tests: resolve through the local dnsmasq cache in CI. #162

Workflow file for this run

.github/workflows/build_and_test.yml at cb0d1e7

	name: Build and test

	on:
	push:
	branches: [ master ]
	pull_request:
	branches: [ master ]

	jobs:
	test:
	name: ${{ matrix.name }}
	runs-on: ubuntu-latest

	strategy:
	fail-fast: false
	matrix:
	include:
	- name: "nginx 1.31.6 + OpenSSL"
	NGINX_VERSION: "1.31.6"
	TEST_NGINX_TIMEOUT: "5"

	- name: "nginx 1.31.6 + OpenSSL + HTTP/2"
	NGINX_VERSION: "1.31.6"
	TEST_NGINX_TIMEOUT: "5"
	TEST_NGINX_USE_HTTP2: "1"

	- name: "nginx 1.31.6 + OpenSSL + HTTP/3"
	NGINX_VERSION: "1.31.6"
	TEST_NGINX_USE_HTTP3: "1"
	TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"

	- name: "nginx 1.31.6 + BoringSSL + HTTP/3"
	NGINX_VERSION: "1.31.6"
	BORINGSSL: "1"
	TEST_NGINX_USE_HTTP3: "1"
	TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"

	services:
	redis:
	image: redis:7-alpine
	ports:
	- 6379:6379
	mysql:
	image: mysql:8.0
	env:
	MYSQL_ALLOW_EMPTY_PASSWORD: yes
	ports:
	- 3306:3306
	options: >-
	--health-cmd="mysqladmin ping --silent"
	--health-interval=10s
	--health-timeout=5s
	--health-retries=10

	env:
	JOBS: 3
	NGX_BUILD_JOBS: 3
	CC: gcc
	DRIZZLE_VER: "2011.07.21"
	LUAJIT_PREFIX: /opt/luajit21
	LUAJIT_LIB: /opt/luajit21/lib
	LUAJIT_INC: /opt/luajit21/include/luajit-2.1
	LUA_INCLUDE_DIR: /opt/luajit21/include/luajit-2.1
	PCRE2_PREFIX: /usr/local/openresty/pcre2
	PCRE2_LIB: /usr/local/openresty/pcre2/lib
	PCRE2_INC: /usr/local/openresty/pcre2/include
	OPENSSL_PREFIX: /usr/local/openresty/openssl3
	OPENSSL_LIB: /usr/local/openresty/openssl3/lib
	OPENSSL_INC: /usr/local/openresty/openssl3/include
	LIBDRIZZLE_PREFIX: /opt/drizzle
	LIBDRIZZLE_INC: /opt/drizzle/include/libdrizzle-1.0
	LIBDRIZZLE_LIB: /opt/drizzle/lib
	TEST_NGINX_SLEEP: "0.006"
	TEST_NGINX_SKIP_COSOCKET_LOG_TEST: "1"
	MALLOC_PERTURB_: "9"

	steps:
	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

	- name: Install system packages
	run: \|
	sudo apt-get update -q
	sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
	ack axel cpanminus \
	libtest-base-perl libtext-diff-perl liburi-perl libwww-perl \
	libtest-longstring-perl liblist-moreutils-perl \
	libgd-dev time cmake libunwind-dev wget \
	libbrotli1 lsb-release gnupg ca-certificates dnsutils

	- name: Install Perl test modules
	run: \|
	/usr/bin/env perl $(command -v cpanm) --sudo --notest \
	Test::Nginx IPC::Run Test2::Util > build.log 2>&1 \|\| (cat build.log && exit 1)

	- name: Add OpenResty apt repository
	run: \|
	wget -qO- https://openresty.org/package/pubkey.gpg \| gpg --dearmor \| sudo tee /usr/share/keyrings/openresty.gpg > /dev/null
	echo "deb [signed-by=/usr/share/keyrings/openresty.gpg] https://openresty.org/package/ubuntu $(lsb_release -sc) main" \
	\| sudo tee /etc/apt/sources.list.d/openresty.list
	sudo apt-get update -q
	sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
	openresty-pcre2 openresty-openssl3 openresty-pcre2-dev openresty-openssl3-dev

	- name: Cache download directory
	uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
	with:
	path: download-cache
	key: download-cache-${{ runner.os }}-drizzle-${{ env.DRIZZLE_VER }}

