Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
94 lines
3.5 KiB
YAML
94 lines
3.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
# Documentation-only or local agent state changes do not trigger CI jobs.
|
|
pull_request:
|
|
paths-ignore: ['**.md', 'docs/**', 'LICENSE*', '.gitignore', '.githooks/**', '.wolf/**', '.claude/**', '.opencode/**', '.codex/**', '.cursor/**', '.superpowers/**', '.superset/**', '.gitea/ISSUE_TEMPLATE/**', 'scripts/release-notes.sh', '.gitea/workflows/release.yml']
|
|
workflow_call:
|
|
|
|
concurrency:
|
|
group: ci-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUSTFLAGS: -D warnings
|
|
# The runner persists /opt/hostedtoolcache across jobs: rustup toolchains,
|
|
# cargo registry, npm/apt caches, and target directories live there so nothing
|
|
# is re-downloaded or rebuilt from scratch on every run. Each job uses its own
|
|
# target directory so differing RUSTFLAGS do not invalidate another job's cache.
|
|
CARGO_HOME: /opt/hostedtoolcache/cargo
|
|
RUSTUP_HOME: /opt/hostedtoolcache/rustup
|
|
NPM_CONFIG_CACHE: /opt/hostedtoolcache/npm-cache
|
|
# Prebuilt libduckdb (scripts/fetch-libduckdb.sh), cached on the persistent
|
|
# runner volume. Every CI job runs on linux-arm64.
|
|
DUCKDB_LIB_DIR: /opt/hostedtoolcache/duckdb/linux-arm64
|
|
DUCKDB_INCLUDE_DIR: /opt/hostedtoolcache/duckdb/linux-arm64
|
|
LD_LIBRARY_PATH: /opt/hostedtoolcache/duckdb/linux-arm64
|
|
|
|
jobs:
|
|
lint:
|
|
name: Format and clippy
|
|
runs-on: linux-arm64
|
|
env:
|
|
CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/acaua-lint
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 22
|
|
- name: UI translation coverage
|
|
run: node scripts/check-ui-i18n.mjs
|
|
- name: Prebuilt libduckdb
|
|
run: |
|
|
command -v unzip >/dev/null || scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/unzip unzip
|
|
scripts/fetch-libduckdb.sh "$DUCKDB_LIB_DIR"
|
|
- run: cargo fmt --all -- --check
|
|
- run: cargo clippy --workspace --all-targets
|
|
|
|
# Linux-only runner (ARM64).
|
|
test:
|
|
name: Tests (Linux)
|
|
runs-on: linux-arm64
|
|
env:
|
|
CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/acaua-test
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- name: Prebuilt libduckdb
|
|
run: |
|
|
command -v unzip >/dev/null || scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/unzip unzip
|
|
scripts/fetch-libduckdb.sh "$DUCKDB_LIB_DIR"
|
|
- run: cargo test --workspace
|
|
|
|
audit:
|
|
name: Dependency audit
|
|
runs-on: linux-arm64
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
# rustsec/audit-check depends on GitHub's checks API. cargo-audit itself
|
|
# needs nothing but the advisory database, and installing it once into the
|
|
# persistent CARGO_HOME makes every later run skip compilation.
|
|
- name: cargo audit
|
|
run: |
|
|
command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
|
|
cargo audit
|
|
|
|
image:
|
|
name: Docker image (build and smoke test)
|
|
if: ${{ gitea.event_name == 'pull_request' }}
|
|
runs-on: linux-arm64
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- name: Build
|
|
run: docker build -t "acaua-ci:${{ gitea.run_id }}" .
|
|
- name: Smoke test
|
|
run: scripts/smoke-image.sh "acaua-ci:${{ gitea.run_id }}"
|
|
- name: Clean up
|
|
if: always()
|
|
run: docker rmi -f "acaua-ci:${{ gitea.run_id }}" >/dev/null 2>&1 || true
|