1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: CI
on:
push:
branches:
pull_request:
branches:
schedule:
- cron: "0 6 * * 1" # weekly Monday 06:00 UTC — surfaces expired allowlist entries and new advisories
permissions:
contents: read
jobs:
ci:
uses: brefwiz/shared-ci-workflows/.github/workflows/rust.yml@main
with:
run-coverage: false # coverage handled in e2e job
run-no-std: false
run-no-default-features: false # crate requires at least one of: grpc, http
extra-test-flags: "-E 'not binary(e2e)'" # re-enable via run-collector once shared workflow merges
# Heap profiling on the target consuming services actually ship.
#
# The `ci` job above runs heap-probe against the host target: dynamically
# linked glibc. Every consumer ships a STATICALLY LINKED MUSL binary
# (FROM scratch images, --target x86_64-unknown-linux-musl), and jemalloc's
# prof walks a stack on every sampled allocation — which is exactly what a
# static musl binary has no working unwinder for.
#
# brefwiz-spiffe 0.48.0, 0.49.0 and 0.49.1 each shipped heap profiling
# broken, and each was caught by a rollout rather than by CI: 0.49.1
# segfaulted (exit 139) in staging under the very configuration the glibc
# probe proves "works". The arch matters too — the same probe passes on
# aarch64 musl, so only x86_64 musl reproduces it.
#
# ubuntu-latest is x86_64, so the musl binary runs natively here. No QEMU,
# no emulation caveat: this is the shipped target.
heap-profiling-musl:
name: Heap profiling (static musl, shipped target)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
# No host toolchain setup: the target runs everything inside a musl
# container, which is also where libunwind built against musl comes from.
# Same environment here and on a dev machine, so a green here is not a
# property of the runner.
- name: Heap probe on static musl
run: make ci-heap-probe-musl
# Coverage gate requires a live OTel Collector on :4317.
e2e:
name: E2E + Coverage
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: dtolnay/rust-toolchain@stable
with:
components: llvm-tools-preview
- name: Install cargo-nextest and cargo-llvm-cov
run: |
cargo install cargo-nextest --version 0.9.114 --locked
cargo install cargo-llvm-cov --locked
- name: Start OTel Collector
env:
OTEL_COLLECTOR_IMAGE: otel/opentelemetry-collector-contrib:0.150.1
PYROSCOPE_IMAGE: grafana/pyroscope:1.13.0
run: |
mkdir -p collector-output && chmod 777 collector-output
docker compose up -d
echo "Waiting for collector health endpoint on :13133..."
for i in $(seq 1 60); do
if curl -sf http://localhost:13133/ > /dev/null 2>&1; then
echo "Collector ready after ${i}s"
exit 0
fi
sleep 1
done
echo "Collector did not become ready within 60 seconds"
docker compose ps
docker compose logs --tail=100
exit 1
- name: Coverage gate (≤1 uncovered line)
run: make ci-coverage
- name: Collector diagnostics
if: failure()
run: |
echo "=== Collector logs ===" && docker compose logs --tail=100
echo "=== Traces ===" && cat collector-output/traces.jsonl 2>/dev/null || true
- name: Teardown
if: always()
run: docker compose down 2>/dev/null || true