: |
| 406 | persist-credentials: false |
| 407 | - name: Register gcc problem matcher |
| 408 | run: echo "::add-matcher::.github/problem-matchers/gcc.json" |
| 409 | - name: Install dependencies |
| 410 | run: sudo ./.github/workflows/posix-deps-apt.sh |
| 411 | - name: Configure OpenSSL env vars |
| 412 | run: | |
| 413 | echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV" |
| 414 | echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV" |
| 415 | echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV" |
| 416 | - name: 'Restore OpenSSL build' |
| 417 | id: cache-openssl |
| 418 | uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 |
| 419 | with: |
| 420 | path: ./multissl/openssl/${{ env.OPENSSL_VER }} |
| 421 | key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }} |
| 422 | - name: Install OpenSSL |
| 423 | if: steps.cache-openssl.outputs.cache-hit != 'true' |
| 424 | run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux |
| 425 | - name: Setup directory envs for out-of-tree builds |
| 426 | run: | |
| 427 | echo "CPYTHON_RO_SRCDIR=$(realpath -m "${GITHUB_WORKSPACE}"/../cpython-ro-srcdir)" >> "$GITHUB_ENV" |
| 428 | echo "CPYTHON_BUILDDIR=$(realpath -m "${GITHUB_WORKSPACE}"/../cpython-builddir)" >> "$GITHUB_ENV" |
| 429 | - name: Create directories for read-only out-of-tree builds |
| 430 | run: mkdir -p "$CPYTHON_RO_SRCDIR" "$CPYTHON_BUILDDIR" |
| 431 | - name: Bind mount sources read-only |
| 432 | run: sudo mount --bind -o ro "$GITHUB_WORKSPACE" "$CPYTHON_RO_SRCDIR" |
| 433 | - name: Runner image version |
| 434 | run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV" |
| 435 | - name: Configure CPython out-of-tree |
| 436 | working-directory: ${{ env.CPYTHON_BUILDDIR }} |
| 437 | run: | |
| 438 | ../cpython-ro-srcdir/configure \ |
| 439 | --config-cache \ |
| 440 | --with-pydebug \ |
| 441 | --enable-slower-safety \ |
| 442 | --with-openssl="$OPENSSL_DIR" |
| 443 | - name: Build CPython out-of-tree |
| 444 | working-directory: ${{ env.CPYTHON_BUILDDIR }} |
| 445 | run: make -j4 |
| 446 | - name: Display build info |
| 447 | working-directory: ${{ env.CPYTHON_BUILDDIR }} |
| 448 | run: make pythoninfo |
| 449 | - name: Remount sources writable for tests |
| 450 | # some tests write to srcdir, lack of pyc files slows down testing |
| 451 | run: sudo mount "$CPYTHON_RO_SRCDIR" -oremount,rw |
| 452 | - name: Setup directory envs for out-of-tree builds |
| 453 | run: | |
| 454 | echo "CPYTHON_BUILDDIR=$(realpath -m "${GITHUB_WORKSPACE}"/../cpython-builddir)" >> "$GITHUB_ENV" |
| 455 | - name: "Create hypothesis venv" |
| 456 | working-directory: ${{ env.CPYTHON_BUILDDIR }} |
| 457 | run: | |
| 458 | VENV_LOC=$(realpath -m .)/hypovenv |
| 459 | VENV_PYTHON=$VENV_LOC/bin/python |
| 460 | echo "HYPOVENV=${VENV_LOC}" >> "$GITHUB_ENV" |
| 461 | echo "VENV_PYTHON=${VENV_PYTHON}" >> "$GITHUB_ENV" |
| 462 | ./python -m venv "$VENV_LOC" && "$VENV_PYTHON" -m pip install -r "${GITHUB_WORKSPACE}/Tools/requirements-hypothesis.txt" |
| 463 | - name: 'Restore Hypothesis database' |
| 464 | id: cache-hypothesis-database |
| 465 | uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 |
| 466 | with: |
| 467 | path: ${{ env.CPYTHON_BUILDDIR }}/.hypothesis/ |
| 468 | key: hypothesis-database-${{ github.head_ref || github.run_id }} |