	- name: Source code style check
	run: \|
	! grep -n -P '(?<=.{80}).+' --color $(find src -name '.c') $(find . -name '.h') \
	\|\| (echo "ERROR: Found C source lines exceeding 80 columns." >&2; exit 1)
	! grep -n -P '\t+' --color $(find src -name '.c') $(find . -name '.h') \
	\|\| (echo "ERROR: Cannot use tabs." >&2; exit 1)

	- name: Clone dependency repositories
	run: \|
	# Sibling repos — build scripts reference them via $root/../<name>
	git clone --depth=1 https://github.com/openresty/openresty.git ../openresty
	git clone --depth=1 https://github.com/openresty/no-pool-nginx.git ../no-pool-nginx
	git clone --depth=1 https://github.com/openresty/lua-upstream-nginx-module.git ../lua-upstream-nginx-module
	git clone --depth=1 https://github.com/openresty/echo-nginx-module.git ../echo-nginx-module
	git clone --depth=1 https://github.com/openresty/nginx-eval-module.git ../nginx-eval-module
	git clone --depth=1 https://github.com/openresty/ngx_devel_kit.git ../ndk-nginx-module
	git clone --depth=1 https://github.com/FRiCKLE/ngx_coolkit.git ../coolkit-nginx-module
	git clone --depth=1 https://github.com/openresty/headers-more-nginx-module.git ../headers-more-nginx-module
	git clone --depth=1 https://github.com/openresty/drizzle-nginx-module.git ../drizzle-nginx-module
	git clone --depth=1 https://github.com/openresty/set-misc-nginx-module.git ../set-misc-nginx-module
	git clone --depth=1 https://github.com/openresty/memc-nginx-module.git ../memc-nginx-module
	git clone --depth=1 https://github.com/openresty/rds-json-nginx-module.git ../rds-json-nginx-module
	git clone --depth=1 https://github.com/openresty/srcache-nginx-module.git ../srcache-nginx-module
	git clone --depth=1 https://github.com/openresty/redis2-nginx-module.git ../redis2-nginx-module
	git clone --depth=1 https://github.com/openresty/lua-resty-core.git ../lua-resty-core
	git clone --depth=1 https://github.com/openresty/lua-resty-lrucache.git ../lua-resty-lrucache
	git clone --depth=1 https://github.com/openresty/lua-resty-mysql.git ../lua-resty-mysql
	git clone --depth=1 https://github.com/spacewander/lua-resty-rsa.git ../lua-resty-rsa
	git clone --depth=1 https://github.com/openresty/lua-resty-string.git ../lua-resty-string
	git clone --depth=1 https://github.com/openresty/stream-lua-nginx-module.git ../stream-lua-nginx-module

	# Local repos — used directly from the working directory
	git clone --depth=1 https://github.com/openresty/test-nginx.git
	git clone --depth=1 https://github.com/openresty/openresty-devel-utils.git
	git clone --depth=1 https://github.com/openresty/mockeagain.git
	git clone --depth=1 https://github.com/openresty/lua-cjson.git lua-cjson
	git clone -b v2.1-agentzh --depth=1 https://github.com/openresty/luajit2.git luajit2

	- name: Download prebuilt tarballs
	run: \|
	mkdir -p download-cache
	if [ ! -f download-cache/drizzle7-$DRIZZLE_VER.tar.gz ]; then
	wget -P download-cache \
	https://github.com/openresty/openresty-deps-prebuild/releases/download/v20230902/drizzle7-$DRIZZLE_VER.tar.gz
	fi
	wget https://github.com/openresty/openresty-deps-prebuild/releases/download/v20230902/boringssl-20230902-x64-focal.tar.gz
	wget https://github.com/stunnel/static-curl/releases/download/8.20.0/curl-linux-x86_64-glibc-8.20.0.tar.xz

	- name: Install HTTP/3-capable curl
	run: \|
	sudo mkdir -p /opt/curl/bin
	sudo tar -C /opt/curl/bin -xf curl-linux-x86_64-glibc-8.20.0.tar.xz curl

	- name: Start memcached (native, UDP enabled)
	run: \|
	sudo apt-get install -y --no-install-recommends memcached
	sudo systemctl stop memcached
	# Ubuntu's default /etc/memcached.conf has "-U 0" which disables UDP.
	# Start manually with UDP on port 11211 so udp-socket tests pass.
	memcached -d -l 127.0.0.1 -p 11211 -U 11211 -m 64
	sudo ss -lntup \| grep 11211


