.cirrus.yml

##################################################################################
# Please note:                                                                   #
#                                                                                #
# After updating this file, please also update CI column of the support matrix   #
# at https://github.com/zeek/zeek/wiki/Zeek-Operating-System-Support-Matrix      #
##################################################################################

cpus: &CPUS 4
btest_jobs: &BTEST_JOBS 4
btest_retries: &BTEST_RETRIES 2
memory: &MEMORY 4GB

config: &CONFIG --build-type=release --disable-broker-tests --prefix=$CIRRUS_WORKING_DIR/install
static_config: &STATIC_CONFIG --build-type=release --disable-broker-tests --enable-static-broker --enable-static-binpac --prefix=$CIRRUS_WORKING_DIR/install
sanitizer_config: &SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=address,undefined --enable-fuzzers --enable-coverage
mobile_ipv6_config: &MOBILE_IPV6_CONFIG --build-type=release --enable-mobile-ipv6 --disable-broker-tests --prefix=$CIRRUS_WORKING_DIR/install
openssl30_config: &OPENSSL30_CONFIG --build-type=release --disable-broker-tests --with-openssl=/opt/openssl --prefix=$CIRRUS_WORKING_DIR/install

resources_template: &RESOURCES_TEMPLATE
  cpu: *CPUS
  memory: *MEMORY
  # For greediness, see https://medium.com/cirruslabs/introducing-greedy-container-instances-29aad06dc2b4
  greedy: true

macos_resources_template: &MACOS_RESOURCES_TEMPLATE
  # https://medium.com/cirruslabs/new-macos-task-execution-architecture-for-cirrus-ci-604250627c94
  # suggests we can go faster here:
  env:
    ZEEK_CI_CPUS: 12
    ZEEK_CI_BTEST_JOBS: 12
    # No permission to write to default location of /zeek
    CIRRUS_WORKING_DIR: /tmp/zeek

ci_template: &CI_TEMPLATE
  only_if: >
    $CIRRUS_PR != '' ||
    ( $CIRRUS_REPO_NAME == 'zeek' &&
      (
      $CIRRUS_BRANCH == 'master' ||
      $CIRRUS_BRANCH =~ 'release/.*'
      )
    )

  # Default timeout is 60 minutes, Cirrus hard limit is 120 minutes for free
  # tasks, so may as well ask for full time.
  timeout_in: 120m

  sync_submodules_script: git submodule update --recursive --init

  get_external_pcaps_cache:
    folder: testing/external/zeek-testing-traces
    fingerprint_script: echo zeek-testing-traces
    populate_script: ./ci/init-external-repos.sh
  init_external_repos_script: ./ci/init-external-repos.sh

  build_script: ./ci/build.sh
  test_script: ./ci/test.sh

  on_failure:
    upload_btest_tmp_dir_artifacts:
      path: "testing/**/tmp.tar.gz"
  always:
    upload_btest_xml_results_artifacts:
      path: "testing/**/btest-results.xml"
      type: text/xml
      format: junit
    upload_btest_html_results_artifacts:
      path: "testing/**/btest-results.html"
      type: text/html

env:
  CIRRUS_WORKING_DIR: /zeek
  ZEEK_CI_CPUS: *CPUS
  ZEEK_CI_BTEST_JOBS: *BTEST_JOBS
  ZEEK_CI_BTEST_RETRIES: *BTEST_RETRIES
  ZEEK_CI_CONFIGURE_FLAGS: *CONFIG
  # This is a single-purpose, read-only GitHub deploy key (SSH private key) for
  # the zeek-testing-private repository.
  ZEEK_TESTING_PRIVATE_SSH_KEY: ENCRYPTED[!dbdba93df9c166f926480cebff52dab303589257b3b3ee53aa392021aff2881ed9aafefef26aa9a1b71a49d663d1361c!]

  # This is the key used to create HMAC auth keys for the benchmark script. This
  # was generated by creating a new key using openssl, and then running sha256
  # on it.
  ZEEK_BENCHMARK_HMAC_KEY: ENCRYPTED[363e79b9942f348e53ab1f39f6ac8f7118bea2f4228ad1ef7b55981d3ef8d26dd756872f600ff40f2d7dcadb71f88513]

  # This is the https endpoint host and port used for benchmarking. It's kept
  # encrypted as a security measure to avoid leaking the host's information.
  ZEEK_BENCHMARK_HOST: ENCRYPTED[62ecdc93e839800d754d09d9a9070e9cb9b209e7d7dd2472ba38648f786ff272d0e0ea71233d0910025f2c6f3771259c]
  ZEEK_BENCHMARK_PORT: ENCRYPTED[b97fabf4d6bd5eef107c8469c5cb2c44e0107d89c220f43e7d1e7bdfb32dbdc2620855fee8e5a8d889458d5a6ac3e5c7]

  # The repo token used for uploading data to Coveralls.io
  ZEEK_COVERALLS_REPO_TOKEN: ENCRYPTED[7ffd1e041f848f02b62f5abc7fda8a5a8a1561fbb2b46d88cefb67c74408ddeef6ea6f3b279c7953ca14ae9b4d050e2d]

