Slips v1.1.22

.github/workflows/create-a-new-release.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/dockerfile-pr-tests.yml

@@ -0,0 +1,90 @@
+# Runs Dockerfile-based unit and integration tests on pull requests to master.
+# External contributors must pass the external-pr-approval environment gate
+# before tests execute, to avoid running untrusted PR code automatically.
+
+name: dockerfile-pr-tests
+
+on:
+  pull_request:
+    branches:
+      - 'master'
+      - '!develop'
+
+permissions:
+  contents: read
+
+jobs:
+  external-pr-approval:
+    name: External PR approval
+    if: ${{ !contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association) }}
+    runs-on: ubuntu-latest
+    environment:
+      name: external-pr-approval
+    steps:
+      - name: Confirm approval
+        run: echo "External pull request approved for Dockerfile test execution."
+
+  build-docker-image:
+    name: Build Docker image
+    if: ${{ always() && (needs.external-pr-approval.result == 'success' || needs.external-pr-approval.result == 'skipped') }}
+    needs: external-pr-approval
+    runs-on: ubuntu-22.04
+    outputs:
+      docker_image_artifact_name: ${{ steps.image.outputs.artifact_name }}
+      docker_image_tag: ${{ steps.image.outputs.image_tag }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Prepare Docker image metadata
+        id: image
+        run: |
+          image_tag="slips-dockerfile-pr-tests:${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          artifact_name="slips-dockerfile-pr-tests-image-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          echo "image_tag=$image_tag" >> "$GITHUB_OUTPUT"
+          echo "artifact_name=$artifact_name" >> "$GITHUB_OUTPUT"
+
+      - name: Build Docker image
+        uses: ./.github/workflows/reusable/build-docker-image
+        with:
+          artifact_name: ${{ steps.image.outputs.artifact_name }}
+          image_tag: ${{ steps.image.outputs.image_tag }}
+
+  unit-tests:
+    if: ${{ always() && needs.build-docker-image.result == 'success' }}
+    needs:
+      - external-pr-approval
+      - build-docker-image
+    uses: ./.github/workflows/test-suite.yml
+    with:
+      test_suite_name: unit-tests
+      test_dir: tests/unit
+      test_path_prefix: tests/unit/
+      pytest_workers: "5"
+      timeout_minutes: 120
+      output_path: output/unit_tests
+      artifact_name_prefix: test_slips-output-
+      container_prefix: slips-unit
+      docker_image_artifact_name: ${{ needs.build-docker-image.outputs.docker_image_artifact_name }}
+      docker_image_tag: ${{ needs.build-docker-image.outputs.docker_image_tag }}
+
+  integration-tests:
+    if: ${{ always() && needs.build-docker-image.result == 'success' }}
+    needs:
+      - external-pr-approval
+      - build-docker-image
+    uses: ./.github/workflows/test-suite.yml
+    with:
+      test_suite_name: integration-tests
+      test_dir: tests/integration
+      output_prefix: integration/
+      test_path_prefix: tests/
+      pytest_workers: "3"
+      timeout_minutes: 1800
+      output_path: output/integration_tests
+      artifact_name_suffix: -integration-output
+      container_prefix: slips-integration
+      docker_image_artifact_name: ${{ needs.build-docker-image.outputs.docker_image_artifact_name }}
+      docker_image_tag: ${{ needs.build-docker-image.outputs.docker_image_tag }}

.github/workflows/integration-tests.yml

@@ -3,71 +3,18 @@ name: integration-tests
 on:
   pull_request:
     branches:
-      - 'master'
+      - '!master'
       - 'develop'
 
