Skip to content

Commit 4d95aba

Browse files
ErenAriErenAri
committed
Branch protection required-check wiring, Release drill switched to full BPF on proper runner, Single go-live gate with aggregated evidence
1 parent 6b7266c commit 4d95aba

32 files changed

Lines changed: 1301 additions & 82 deletions

‎.github/workflows/branch-protection-audit.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Branch Protection Audit
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 9 * * 1"
7+
8+
jobs:
9+
audit:
10+
runs-on: ubuntu-24.04
11+
steps:
12+
- uses: actions/checkout@v4
13+
14+
- name: Audit branch protection required checks
15+
env:
16+
BRANCH_PROTECTION_TOKEN: ${{ secrets.BRANCH_PROTECTION_TOKEN }}
17+
REPO: ${{ github.repository }}
18+
run: |
19+
if [[ -z "${BRANCH_PROTECTION_TOKEN}" ]]; then
20+
echo "BRANCH_PROTECTION_TOKEN is not configured; skipping audit."
21+
echo "Set an admin-capable token in repository secrets to enable this check."
22+
exit 0
23+
fi
24+
export GH_TOKEN="${BRANCH_PROTECTION_TOKEN}"
25+
REPO="${REPO}" BRANCH=main scripts/check_branch_protection.sh

‎.github/workflows/canary.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Staging Canary
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 2 * * 1"
7+
8+
jobs:
9+
canary:
10+
runs-on: [self-hosted, bpf-lsm]
11+
timeout-minutes: 90
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Install dependencies (if apt-get is available)
16+
run: |
17+
if command -v apt-get >/dev/null 2>&1; then
18+
sudo apt-get update
19+
sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build python3-jsonschema
20+
fi
21+
22+
- name: Verify environment
23+
run: scripts/verify_env.sh --strict
24+
25+
- name: Require BPF LSM
26+
run: grep -qw bpf /sys/kernel/security/lsm
27+
28+
- name: Configure
29+
run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF
30+
31+
- name: Build
32+
run: cmake --build build
33+
34+
- name: Canary gate (audit)
35+
run: sudo AEGIS_BIN=./build/aegisbpf PHASE=audit DURATION_SECONDS=300 MAX_RINGBUF_DROPS=100 MAX_RSS_GROWTH_KB=65536 scripts/canary_gate.sh
36+
37+
- name: Canary gate (enforce)
38+
run: sudo AEGIS_BIN=./build/aegisbpf PHASE=enforce ENFORCE_SIGNAL=term DURATION_SECONDS=300 MAX_RINGBUF_DROPS=100 MAX_RSS_GROWTH_KB=65536 scripts/canary_gate.sh
39+
40+
- name: Upload canary artifacts
41+
uses: actions/upload-artifact@v4
42+
with:
43+
name: canary-artifacts
44+
path: artifacts/canary/

‎.github/workflows/ci.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,12 @@ jobs:
7777
run: cmake --build build
7878

7979
- name: Run tests with sanitizer
80-
run: ctest --test-dir build --output-on-failure --timeout 300
80+
run: |
81+
if [ "${{ matrix.sanitizer }}" = "tsan" ]; then
82+
setarch "$(uname -m)" -R ctest --test-dir build --output-on-failure --timeout 300
83+
else
84+
ctest --test-dir build --output-on-failure --timeout 300
85+
fi
8186
env:
8287
ASAN_OPTIONS: abort_on_error=1:halt_on_error=1
8388
UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1