| 469 | restore-keys: | |
| 470 | hypothesis-database- |
| 471 | - name: "Run tests" |
| 472 | working-directory: ${{ env.CPYTHON_BUILDDIR }} |
| 473 | run: | |
| 474 | # Most of the excluded tests are slow test suites with no property tests |
| 475 | # |
| 476 | # (GH-104097) test_sysconfig is skipped because it has tests that are |
| 477 | # failing when executed from inside a virtual environment. |
| 478 | "${VENV_PYTHON}" -m test \ |
| 479 | -W \ |
| 480 | --slowest \ |
| 481 | -j4 \ |
| 482 | --timeout 900 \ |
| 483 | -x test_asyncio \ |
| 484 | -x test_multiprocessing_fork \ |
| 485 | -x test_multiprocessing_forkserver \ |
| 486 | -x test_multiprocessing_spawn \ |
| 487 | -x test_concurrent_futures \ |
| 488 | -x test_socket \ |
| 489 | -x test_subprocess \ |
| 490 | -x test_signal \ |
| 491 | -x test_sysconfig |
| 492 | - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 |
| 493 | if: always() |
| 494 | with: |
| 495 | name: hypothesis-example-db |
| 496 | path: ${{ env.CPYTHON_BUILDDIR }}/.hypothesis/examples/ |
| 497 | |
| 498 | build-asan: |
| 499 | name: 'Address sanitizer' |
| 500 | runs-on: ${{ matrix.os }} |
| 501 | timeout-minutes: 60 |
| 502 | needs: build-context |
| 503 | if: needs.build-context.outputs.run-ubuntu == 'true' |
| 504 | strategy: |
| 505 | fail-fast: false |
| 506 | matrix: |
| 507 | os: [ubuntu-24.04] |
| 508 | env: |
| 509 | OPENSSL_VER: 3.5.7 |
| 510 | PYTHONSTRICTEXTENSIONBUILD: 1 |
| 511 | ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0 |
| 512 | steps: |
| 513 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 514 | with: |
| 515 | persist-credentials: false |
| 516 | - name: Runner image version |
| 517 | run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV" |
| 518 | - name: Register gcc problem matcher |
| 519 | run: echo "::add-matcher::.github/problem-matchers/gcc.json" |
| 520 | - name: Install dependencies |
| 521 | run: sudo ./.github/workflows/posix-deps-apt.sh |
| 522 | - name: Set up GCC-10 for ASAN |
| 523 | uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0 |
| 524 | with: |
| 525 | version: 10 |
| 526 | - name: Configure OpenSSL env vars |
| 527 | run: | |
| 528 | echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV" |
| 529 | echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV" |
| 530 | echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV" |
| 531 | - name: 'Restore OpenSSL build' |
| 532 | id: cache-openssl |
| 533 | uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 |
| 534 | with: |
| 535 | path: ./multissl/openssl/${{ env.OPENSSL_VER }} |
| 536 | key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }} |
| 537 | - name: Install OpenSSL |
| 538 | if: steps.cache-openssl.outputs.cache-hit != 'true' |
| 539 | run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux |
| 540 | - name: Configure CPython |
| 541 | run: ./configure --config-cache --with-address-sanitizer --without-pymalloc --with-openssl="$OPENSSL_DIR" |
| 542 | - name: Build CPython |
| 543 | run: make -j4 |
| 544 | - name: Display build info |
| 545 | run: make pythoninfo |
| 546 | - name: Tests |
| 547 | run: xvfb-run make ci |
| 548 | |
| 549 | build-san: |
| 550 | # ${{ '' } is a hack to nest jobs under the same sidebar category. |
| 551 | name: Sanitizers${{ '' }} # zizmor: ignore[obfuscation] |
