feat(metrics): opt-in Prometheus /metrics endpoint + textfile collector #314
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Kernel BPF Test | |
| on: | |
| push: | |
| branches: [main, develop] | |
| paths: | |
| - 'bpf/**' | |
| - 'src/**' | |
| - 'CMakeLists.txt' | |
| pull_request: {} | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| kernel-bpf-test: | |
| name: kernel-bpf-test | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect kernel-BPF-relevant changes | |
| id: changes | |
| run: | | |
| set -euo pipefail | |
| if [[ "${{ github.event_name }}" != "pull_request" ]]; then | |
| echo "kernel_bpf_relevant=true" >> "$GITHUB_OUTPUT" | |
| echo "Non-PR event; running kernel BPF test." | |
| exit 0 | |
| fi | |
| base="${{ github.event.pull_request.base.sha }}" | |
| head="${{ github.event.pull_request.head.sha }}" | |
| changed="$( | |
| git diff --name-only "$base" "$head" -- \ | |
| bpf \ | |
| src \ | |
| CMakeLists.txt \ | |
| .github/workflows/kernel-bpf-test.yml | |
| )" | |
| if [[ -n "$changed" ]]; then | |
| echo "kernel_bpf_relevant=true" >> "$GITHUB_OUTPUT" | |
| echo "kernel-BPF-relevant changes detected:" | |
| echo "$changed" | |
| else | |
| echo "kernel_bpf_relevant=false" >> "$GITHUB_OUTPUT" | |
| echo "No kernel-BPF-relevant changes; satisfying required check without kernel work." | |
| fi | |
| - name: Required check no-op | |
| if: steps.changes.outputs.kernel_bpf_relevant != 'true' | |
| run: | | |
| echo "No bpf/src/CMake/kernel-bpf workflow inputs changed." | |
| echo "This required job reports success so branch protection does not wait on an untriggered path-filtered check." | |
| - name: Install dependencies | |
| if: steps.changes.outputs.kernel_bpf_relevant == 'true' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y clang llvm libbpf-dev libsystemd-dev pkg-config \ | |
| cmake ninja-build python3-pip qemu-system-x86 linux-image-generic \ | |
| linux-tools-common 2>/dev/null || true | |
| sudo apt-get install -y linux-tools-$(uname -r) 2>/dev/null || \ | |
| sudo apt-get install -y linux-tools-generic 2>/dev/null || \ | |
| sudo apt-get install -y bpftool 2>/dev/null || true | |
| if ! bpftool version >/dev/null 2>&1; then | |
| REAL=$(find /usr/lib/linux-tools/ -name bpftool -type f 2>/dev/null | sort -V | tail -1) | |
| if [[ -n "$REAL" ]]; then | |
| sudo cp "$REAL" /usr/sbin/bpftool | |
| fi | |
| fi | |
| sudo pip3 install virtme-ng || pip3 install --user virtme-ng | |
| - name: Check BPF tooling availability | |
| if: steps.changes.outputs.kernel_bpf_relevant == 'true' | |
| id: bpf_check | |
| run: | | |
| if [[ -f /sys/kernel/btf/vmlinux ]] && bpftool version >/dev/null 2>&1; then | |
| echo "bpf_ready=true" >> "$GITHUB_OUTPUT" | |
| echo "BTF available and bpftool works: $(bpftool version 2>&1 | head -1)" | |
| else | |
| echo "bpf_ready=false" >> "$GITHUB_OUTPUT" | |
| echo "::warning::Skipping — BTF or working bpftool not available on this runner" | |
| fi | |
| - name: Build with BPF enabled | |
| if: steps.changes.outputs.kernel_bpf_relevant == 'true' && steps.bpf_check.outputs.bpf_ready == 'true' | |
| run: | | |
| cmake -S . -B build -G Ninja \ | |
| -DCMAKE_BUILD_TYPE=Release \ | |
| -DBUILD_TESTING=ON | |
| cmake --build build | |
| - name: Verify BPF object compiles | |
| if: steps.changes.outputs.kernel_bpf_relevant == 'true' && steps.bpf_check.outputs.bpf_ready == 'true' | |
| run: | | |
| test -f build/aegis.bpf.o || { echo "BPF object not built"; exit 1; } | |
| file build/aegis.bpf.o | grep -q "ELF" || { echo "Not a valid ELF"; exit 1; } | |
| - name: Run BPF verifier check | |
| if: steps.changes.outputs.kernel_bpf_relevant == 'true' && steps.bpf_check.outputs.bpf_ready == 'true' | |
| run: | | |
| if command -v veristat >/dev/null 2>&1; then | |
| veristat build/aegis.bpf.o || true | |
| fi | |
| - name: Boot kernel with virtme-ng and test BPF loading | |
| if: steps.changes.outputs.kernel_bpf_relevant == 'true' && steps.bpf_check.outputs.bpf_ready == 'true' | |
| timeout-minutes: 10 | |
| run: | | |
| KERNEL_IMG=$(ls /boot/vmlinuz-* 2>/dev/null | sort -V | tail -1) | |
| if [[ -z "$KERNEL_IMG" ]]; then | |
| echo "No kernel image found, skipping virtme test" | |
| exit 0 | |
| fi | |
| cat > /tmp/bpf_load_test.sh << 'SCRIPT' | |
| #!/bin/bash | |
| set -e | |
| echo "=== BPF Load Test ===" | |
| echo "Kernel: $(uname -r)" | |
| echo "BTF: $(ls -la /sys/kernel/btf/vmlinux 2>/dev/null || echo 'not available')" | |
| if grep -q bpf /sys/kernel/security/lsm 2>/dev/null; then | |
| echo "BPF LSM: enabled" | |
| else | |
| echo "BPF LSM: not enabled (expected in some configs)" | |
| fi | |
| if command -v bpftool >/dev/null 2>&1 && [[ -f /sys/kernel/btf/vmlinux ]]; then | |
| bpftool btf dump file /sys/kernel/btf/vmlinux format raw | head -c 64 > /dev/null | |
| echo "BTF dump: OK" | |
| fi | |
| echo "=== BPF Load Test Complete ===" | |
| SCRIPT | |
| chmod +x /tmp/bpf_load_test.sh | |
| if command -v vng >/dev/null 2>&1; then | |
| vng --run /tmp/bpf_load_test.sh -- \ | |
| --kernel "$KERNEL_IMG" \ | |
| --memory 2G \ | |
| --cpus 2 || echo "virtme-ng test completed (may have limited BPF support in runner)" | |
| else | |
| echo "virtme-ng not available, running local BPF checks only" | |
| bash /tmp/bpf_load_test.sh || true | |
| fi | |
| - name: Run userspace tests | |
| if: steps.changes.outputs.kernel_bpf_relevant == 'true' && steps.bpf_check.outputs.bpf_ready == 'true' | |
| run: ctest --test-dir build --output-on-failure --timeout 120 |