	- name: Set up MySQL test database
	run: \|
	mysql -h 127.0.0.1 -P 3306 -uroot \
	-e "CREATE DATABASE ngx_test; \
	CREATE USER 'ngx_test'@'%' IDENTIFIED WITH mysql_native_password BY 'ngx_test'; \
	GRANT ALL ON ngx_test.* TO 'ngx_test'@'%'; \
	FLUSH PRIVILEGES;"

	- name: Set up network rules
	run: \|
	sudo iptables -I OUTPUT 1 -p udp --dport 10086 -j REJECT
	sudo iptables -I OUTPUT -p tcp --dst 127.0.0.2 --dport 12345 -j DROP
	sudo iptables -I OUTPUT -p udp --dst 127.0.0.2 --dport 12345 -j DROP
	sudo ip route add prohibit 0.0.0.1/32
	sudo sysctl -w kernel.pid_max=10000

	- name: Start local DNS cache (dnsmasq)
	run: \|
	sudo apt-get install -y --no-install-recommends dnsmasq
	# Stop any pre-installed dnsmasq instance from the package's default unit.
	sudo systemctl stop dnsmasq 2>/dev/null \|\| true
	# --no-resolv: ignore /etc/resolv.conf (which on ubuntu-latest points at
	# systemd-resolved on 127.0.0.53), so we never loop back to ourselves.
	# Listen on 127.0.0.1:53: systemd-resolved's stub owns 127.0.0.53:53
	# only, so this address is free, and --bind-interfaces keeps us off
	# every other one. The tests can then name the resolver as a bare IP,
	# which t/087-udp-socket.t TEST 10 needs: it hands
	# $TEST_NGINX_RESOLVER to setpeername() with port 53.
	# --host-record: --no-hosts keeps /etc/hosts out, and public resolvers
	# do not answer "localhost" (RFC 6761 makes it the stub resolver's
	# job), so answer it here instead of relying on an outside name.
	sudo dnsmasq --port=53 \
	--listen-address=127.0.0.1 \
	--bind-interfaces \
	--no-resolv --no-hosts \
	--host-record=localhost,127.0.0.1,::1 \
	--host-record=trailing-dot.test,127.0.0.1 \
	--server=8.8.4.4 --server=8.8.8.8 --server=1.1.1.1 \
	--cache-size=1000 \
	--pid-file=/tmp/dnsmasq.pid
	sudo ss -lnupt \| grep -q '127\.0\.0\.1:53' \
	\|\| (echo "ERROR: dnsmasq is not listening on 127.0.0.1:53" >&2; exit 1)
	# localhost must resolve locally, or the resolver tests fail.
	dig +short @127.0.0.1 localhost
	# Warm the cache for all external hostnames the test suite resolves.
	for h in openresty.org www.openresty.org agentzh.org sregex.org \
	www.google.com google-public-dns-a.google.com; do
	dig +short +tries=3 +time=2 @127.0.0.1 "$h" \|\| true
	done

	- name: Build LuaJIT
	run: \|
	cd luajit2
	make -j$JOBS CCDEBUG=-g Q= PREFIX=$LUAJIT_PREFIX CC=$CC \
	XCFLAGS='-DLUA_USE_APICHECK -DLUA_USE_ASSERT -msse4.2' \
	> build.log 2>&1 \|\| (cat build.log && exit 1)
	sudo make install PREFIX=$LUAJIT_PREFIX > build.log 2>&1 \|\| (cat build.log && exit 1)

	- name: Build drizzle7
	run: \|
	tar xzf download-cache/drizzle7-$DRIZZLE_VER.tar.gz
	cd drizzle7-$DRIZZLE_VER
	./configure --prefix=$LIBDRIZZLE_PREFIX --without-server \
	> build.log 2>&1 \|\| (cat build.log && exit 1)
	make libdrizzle-1.0 -j$JOBS > build.log 2>&1 \|\| (cat build.log && exit 1)
	sudo make install-libdrizzle-1.0 > build.log 2>&1 \|\| (cat build.log && exit 1)