# Linux EOL timelines: https://linuxlifecycle.com/
# Fedora (~13 months): https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle

fedora35_task:
  container:
    # Fedora 35 EOL: Around Dec 2022
    dockerfile: ci/fedora-35/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

fedora34_task:
  container:
    # Fedora 34 EOL: Around May 2022
    dockerfile: ci/fedora-34/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

fedora33_task:
  container:
    # Fedora 33 EOL: Around November 2022
    dockerfile: ci/fedora-33/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

centosstream8_task:
  container:
    # Stream 8 support should be 5 years, so until 2024. but I cannot find a concrete timeline --cpk
    dockerfile: ci/centos-stream-8/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

centos8_task:
  container:
    # CentOS 8 EOL: May 31, 2029
    dockerfile: ci/centos-8/Dockerfile
    << : *RESOURCES_TEMPLATE
  env:
    ZEEK_CI_CREATE_ARTIFACT: 1
  << : *CI_TEMPLATE
  upload_binary_artifacts:
    path: build.tgz
  benchmark_script: ./ci/benchmark.sh

centos7_task:
  container:
    # CentOS 7 EOL: June 30, 2024
    dockerfile: ci/centos-7/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

debian11_task:
  container:
    # Debian 11 EOL: June 2026
    dockerfile: ci/debian-11/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

debian11_static_task:
  container:
    # Just use a recent/common distro to run a static compile test.
    # Debian 11 EOL: June 2026
    dockerfile: ci/debian-11/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  env:
    ZEEK_CI_CONFIGURE_FLAGS: *STATIC_CONFIG

debian10_task:
  container:
    # Debian 10 EOL: June 2024
    dockerfile: ci/debian-10/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

debian9_task:
  container:
    # Debian 9 EOL: June 2022
    dockerfile: ci/debian-9/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

debian9_32bit_task:
  container:
    # Debian 9 EOL: June 2022
    dockerfile: ci/debian-9-32bit/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

opensuse_leap_15_2_task:
  container:
    # Opensuse Leap 15.2 EOL: Dec 2021
    dockerfile: ci/opensuse-leap-15.2/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

opensuse_leap_15_3_task:
  container:
    # Opensuse Leap 15.3 EOL: TBD
    dockerfile: ci/opensuse-leap-15.3/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

ubuntu20_task:
  container:
    # Ubuntu 20.04 EOL: April 2025
    dockerfile: ci/ubuntu-20.04/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

ubuntu18_task:
  container:
    # Ubuntu 18.04 EOL: April 2023
    dockerfile: ci/ubuntu-18.04/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  env:
    ZEEK_CI_CONFIGURE_FLAGS: *MOBILE_IPV6_CONFIG

alpine_task:
  container:
    # Alpine releases typically happen every 6 months w/ support for 2 years.
    # The Dockerfile simply tracks latest Alpine release and shouldn't
    # generally need updating based on particular Alpine release timelines.
    dockerfile: ci/alpine/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE

# Apple doesn't publish official long-term support timelines.
# We aim to support both the current and previous macOS release.
macos_monterey_task:
  macos_instance:
    image: monterey-xcode-13.1
  prepare_script: ./ci/macos/prepare.sh
  << : *CI_TEMPLATE
  << : *MACOS_RESOURCES_TEMPLATE

macos_big_sur_task:
  macos_instance:
    image: big-sur-xcode-12.5
  prepare_script: ./ci/macos/prepare.sh
  << : *CI_TEMPLATE
  << : *MACOS_RESOURCES_TEMPLATE

# FreeBSD EOL timelines: https://www.freebsd.org/security/security.html#sup
freebsd14_task:
  freebsd_instance:
    # We don't support FreeBSD 14 yet, this is a purely informative task
    image_family: freebsd-14-0-snap
    cpu: 8
    # Not allowed to request less than 8GB for an 8 CPU FreeBSD VM.
    memory: 8GB

    allow_failures: true
    skip_notification: true

  prepare_script: ./ci/freebsd/prepare.sh
  << : *CI_TEMPLATE

freebsd13_task:
  freebsd_instance:
    # FreeBSD 13 EOL: January 31, 2026
    image_family: freebsd-13-0
    cpu: 8
    # Not allowed to request less than 8GB for an 8 CPU FreeBSD VM.
    memory: 8GB
  prepare_script: ./ci/freebsd/prepare.sh
  << : *CI_TEMPLATE

freebsd12_task:
  freebsd_instance:
    # FreeBSD 12 EOL: June 30, 2024
    image_family: freebsd-12-2
    cpu: 8
    # Not allowed to request less than 8GB for an 8 CPU FreeBSD VM.
    memory: 8GB
  prepare_script: ./ci/freebsd/prepare.sh
  << : *CI_TEMPLATE

# This can be removed as soon as the first distribution that we use ships
# OpenSSL 3.0
openssl30_task:
  container:
    # Tweaked Ubuntu 20.04 EOL: April 2025
    dockerfile: ci/openssl-3.0/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  env:
    ZEEK_CI_CONFIGURE_FLAGS: *OPENSSL30_CONFIG

sanitizer_task:
  container:
    # Just uses a recent/common distro to run memory error/leak checks.
    dockerfile: ci/ubuntu-18.04/Dockerfile
    cpu: 4
    # AddressSanitizer uses a lot more memory than a typical config.
    memory: 12GB
  << : *CI_TEMPLATE
  test_fuzzers_script: ./ci/test-fuzzers.sh
  coverage_script: ./ci/upload-coverage.sh
  env:
    CXXFLAGS: -DZEEK_DICT_DEBUG
    ZEEK_CI_CONFIGURE_FLAGS: *SANITIZER_CONFIG
    ZEEK_TAILORED_UB_CHECKS: 1
    ZEEK_CI_DISABLE_SCRIPT_PROFILING: 1
    UBSAN_OPTIONS: print_stacktrace=1