| 552 | needs: build-context |
| 553 | if: needs.build-context.outputs.run-ubuntu == 'true' |
| 554 | strategy: |
| 555 | fail-fast: false |
| 556 | matrix: |
| 557 | check-name: |
| 558 | - Thread |
| 559 | free-threading: |
| 560 | - false |
| 561 | - true |
| 562 | sanitizer: |
| 563 | - TSan |
| 564 | include: |
| 565 | - check-name: Undefined behavior |
| 566 | sanitizer: UBSan |
| 567 | free-threading: false |
| 568 | uses: ./.github/workflows/reusable-san.yml |
| 569 | with: |
| 570 | sanitizer: ${{ matrix.sanitizer }} |
| 571 | free-threading: ${{ matrix.free-threading }} |
| 572 | |
| 573 | cross-build-linux: |
| 574 | name: Cross build Linux |
| 575 | runs-on: ubuntu-latest |
| 576 | timeout-minutes: 60 |
| 577 | needs: build-context |
| 578 | if: needs.build-context.outputs.run-ubuntu == 'true' |
| 579 | steps: |
| 580 | - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 581 | with: |
| 582 | persist-credentials: false |
| 583 | - name: Runner image version |
| 584 | run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV" |
| 585 | - name: Register gcc problem matcher |
| 586 | run: echo "::add-matcher::.github/problem-matchers/gcc.json" |
| 587 | - name: Set build dir |
| 588 | run: |
| 589 | # an absolute path outside of the working directoy |
| 590 | echo "BUILD_DIR=$(realpath ${{ github.workspace }}/../build)" >> "$GITHUB_ENV" |
| 591 | - name: Install dependencies |
| 592 | run: sudo ./.github/workflows/posix-deps-apt.sh |
| 593 | - name: Configure host build |
| 594 | run: ./configure --prefix="$BUILD_DIR/host-python" |
| 595 | - name: Install host Python |
| 596 | run: make -j8 install |
| 597 | - name: Run test subset with host build |
| 598 | run: | |
| 599 | "$BUILD_DIR/host-python/bin/python3" -m test test_sysconfig test_site test_embed |
| 600 | - name: Configure cross build |
| 601 | run: ./configure --prefix="$BUILD_DIR/cross-python" --with-build-python="$BUILD_DIR/host-python/bin/python3" |
| 602 | - name: Install cross Python |
| 603 | run: make -j8 install |
| 604 | - name: Display build info |
| 605 | run: | |
| 606 | "$BUILD_DIR/cross-python/bin/python3" -m test.pythoninfo |
| 607 | - name: Run test subset with host build |
| 608 | run: | |
| 609 | "$BUILD_DIR/cross-python/bin/python3" -m test test_sysconfig test_site test_embed |
| 610 | |
| 611 | cifuzz: |
| 612 | # ${{ '' } is a hack to nest jobs under the same sidebar category. |
| 613 | name: CIFuzz${{ '' }} # zizmor: ignore[obfuscation] |
| 614 | needs: build-context |
| 615 | if: >- |
| 616 | needs.build-context.outputs.run-ci-fuzz == 'true' |
| 617 | || needs.build-context.outputs.run-ci-fuzz-stdlib == 'true' |
| 618 | permissions: |
| 619 | contents: read |
| 620 | security-events: write |
| 621 | strategy: |
| 622 | fail-fast: false |
| 623 | matrix: |
| 624 | sanitizer: |
| 625 | - address |
| 626 | oss-fuzz-project-name: |
| 627 | - cpython3 |
| 628 | - python3-libraries |
| 629 | include: |
| 630 | - sanitizer: undefined |
| 631 | oss-fuzz-project-name: cpython3 |
| 632 | - sanitizer: memory |
| 633 | oss-fuzz-project-name: cpython3 |
| 634 | exclude: |
| 635 | # Note that the 'no-exclude' sentinel below is to prevent |
| 636 | # an empty string value from excluding all jobs and causing |
| 637 | # GHA to create a 'default' matrix entry with all empty values. |
