github: Migrate from Travis CI to Github Actions

On travis-ci.com (travis-ci.org will be discontinued by the end of the year) we are now charged for each minute. We only got 10000 credits in a trial plan, which we used up with a few builds. Minutes also cost a different amount of credits on different platforms: 10 on Linux, but 50 on macOS (installing the dependencies on macOS alone took 12-15 minutes on Travis for some reason, takes about half on Github's runners). No native Windows build yet as we have the same issue as on AppVeyor where threading/streaming tests might get stuck. And there is also only a single Windows platform to test on. Plus building/testing on Windows is very slow (and getting ccache to work seems tricky). The 'sw_collector' test case had to be disabled because we can't access /usr/local/share on the Github build hosts (the process is just blocked in readdir() and eventually times out). Unfortunately, we can't test on different architectures anymore (in particular ARM and the big-endian IBM Z/x390x).
2020-12-15 10:42:43 +01:00
parent eb4cd8e3b1
commit de401e0e89
10 changed files with 396 additions and 187 deletions
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Build script for Travis CI
+# Build script for CI

 build_botan()
 {
@@ -88,8 +88,8 @@ build_tss2()
 	cd -
 }

-: ${TRAVIS_BUILD_DIR=$PWD}
-: ${DEPS_BUILD_DIR=$TRAVIS_BUILD_DIR/..}
+: ${BUILD_DIR=$PWD}
+: ${DEPS_BUILD_DIR=$BUILD_DIR/..}
 : ${DEPS_PREFIX=/usr/local}

 TARGET=check
@@ -140,26 +140,25 @@ all|coverage|sonarcloud)
 			--disable-osx-attr --disable-tkm --disable-uci
 			--disable-unwind-backtraces
 			--disable-svc --disable-dbghelp-backtraces --disable-socket-win
-			--disable-kernel-wfp --disable-kernel-iph --disable-winhttp"
+			--disable-kernel-wfp --disable-kernel-iph --disable-winhttp
+			--disable-python-eggs-install"
 	# not enabled on the build server
 	CONFIG="$CONFIG --disable-af-alg"
-	if test "$TRAVIS_CPU_ARCH" != "amd64"; then
-		CONFIG="$CONFIG --disable-aesni --disable-rdrand"
-	fi
 	if test "$TEST" != "coverage"; then
 		CONFIG="$CONFIG --disable-coverage"
 	else
 		# not actually required but configure checks for it
 		DEPS="$DEPS lcov"
 	fi
-	# Botan requires GCC 5.0, so disable it on Ubuntu 16.04
+	# Botan requires newer compilers, so disable it on Ubuntu 16.04
 	if test -n "$UBUNTU_XENIAL"; then
 		CONFIG="$CONFIG --disable-botan"
 	fi
 	DEPS="$DEPS libcurl4-gnutls-dev libsoup2.4-dev libunbound-dev libldns-dev
 		  libmysqlclient-dev libsqlite3-dev clearsilver-dev libfcgi-dev
-		  libpcsclite-dev libpam0g-dev binutils-dev libnm-dev libgcrypt20-dev
-		  libjson-c-dev iptables-dev python-pip libtspi-dev libsystemd-dev"
+		  libldap2-dev libpcsclite-dev libpam0g-dev binutils-dev libnm-dev
+		  libgcrypt20-dev libjson-c-dev iptables-dev python-pip libtspi-dev
+		  libsystemd-dev"
 	PYDEPS="tox"
 	if test "$1" = "build-deps"; then
 		if test -z "$UBUNTU_XENIAL"; then
@@ -183,7 +182,6 @@ win*)
 	# no make check for Windows binaries unless we run on a windows host
 	if test "$APPVEYOR" != "True"; then
 		TARGET=
-		CCACHE=ccache
 	else
 		CONFIG="$CONFIG --enable-openssl"
 		CFLAGS="$CFLAGS -I/c/OpenSSL-$TEST/include"
@@ -196,24 +194,23 @@ win*)
 	win64)
 		CONFIG="--host=x86_64-w64-mingw32 $CONFIG --enable-dbghelp-backtraces"
 		DEPS="gcc-mingw-w64-x86-64 binutils-mingw-w64-x86-64 mingw-w64-x86-64-dev $DEPS"
-		CC="$CCACHE x86_64-w64-mingw32-gcc"
+		CC="x86_64-w64-mingw32-gcc"
 		;;
 	win32)
 		CONFIG="--host=i686-w64-mingw32 $CONFIG"
 		DEPS="gcc-mingw-w64-i686 binutils-mingw-w64-i686 mingw-w64-i686-dev $DEPS"
-		CC="$CCACHE i686-w64-mingw32-gcc"
+		CC="i686-w64-mingw32-gcc"
 		;;
 	esac
 	;;
 android)
-	DEPS="$DEPS openjdk-8-jdk"
 	if test "$1" = "deps"; then
 		git clone git://git.strongswan.org/android-ndk-boringssl.git -b ndk-static \
 			src/frontends/android/app/src/main/jni/openssl
 	fi
 	TARGET=distdir
 	;;
-osx)
+macos)
 	# this causes a false positive in ip-packet.c since Xcode 8.3
 	CFLAGS="$CFLAGS -Wno-address-of-packed-member"
 	# use the same options as in the Homebrew Formula
@@ -227,7 +224,7 @@ osx)
 			--enable-scepclient --enable-socket-default --enable-sshkey
 			--enable-stroke --enable-swanctl --enable-unity --enable-updown
 			--enable-x509 --enable-xauth-generic"
-	DEPS="bison gettext openssl curl"
+	DEPS="automake autoconf libtool bison gettext openssl curl"
 	BREW_PREFIX=$(brew --prefix)
 	export PATH=$BREW_PREFIX/opt/bison/bin:$PATH
 	export ACLOCAL_PATH=$BREW_PREFIX/opt/gettext/share/aclocal:$ACLOCAL_PATH
@@ -271,7 +268,7 @@ fuzzing)
 	if test -z "$1"; then
 		if test -z "$FUZZING_CORPORA"; then
 			git clone --depth 1 https://github.com/strongswan/fuzzing-corpora.git fuzzing-corpora
-			export FUZZING_CORPORA=$TRAVIS_BUILD_DIR/fuzzing-corpora
+			export FUZZING_CORPORA=$BUILD_DIR/fuzzing-corpora
 		fi
 		# these are about the same as those on OSS-Fuzz (except for the
 		# symbolize options and strip_path_prefix)
@@ -306,26 +303,22 @@ lgtm)
 	DEPS="jq"