‎.github/workflows/go-live-gate.yml‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
name: Go-Live Gate
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
readiness:
8+
runs-on: ubuntu-24.04
9+
timeout-minutes: 60
10+
steps:
11+
- uses: actions/checkout@v4
12+
13+
- name: Install dependencies
14+
run: |
15+
sudo apt-get update
16+
sudo apt-get install -y clang llvm libbpf-dev libsystemd-dev pkg-config cmake ninja-build rpm python3-jsonschema linux-tools-common linux-tools-$(uname -r) || sudo apt-get install -y clang llvm libbpf-dev libsystemd-dev pkg-config cmake ninja-build rpm python3-jsonschema linux-tools-common
17+
18+
- name: Run release-readiness gate
19+
run: |
20+
mkdir -p artifacts/go-live/readiness
21+
set -o pipefail
22+
scripts/release_readiness.sh | tee artifacts/go-live/readiness/release_readiness.log
23+
24+
- name: Run key-rotation drill
25+
run: |
26+
mkdir -p artifacts/go-live/readiness
27+
set -o pipefail
28+
BUILD_DIR=build-key-drill scripts/key_rotation_drill.sh | tee artifacts/go-live/readiness/key_rotation_drill.log
29+
30+
- name: Upload readiness artifacts
31+
if: always()
32+
uses: actions/upload-artifact@v4
33+
with:
34+
name: go-live-readiness
35+
path: artifacts/go-live/readiness/
36+
if-no-files-found: warn
37+
38+
runtime-canary:
39+
runs-on: [self-hosted, bpf-lsm]
40+
timeout-minutes: 120
41+
steps:
42+
- uses: actions/checkout@v4
43+
44+
- name: Install dependencies (if apt-get is available)
45+
run: |
46+
if command -v apt-get >/dev/null 2>&1; then
47+
sudo apt-get update
48+
sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build python3-jsonschema
49+
fi
50+
51+
- name: Verify environment
52+
run: scripts/verify_env.sh --strict
53+
54+
- name: Require BPF LSM
55+
run: grep -qw bpf /sys/kernel/security/lsm
56+
57+
- name: Configure
58+
run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON
59+
60+
- name: Build
61+
run: cmake --build build
62+
63+
- name: Unit tests
64+
run: ctest --test-dir build --output-on-failure --timeout 180
65+
66+
- name: Canary gate (audit)
67+
run: sudo AEGIS_BIN=./build/aegisbpf PHASE=audit DURATION_SECONDS=180 MAX_RINGBUF_DROPS=100 MAX_RSS_GROWTH_KB=65536 scripts/canary_gate.sh
68+
69+
- name: Canary gate (enforce)
70+
run: sudo AEGIS_BIN=./build/aegisbpf PHASE=enforce ENFORCE_SIGNAL=term DURATION_SECONDS=180 MAX_RINGBUF_DROPS=100 MAX_RSS_GROWTH_KB=65536 scripts/canary_gate.sh
71+
72+
- name: Incident evidence bundle
73+
run: |
74+
mkdir -p artifacts/go-live
75+
sudo AEGIS_BIN=./build/aegisbpf scripts/collect_incident_bundle.sh artifacts/go-live/incident-gate
76+
77+
- name: Upload runtime artifacts
78+
if: always()
79+
uses: actions/upload-artifact@v4
80+
with:
81+
name: go-live-runtime
82+
path: |
83+
artifacts/canary/
84+
artifacts/go-live/incident-gate.tar.gz
85+
if-no-files-found: warn
86+
87+
perf-certification:
88+
runs-on: [self-hosted, perf]
89+
timeout-minutes: 60
90+
steps:
91+
- uses: actions/checkout@v4
92+
93+
- name: Install dependencies (if apt-get is available)
94+
run: |
95+
if command -v apt-get >/dev/null 2>&1; then
