xprobe/.github/workflows/release.yml at master · itdevwu/xprobe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  cupti-agent:
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - cuda_major: 12
            image: nvidia/cuda:12.9.1-devel-ubuntu22.04@sha256:bd4e2680a261c212f1e2fea241606f71497dc67a417f73175d794ec8212b5ba8
          - cuda_major: 13
            image: nvidia/cuda:13.3.0-devel-ubuntu22.04@sha256:cbe2f44080865228de493c496427aa7b414866979fc3bb547e0197e9c31e77bb
    container:
      image: ${{ matrix.image }}
    steps:
      - uses: actions/checkout@v6
      - name: Install build tools
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            binutils build-essential ca-certificates cmake ninja-build
      - name: Build CUDA ${{ matrix.cuda_major }} Agent
        run: |
          cmake -S . -B build/cuda -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DXPROBE_BUILD_BPF=OFF \
            -DXPROBE_BUILD_CUPTI=ON \
            -DXPROBE_REQUIRE_CUPTI=ON \
            -DXPROBE_CUDA_MAJOR=${{ matrix.cuda_major }}
          cmake --build build/cuda --target xprobe-cupti
          readelf -d build/cuda/cupti/libxprobe-cupti.so |
            grep -F 'Shared library: [libcupti.so.${{ matrix.cuda_major }}]'
          if readelf -d build/cuda/cupti/libxprobe-cupti.so |
             grep -E '\((RPATH|RUNPATH)\)'; then
            exit 1
          fi
      - uses: actions/upload-artifact@v7
        with:
          name: xprobe-cupti-cuda${{ matrix.cuda_major }}-linux-x86_64
          path: build/cuda/cupti/libxprobe-cupti.so
          if-no-files-found: error

  linux-x86_64:
    needs: cupti-agent
    runs-on: ubuntu-22.04
    permissions:
      actions: read
      attestations: write
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6
      - name: Install build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            autoconf automake autopoint bison build-essential ca-certificates \
            clang curl flex gawk libtool pkg-config python3
      - name: Install Rust
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - uses: actions/download-artifact@v8
        with:
          name: xprobe-cupti-cuda12-linux-x86_64
          path: build/cuda12/cupti
      - uses: actions/download-artifact@v8
        with:
          name: xprobe-cupti-cuda13-linux-x86_64
          path: build/cuda13/cupti
      - name: Build release archive
        id: package
        run: |
          version=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)
          test "$GITHUB_REF_NAME" = "v$version"
          echo "name=xprobe-${version}-linux-x86_64" >> "$GITHUB_OUTPUT"
          scripts/package-release.sh
      - name: Verify release installation
        run: >-
          tests/install/test_install.sh
          dist/${{ steps.package.outputs.name }}.tar.gz
      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          file: dist/${{ steps.package.outputs.name }}.tar.gz
          format: spdx-json
          output-file: dist/${{ steps.package.outputs.name }}.spdx.json
          upload-artifact: false
          upload-release-assets: false
      - name: Verify SPDX SBOM
        run: >-
          scripts/check-release-sbom.py
          dist/${{ steps.package.outputs.name }}.spdx.json
      - name: Attest build provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-path: dist/${{ steps.package.outputs.name }}.tar.gz
      - name: Attest SPDX SBOM
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-path: dist/${{ steps.package.outputs.name }}.tar.gz
          sbom-path: dist/${{ steps.package.outputs.name }}.spdx.json
      - uses: actions/upload-artifact@v7
        with:
          name: xprobe-linux-x86_64
          path: |
            dist/${{ steps.package.outputs.name }}.tar.gz
            dist/${{ steps.package.outputs.name }}.tar.gz.sha256
            dist/${{ steps.package.outputs.name }}.spdx.json
      - uses: softprops/action-gh-release@v3
        with:
          files: |
            dist/${{ steps.package.outputs.name }}.tar.gz
            dist/${{ steps.package.outputs.name }}.tar.gz.sha256
            dist/${{ steps.package.outputs.name }}.spdx.json
          generate_release_notes: true
      - name: Verify public release archive
        env:
          GH_TOKEN: ${{ github.token }}
          XPROBE_VERIFY_ATTESTATIONS: "1"
          XPROBE_RELEASE_REPOSITORY: ${{ github.repository }}
        run: scripts/verify-public-release.sh "${GITHUB_REF_NAME#v}"