 	if test -z "$1"; then
-		# fall back to the parent of the latest commit (on new branches we might
-		# not have a range, also on duplicate branches)
-		base="${TRAVIS_COMMIT}^"
-		if test -n "$TRAVIS_COMMIT_RANGE"; then
-			base="${TRAVIS_COMMIT_RANGE%...*}"
-			# after rebases, the first commit ID in the range might not be valid
-			git rev-parse -q --verify $base
-			if [ $? != 0 ]; then
-				# this will always compare against master, while the range
-				# otherwise only contains "new" commits
-				base=$(git merge-base origin/master ${TRAVIS_COMMIT})
-			fi
+		base=$COMMIT_BASE
+		# after rebases or for new/duplicate branches, the passed base commit
+		# ID might not be valid
+		git rev-parse -q --verify $base^{commit}
+		if [ $? != 0 ]; then
+			# this will always compare against master, while via base we
+			# otherwise only contains "new" commits
+			base=$(git merge-base origin/master ${COMMIT_ID})
 		fi
 		base=$(git rev-parse $base)
 		project_id=1506185006272

-		echo "Starting code review for $TRAVIS_COMMIT (base $base) on lgtm.com"
+		echo "Starting code review for $COMMIT_ID (base $base) on lgtm.com"
 		git diff --binary $base > lgtm.patch || exit $?
 		curl -s -X POST --data-binary @lgtm.patch \
-			"https://lgtm.com/api/v1.0/codereviews/${project_id}?base=${base}&external-id=${TRAVIS_BUILD_NUMBER}" \
+			"https://lgtm.com/api/v1.0/codereviews/${project_id}?base=${base}&external-id=${BUILD_NUMBER}" \
 			-H 'Content-Type: application/octet-stream' \
 			-H 'Accept: application/json' \
 			-H "Authorization: Bearer ${LGTM_TOKEN}" > lgtm.res || exit $?
@@ -373,12 +366,12 @@ esac

 case "$1" in
 deps)
-	case "$TRAVIS_OS_NAME" in
+	case "$OS_NAME" in
 	linux)
 		sudo apt-get update -qq && \
 		sudo apt-get install -qq bison flex gperf gettext $DEPS
 		;;
-	osx)
+	macos)
 		brew update && \
 		brew install $DEPS
 		;;
@@ -423,12 +416,6 @@ esac
 echo "$ make $TARGET"
 case "$TEST" in
 sonarcloud)
-	# there is an issue with the platform detection that causes sonarqube to
-	# fail on bionic with "ERROR: ld.so: object '...libinterceptor-${PLATFORM}.so'
-	# from LD_PRELOAD cannot be preloaded (cannot open shared object file)"
-	# https://jira.sonarsource.com/browse/CPP-2027
-	BW_PATH=$(dirname $(which build-wrapper-linux-x86-64))
-	cp $BW_PATH/libinterceptor-x86_64.so $BW_PATH/libinterceptor-haswell.so
 	# without target, coverage is currently not supported anyway because
 	# sonarqube only supports gcov, not lcov
 	build-wrapper-linux-x86-64 --out-dir bw-output make -j4 || exit $?
@@ -448,9 +435,11 @@ apidoc)
 	;;
 sonarcloud)
 	sonar-scanner \
+		-Dsonar.host.url=https://sonarcloud.io \
 		-Dsonar.projectKey=${SONAR_PROJECT} \
 		-Dsonar.organization=${SONAR_ORGANIZATION} \
-		-Dsonar.projectVersion=$(git describe)+${TRAVIS_BUILD_NUMBER} \
+		-Dsonar.login=${SONAR_TOKEN} \
+		-Dsonar.projectVersion=$(git describe)+${BUILD_NUMBER} \
 		-Dsonar.sources=. \
 		-Dsonar.cfamily.threads=2 \
 		-Dsonar.cfamily.cache.enabled=true \
@@ -462,7 +451,7 @@ android)
 	rm -r strongswan-*
 	cd src/frontends/android
 	echo "$ ./gradlew build"
-	NDK_CCACHE=ccache ./gradlew build
+	NDK_CCACHE=ccache ./gradlew build || exit $?
 	;;
 *)
 	;;