96+
sudo apt-get update
97+
sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build python3-jsonschema
98+
fi
99+
100+
- name: Verify environment
101+
run: scripts/verify_env.sh --strict
102+
103+
- name: Configure
104+
run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF
105+
106+
- name: Build
107+
run: cmake --build build
108+
109+
- name: Perf microbench gate
110+
run: |
111+
mkdir -p artifacts/go-live/perf
112+
set -o pipefail
113+
sudo MAX_PCT=10 ITERATIONS=200000 FILE=/etc/hosts scripts/perf_compare.sh | tee artifacts/go-live/perf/perf_compare.log
114+
115+
- name: Perf workload suite gate
116+
run: |
117+
mkdir -p artifacts/go-live/perf
118+
set -o pipefail
119+
sudo BIN=./build/aegisbpf \
120+
FILE=/etc/hosts \
121+
OPEN_ITERATIONS=200000 \
122+
READ_ITERATIONS=50000 \
123+
STAT_SAMPLE=400 \
124+
STAT_ITERATIONS=50 \
125+
MAX_OPEN_PCT=10 \
126+
MAX_READ_PCT=15 \
127+
MAX_STAT_PCT=15 \
128+
FORMAT=json \
129+
OUT=artifacts/go-live/perf/perf_workload.json \
130+
scripts/perf_workload_suite.sh | tee artifacts/go-live/perf/perf_workload.log
131+
132+
- name: Upload perf artifacts
133+
if: always()
134+
uses: actions/upload-artifact@v4
135+
with:
136+
name: go-live-perf
137+
path: artifacts/go-live/perf/
138+
if-no-files-found: warn
139+
140+
release-drill:
141+
runs-on: [self-hosted, bpf-lsm]
142+
timeout-minutes: 60
143+
steps:
144+
- uses: actions/checkout@v4
145+
146+
- name: Install dependencies (if apt-get is available)
147+
run: |
148+
if command -v apt-get >/dev/null 2>&1; then
149+
sudo apt-get update
150+
sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build rpm python3-jsonschema linux-tools-common linux-tools-$(uname -r) || sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build rpm python3-jsonschema linux-tools-common
151+
fi
152+
153+
- name: Verify environment
154+
run: scripts/verify_env.sh --strict
155+
156+
- name: Require BPF LSM
157+
run: grep -qw bpf /sys/kernel/security/lsm
158+
159+
- name: Run full release drill
160+
run: BUILD_DIR=build-release-drill SKIP_BPF_BUILD=OFF ARTIFACT_DIR=artifacts/go-live/release-drill scripts/release_drill.sh
161+
162+
- name: Upload release-drill artifacts
163+
if: always()
164+
uses: actions/upload-artifact@v4
165+
with:
166+
name: go-live-release-drill
167+
path: artifacts/go-live/release-drill/
168+
if-no-files-found: warn
169+
170+
aggregate-evidence:
171+
if: always()
172+
needs: [readiness, runtime-canary, perf-certification, release-drill]
173+
runs-on: ubuntu-24.04
174+
steps:
175+
- uses: actions/download-artifact@v4
176+
with:
177+
path: go-live-evidence
178+
179+
- name: Bundle go-live evidence
180+
run: |
181+
mkdir -p bundle
182+
find go-live-evidence -type f | sort > bundle/evidence_manifest.txt || true
183+
cp -r go-live-evidence bundle/evidence
184+
tar -czf go-live-evidence-${GITHUB_RUN_ID}.tar.gz -C bundle .
185+
186+
- name: Upload aggregated evidence bundle
187+
uses: actions/upload-artifact@v4
188+
with:
189+
name: go-live-evidence-bundle
190+
path: |
191+
go-live-evidence-*.tar.gz
192+
bundle/evidence_manifest.txt

