feat(metrics): opt-in Prometheus /metrics endpoint + textfile collector #48
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # bpfcompat Layer-A kernel matrix (object load/verify/attach across real kernels). | |
| # | |
| # Manual / opt-in: runs only on a self-hosted runner that has KVM, the bpfcompat | |
| # checkout (path in the BPFCOMPAT_DIR repo variable), and its cached VM images. | |
| # PR runs are capacity-gated by AEGIS_ENABLE_SELF_HOSTED_PR_GATES. With that | |
| # repository variable unset, PR jobs skip before runner allocation and do not | |
| # count as compatibility evidence. The verdict logic lives in the tested wrapper | |
| # scripts/run_bpfcompat_matrix.sh. See docs/KERNEL_COMPAT_MATRIX.md. | |
| # | |
| # Alternative (no self-hosted runner): submit aegis.bpf.o + the manifest to the | |
| # bpfcompat HTTP API with BPFCOMPAT_API_* secrets — wire that here instead. | |
| name: bpfcompat Kernel Matrix | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| matrix: | |
| description: "Matrix file (profiles to validate)" | |
| default: tests/enforcement/bpfcompat-matrix.yaml | |
| # Cross-kernel load gate: any change that can alter the compiled BPF object (or | |
| # the matrix/gate itself) is validated on every target kernel BEFORE merge. | |
| # A verifier rejection that only shows up on an older LTS kernel (the failure | |
| # mode single-kernel CI cannot see) fails this check when the self-hosted KVM | |
| # runner fleet is enabled. If AEGIS_ENABLE_SELF_HOSTED_PR_GATES is not true, | |
| # this job skips and release approvers must treat cross-kernel evidence as | |
| # missing rather than passed. | |
| pull_request: | |
| paths: | |
| - 'bpf/**' | |
| - 'CMakeLists.txt' | |
| - 'tests/enforcement/bpfcompat-matrix.yaml' | |
| - 'tests/enforcement/bpfcompat-manifest.yaml' | |
| - 'tests/enforcement/bpfcompat_load_baseline.json' | |
| - 'scripts/run_bpfcompat_matrix.sh' | |
| - 'scripts/gen_bpfcompat_manifest.py' | |
| - '.github/workflows/bpfcompat-matrix.yml' | |
| permissions: | |
| contents: read | |
| jobs: | |
| layer-a: | |
| if: github.event_name != 'pull_request' || vars.AEGIS_ENABLE_SELF_HOSTED_PR_GATES == 'true' | |
| runs-on: [self-hosted, kvm, bpfcompat] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Build BPF object | |
| run: | | |
| cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF | |
| cmake --build build --target bpf_obj | |
| - name: Run Layer-A kernel matrix | |
| env: | |
| AEGIS_BPFCOMPAT_DIR: ${{ vars.BPFCOMPAT_DIR }} | |
| AEGIS_BPF_OBJ: build/aegis.bpf.o | |
| AEGIS_BPFCOMPAT_MATRIX: ${{ inputs.matrix || 'tests/enforcement/bpfcompat-matrix.yaml' }} | |
| AEGIS_MATRIX_OUT: bpfcompat-matrix-summary.json | |
| run: bash scripts/run_bpfcompat_matrix.sh | |
| - name: Upload matrix summary | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4 | |
| with: | |
| name: bpfcompat-matrix-summary | |
| path: bpfcompat-matrix-summary.json | |
| if-no-files-found: ignore |