| 638 | - oss-fuzz-project-name: >- |
| 639 | ${{ |
| 640 | needs.build-context.outputs.run-ci-fuzz == 'true' |
| 641 | && 'no-exclude' |
| 642 | || 'cpython3' |
| 643 | }} |
| 644 | - oss-fuzz-project-name: >- |
| 645 | ${{ |
| 646 | needs.build-context.outputs.run-ci-fuzz-stdlib == 'true' |
| 647 | && 'no-exclude' |
| 648 | || 'python3-libraries' |
| 649 | }} |
| 650 | uses: ./.github/workflows/reusable-cifuzz.yml |
| 651 | with: |
| 652 | oss-fuzz-project-name: ${{ matrix.oss-fuzz-project-name }} |
| 653 | sanitizer: ${{ matrix.sanitizer }} |
| 654 | |
| 655 | all-required-green: # This job does nothing and is only used for the branch protection |
| 656 | name: All required checks pass |
| 657 | runs-on: ubuntu-latest |
| 658 | timeout-minutes: 5 |
| 659 | needs: |
| 660 | - build-context # Transitive dependency, needed to access `run-tests` value |
| 661 | - check-docs |
| 662 | - check-autoconf-regen |
| 663 | - check-generated-files |
| 664 | - check-c-api-docs |
| 665 | - build-windows |
| 666 | - build-windows-msi |
| 667 | - build-macos |
| 668 | - build-ubuntu |
| 669 | - build-ubuntu-ssltests |
| 670 | - build-ios |
| 671 | - build-emscripten |
| 672 | - build-wasi |
| 673 | - test-hypothesis |
| 674 | - build-asan |
| 675 | - build-san |
| 676 | - cross-build-linux |
| 677 | - cifuzz |
| 678 | if: always() |
| 679 | |
| 680 | steps: |
| 681 | - name: Check whether the needed jobs succeeded or failed |
| 682 | uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe |
| 683 | with: |
| 684 | allowed-failures: >- |
| 685 | build-android, |
| 686 | build-emscripten, |
| 687 | build-windows-msi, |
| 688 | build-ubuntu-ssltests, |
| 689 | test-hypothesis, |
| 690 | cifuzz, |
| 691 | allowed-skips: >- |
| 692 | ${{ !fromJSON(needs.build-context.outputs.run-docs) && 'check-docs,' || '' }} |
| 693 | ${{ |
| 694 | needs.build-context.outputs.run-tests != 'true' |
| 695 | && ' |
| 696 | check-autoconf-regen, |
| 697 | check-generated-files, |
| 698 | ' |
| 699 | || '' |
| 700 | }} |
| 701 | ${{ |
| 702 | !fromJSON(needs.build-context.outputs.run-tests) |
| 703 | && !fromJSON(needs.build-context.outputs.run-docs) |
| 704 | && 'check-c-api-docs,' |
| 705 | || '' |
| 706 | }} |
| 707 | ${{ !fromJSON(needs.build-context.outputs.run-windows-tests) && 'build-windows,' || '' }} |
| 708 | ${{ |
| 709 | !fromJSON(needs.build-context.outputs.run-ci-fuzz) |
| 710 | && !fromJSON(needs.build-context.outputs.run-ci-fuzz-stdlib) |
| 711 | && 'cifuzz,' || |
| 712 | '' |
| 713 | }} |
| 714 | ${{ !fromJSON(needs.build-context.outputs.run-macos) && 'build-macos,' || '' }} |
| 715 | ${{ |
| 716 | !fromJSON(needs.build-context.outputs.run-ubuntu) |
| 717 | && ' |
| 718 | build-ubuntu, |
| 719 | build-ubuntu-ssltests, |
| 720 | test-hypothesis, |
| 721 | build-asan, |
| 722 | build-san, |
| 723 | cross-build-linux, |
| 724 | ' |
| 725 | || '' |
| 726 | }} |
| 727 | ${{ !fromJSON(needs.build-context.outputs.run-android) && 'build-android,' || '' }} |
| 728 | ${{ !fromJSON(needs.build-context.outputs.run-ios) && 'build-ios,' || '' }} |
| 729 | ${{ !fromJSON(needs.build-context.outputs.run-emscripten) && 'build-emscripten,' || '' }} |
| 730 | ${{ !fromJSON(needs.build-context.outputs.run-wasi) && 'build-wasi,' || '' }} |
| 731 | jobs: ${{ toJSON(needs) }} |
| 732 | |