‎.github/workflows/key-rotation-drill.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Key Rotation Drill
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 8 1 */3 *"
7+
8+
jobs:
9+
key-rotation-drill:
10+
runs-on: ubuntu-24.04
11+
steps:
12+
- uses: actions/checkout@v4
13+
14+
- name: Install dependencies
15+
run: |
16+
sudo apt-get update
17+
sudo apt-get install -y clang llvm libbpf-dev libsystemd-dev pkg-config cmake ninja-build python3-jsonschema
18+
19+
- name: Run key rotation drill
20+
run: BUILD_DIR=build-key-drill scripts/key_rotation_drill.sh

‎.github/workflows/perf.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,18 @@ jobs:
2727
- name: Build
2828
run: cmake --build build
2929

30-
- name: Perf regression
30+
- name: Perf regression (open/close microbench)
3131
run: sudo MAX_PCT=10 ITERATIONS=200000 FILE=/etc/hosts scripts/perf_compare.sh
32+
33+
- name: Perf workload suite (realistic file workloads)
34+
run: |
35+
sudo BIN=./build/aegisbpf \
36+
FILE=/etc/hosts \
37+
OPEN_ITERATIONS=200000 \
38+
READ_ITERATIONS=50000 \
39+
STAT_SAMPLE=400 \
40+
STAT_ITERATIONS=50 \
41+
MAX_OPEN_PCT=10 \
42+
MAX_READ_PCT=15 \
43+
MAX_STAT_PCT=15 \
44+
scripts/perf_workload_suite.sh

‎.github/workflows/release-drill.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Release Drill
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 6 1 * *"
7+
8+
jobs:
9+
release-drill:
10+
runs-on: [self-hosted, bpf-lsm]
11+
timeout-minutes: 45
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Install dependencies (if apt-get is available)
16+
run: |
17+
if command -v apt-get >/dev/null 2>&1; then
18+
sudo apt-get update
19+
sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build rpm python3-jsonschema linux-tools-common linux-tools-$(uname -r) || sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build rpm python3-jsonschema linux-tools-common
20+
fi
21+
22+
- name: Verify environment
23+
run: scripts/verify_env.sh --strict
24+
25+
- name: Require BPF LSM
26+
run: grep -qw bpf /sys/kernel/security/lsm
27+
28+
- name: Run release drill
29+
run: BUILD_DIR=build-release-drill SKIP_BPF_BUILD=OFF ARTIFACT_DIR=artifacts/release-drill scripts/release_drill.sh
30+
31+
- name: Upload release drill artifacts
32+
if: always()
33+
uses: actions/upload-artifact@v4
34+
with:
35+
name: release-drill-artifacts
36+
path: artifacts/release-drill/

‎.github/workflows/release.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,42 @@ permissions:
1212
attestations: write
1313

1414
jobs:
15+
e2e-gate:
16+
runs-on: [self-hosted, bpf-lsm]
17+
timeout-minutes: 30
18+
steps:
19+
- uses: actions/checkout@v4
20+
21+
- name: Install dependencies (if apt-get is available)
22+
run: |
23+
if command -v apt-get >/dev/null 2>&1; then
24+
sudo apt-get update
25+
sudo apt-get install -y clang llvm bpftool libbpf-dev libsystemd-dev pkg-config cmake ninja-build python3-jsonschema
26+
fi
27+
28+
- name: Verify environment
29+
run: scripts/verify_env.sh --strict
30+
31+
- name: Require BPF LSM
32+
run: grep -qw bpf /sys/kernel/security/lsm
33+
34+
- name: Configure
35+
run: cmake -S . -B build-e2e -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON
36+
37+
- name: Build
38+
run: cmake --build build-e2e
39+
40+
- name: Unit tests
41+
run: ctest --test-dir build-e2e --output-on-failure --timeout 120
42+
43+
- name: Enforce smoke test
44+
run: sudo BIN=./build-e2e/aegisbpf ENFORCE_SIGNAL=term scripts/smoke_enforce.sh
45+
46+
- name: Short soak reliability
47+
run: sudo AEGIS_BIN=./build-e2e/aegisbpf DURATION_SECONDS=180 MAX_RINGBUF_DROPS=100 MAX_RSS_GROWTH_KB=65536 scripts/soak_reliability.sh
48+
1549
build-release:
50+
needs: [e2e-gate]
1651
strategy:
1752
fail-fast: false
1853
matrix:

0 commit comments

Comments
 (0)