 jobs:
-  list-integration-tests:
-    runs-on: ubuntu-latest
-    outputs:
-      test_files: ${{ steps.list.outputs.test_files }}
-    steps:
-      - uses: actions/checkout@v6
-      - id: list
-        uses: ./.github/actions/list-tests-dir
-        with:
-          test_dir: tests/integration
-          output_prefix: integration/
-
   integration-tests:
-    needs: list-integration-tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 1800
-
-    container:
-      image: stratosphereips/slips_dependencies
-      # TensorFlow + multiprocessing + pytest -n can hit /dev/shm limits.
-      options: --shm-size=2g
-
-
-    # suppress tensorflow warnings
-    env:
-      TF_CPP_MIN_LOG_LEVEL: 3
-      TF_ENABLE_ONEDNN_OPTS: 0
-
-    strategy:
-      fail-fast: false
-      matrix:
-        test_file: ${{ fromJson(needs.list-integration-tests.outputs.test_files) }}
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.ref }}
-          fetch-depth: 0
-
-      - name: Start Redis
-        uses: ./.github/actions/start-redis
-
-      - name: Run Integration Tests for ${{ matrix.test_file }}
-        run: |
-          python3 -m pytest tests/${{ matrix.test_file }} -p no:warnings -vv -s -n 3
-
-      - name: Build Artifact Name
-        # built names, otherwise we get numeric names for the artifacts and we dont know which is which
-        # always() here because when the pytest step fails, GitHub skips the name-building step, so steps.artifact-name.outputs.name is empty
-        # and upload-artifact rejects it.
-        if: always()
-        id: artifact-name
-        run: |
-          sanitized_test_file="${{ matrix.test_file }}"
-          sanitized_test_file=$(printf '%s\n' "$sanitized_test_file" | tr '/' '_')
-          echo "name=${sanitized_test_file}-integration-output" >> "$GITHUB_OUTPUT"
-
-      - name: Upload Artifacts
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: ${{ steps.artifact-name.outputs.name }}
-          path: |
-            output/integration_tests
+    uses: ./.github/workflows/test-suite.yml
+    with:
+      test_suite_name: integration-tests
+      test_dir: tests/integration
+      output_prefix: integration/
+      test_path_prefix: tests/
+      pytest_workers: "3"
+      timeout_minutes: 1800
+      output_path: output/integration_tests
+      artifact_name_suffix: -integration-output

.github/workflows/monthly-develop-to-master-pr.yml

@@ -0,0 +1,50 @@
+name: monthly develop to master PR
+
+on:
+  schedule:
+    - cron: '0 7 30 * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  create-pr:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Create monthly PR
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.PR_AUTOMATION_TOKEN }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "PR_AUTOMATION_TOKEN must be configured so PR-triggered workflows run automatically." >&2
+            exit 1
+          fi
+
+          ahead_by="$(gh api "repos/$GH_REPO/compare/master...develop" --jq '.ahead_by')"
+          if [ "$ahead_by" = "0" ]; then
+            echo "develop has no commits ahead of master. Skipping PR creation."
+            exit 0
+          fi
+
+          existing_pr="$(gh pr list \
+            --repo "$GH_REPO" \
+            --base master \
+            --head develop \
+            --state open \
+            --json number \
+            --jq '.[0].number')"
+
+          if [ -n "$existing_pr" ]; then
+            echo "PR #$existing_pr from develop to master already exists. Skipping PR creation."
+            exit 0
+          fi
+
+          gh pr create \
+            --repo "$GH_REPO" \
+            --base master \
+            --head develop \
+            --title "Slips new version" \
+            --body "Automated monthly PR from develop to master."

.github/workflows/publish-slips-images.yml

@@ -64,7 +64,7 @@ jobs:
 
       # clone slips and checkout branch
       # By default it checks out only one commit
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: 'master'
           # Fetch all history for all tags and branches

.github/workflows/reusable/build-docker-image/action.yml

@@ -0,0 +1,53 @@
+name: "Build Docker Image"
+description: "Build docker/Dockerfile, export it as an artifact, and expose the image tag"
+inputs:
+  artifact_name:
+    description: "Artifact name for the exported Docker image tarball"
+    required: true
+  dockerfile:
+    description: "Path to the Dockerfile"
+    required: false
+    default: "docker/Dockerfile"
+  image_tag:
+    description: "Docker image tag to build and export"
+    required: true
+outputs:
+  artifact_name:
+    description: "Artifact name for the exported Docker image tarball"
+    value: ${{ inputs.artifact_name }}
+  image_tag:
+    description: "Docker image tag that was built"
+    value: ${{ inputs.image_tag }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout repository with submodules
+      uses: actions/checkout@v7
+      with:
+        ref: ${{ github.ref }}
+        fetch-depth: 0
+        submodules: recursive
+
+    - name: Validate Docker build context
+      shell: bash
+      run: |
+        test -f iris/go.mod
+        test -f iris/go.sum
+        test -f p2p4slips/go.mod
+        test -f p2p4slips/go.sum
+
+    - name: Build Docker image
+      shell: bash
+      env:
+        DOCKERFILE: ${{ inputs.dockerfile }}
+        IMAGE_TAG: ${{ inputs.image_tag }}
+      run: |
+        docker build -t "$IMAGE_TAG" -f "$DOCKERFILE" .
+        docker save -o docker-image.tar "$IMAGE_TAG"
+
+    - name: Upload Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ inputs.artifact_name }}
+        path: docker-image.tar

.github/actions/list-tests-dir/action.yml → .github/workflows/reusable/list-tests-dir/action.yml

@@ -1,5 +1,5 @@
 name: "List Test Files"
-description: "Build JSON matrix of test files"
+description: "Auto discovery of integration and unit tests - Build JSON matrix of test files"
 inputs:
   test_dir:
     description: "Directory to search for test_*.py files"