	- name: Build mockeagain
	run: cd mockeagain && make CC=$CC -j$JOBS

	- name: Build lua-cjson
	run: cd lua-cjson && make -j$JOBS && sudo make install

	- name: Set up BoringSSL
	if: matrix.BORINGSSL == '1'
	run: \|
	sudo rm -fr $OPENSSL_PREFIX
	sudo mkdir -p $OPENSSL_PREFIX
	sudo tar -C $OPENSSL_PREFIX -xf boringssl-20230902-x64-focal.tar.gz --strip-components=1

	- name: Build nginx
	run: \|
	export LD_LIBRARY_PATH=$LUAJIT_LIB:$LD_LIBRARY_PATH
	export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl/bin:$PATH
	export NGX_BUILD_CC=$CC
	sh util/build-without-ssl.sh ${{ matrix.NGINX_VERSION }} > build.log 2>&1 \|\| (cat build.log && exit 1)
	sh util/build-with-dd.sh ${{ matrix.NGINX_VERSION }} > build.log 2>&1 \|\| (cat build.log && exit 1)
	rm -fr buildroot
	sh util/build.sh ${{ matrix.NGINX_VERSION }} > build.log 2>&1 \|\| (cat build.log && exit 1)
	nginx -V
	ldd $(which nginx) \| grep -E 'luajit\|ssl\|pcre'

	- name: Run releng check
	run: \|
	export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl/bin:$PATH
	ngx-releng > check.txt \|\| true
	lines=$(wc -l check.txt \| awk '{print $1}')
	if [ "$lines" -gt 5 ]; then cat check.txt; exit 1; fi

	- name: Set matrix-specific test env vars
	run: \|
	# Only export vars that have actual values — Perl's defined() treats
	# empty strings as defined, which would cause false positives in tests
	# like t/103-req-http-ver.t that branch on defined $ENV{TEST_NGINX_USE_HTTP3}.
	[ -n "${{ matrix.TEST_NGINX_TIMEOUT }}" ] \
	&& echo "TEST_NGINX_TIMEOUT=${{ matrix.TEST_NGINX_TIMEOUT }}" >> $GITHUB_ENV \|\| true
	[ -n "${{ matrix.TEST_NGINX_USE_HTTP2 }}" ] \
	&& echo "TEST_NGINX_USE_HTTP2=${{ matrix.TEST_NGINX_USE_HTTP2 }}" >> $GITHUB_ENV \|\| true
	[ -n "${{ matrix.TEST_NGINX_USE_HTTP3 }}" ] \
	&& echo "TEST_NGINX_USE_HTTP3=${{ matrix.TEST_NGINX_USE_HTTP3 }}" >> $GITHUB_ENV \|\| true
	[ -n "${{ matrix.TEST_NGINX_QUIC_IDLE_TIMEOUT }}" ] \
	&& echo "TEST_NGINX_QUIC_IDLE_TIMEOUT=${{ matrix.TEST_NGINX_QUIC_IDLE_TIMEOUT }}" >> $GITHUB_ENV \|\| true

	- name: Run tests
	run: \|
	export LD_LIBRARY_PATH=$LUAJIT_LIB:$PWD/mockeagain:$LD_LIBRARY_PATH
	export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl/bin:$PATH
	export LD_PRELOAD=$PWD/mockeagain/mockeagain.so
	export TEST_NGINX_HTTP3_CRT=$PWD/t/cert/http3/http3.crt
	export TEST_NGINX_HTTP3_KEY=$PWD/t/cert/http3/http3.key
	# Resolve through the local dnsmasq cache. Without this the test files
	# fall back to their own default of 8.8.8.8, which sends every query
	# out to a public resolver -- the very thing the cache is here to
	# avoid -- and which cannot answer "localhost", so t/014-bugs.t TEST 37
	# and t/058-tcp-socket.t TEST 4 fail.
	export TEST_NGINX_RESOLVER=127.0.0.1
	export TEST_NGINX_OPENRESTY_ORG_IP=$(dig +short @127.0.0.1 openresty.org \| head -n1)
	dig +short @127.0.0.1 openresty.org \|\| true
	dig +short @127.0.0.1 agentzh.org \|\| true
	python3 ./util/nc_server.py &
	/usr/bin/env perl $(command -v prove) -I. -Itest-nginx/inc -Itest-nginx/lib -r t/

Navigation Menu

tests: resolve through the local dnsmasq cache in CI. #162

Workflow file

tests: resolve through the local dnsmasq cache in CI. #162

Uh oh!

Workflow file for this run