feat(ci): support optional & ordered actions with jobs/prs

.asf.yaml

@@ -38,12 +38,8 @@ github:
         strict: false
         # contexts are the names of checks that must pass (now only enable the basic check)
         contexts:
-          - Analyze (java)
-          - CodeQL
           - check-license
-          # Require the fixed memory result gate, independent of the runtime JDK list.
-          # Commons CI continues to run without blocking merges.
-          - Server memory tests
+          - affected-module-tests
       required_pull_request_reviews:
         dismiss_stale_reviews: true
         require_code_owner_reviews: false

.github/scripts/check-docker-images.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -euo pipefail
+: "${IMAGE_TAG:?set the unique CI image tag}"
+for pair in \
+    hugegraph-pd/Dockerfile=hugegraph/pd \
+    hugegraph-store/Dockerfile=hugegraph/store \
+    hugegraph-server/Dockerfile=hugegraph/hugegraph \
+    hugegraph-server/Dockerfile-hstore=hugegraph/server; do
+    (
+        dockerfile="${pair%%=*}"
+        IMAGE_ID=$(docker image inspect --format '{{.Id}}' "${pair#*=}:${IMAGE_TAG}")
+        echo "Checking ${pair#*=}:${IMAGE_TAG} ($IMAGE_ID)"
+        HC=$(docker image inspect --format '{{json .Config.Healthcheck}}' "$IMAGE_ID")
+        [[ "$HC" != null ]] || { echo "Missing HEALTHCHECK: $dockerfile"; exit 1; }
+
+        JAVA_VERSION=$(docker run --rm --pull never --entrypoint java "$IMAGE_ID" -version 2>&1)
+        echo "$JAVA_VERSION"
+        grep -Eq 'version "17\.' <<< "$JAVA_VERSION" || {
+            echo "ERROR: expected a Java 17 runtime in $dockerfile"
+            exit 1
+        }
+
+        if [[ "$dockerfile" == hugegraph-server/* ]]; then
+            STATE=$(docker run --rm --pull never "$IMAGE_ID" bash -c \
+                'source /hugegraph-server/bin/util.sh && port_listen_state 8080')
+            echo "port_listen_state 8080 -> $STATE"
+            # Require a usable answer from the socket-table tool in the image.
+            [[ "$STATE" == "free" || "$STATE" == "busy" ]] || {
+                echo "ERROR: no usable socket-table tool (ss/netstat) in $dockerfile"
+                exit 1
+            }
+        fi
+
+        if [[ "$dockerfile" == hugegraph-server/* ]]; then
+            CHECK_DIR=$(mktemp -d)
+            trap 'rm -rf "$CHECK_DIR"' EXIT
+            docker run --rm --pull never --entrypoint bash \
+                -v "$CHECK_DIR:/check" "$IMAGE_ID" -c \
+                'cp /hugegraph-server/lib/hugegraph-api-*.jar \
+                    /hugegraph-server/lib/hugegraph-common-*.jar /check/'
+
+            API_JAR=$(find "$CHECK_DIR" -name 'hugegraph-api-*.jar' -print -quit)
+            COMMON_JAR=$(find "$CHECK_DIR" -name 'hugegraph-common-*.jar' -print -quit)
+            EXPECTED_MANIFEST=$(sed -n \
+                's|.*<Implementation-Version>\([^<]*\)</Implementation-Version>.*|\1|p' \
+                hugegraph-server/hugegraph-api/pom.xml)
+            ACTUAL_MANIFEST=$(unzip -p "$API_JAR" META-INF/MANIFEST.MF |
+                sed -n 's/^Implementation-Version: *//p' | tr -d '\r')
+            EXPECTED_PROPERTY=$(sed -n 's/^ApiVersion=//p' \
+                hugegraph-commons/hugegraph-common/src/main/resources/version.properties)
+            ACTUAL_PROPERTY=$(unzip -p "$COMMON_JAR" version.properties |
+                sed -n 's/^ApiVersion=//p' | tr -d '\r')
+
+            [[ "$ACTUAL_MANIFEST" == "$EXPECTED_MANIFEST" ]] || {
+                echo "ERROR: API manifest is $ACTUAL_MANIFEST; expected $EXPECTED_MANIFEST"
+                exit 1
+            }
+            [[ "$ACTUAL_PROPERTY" == "$EXPECTED_PROPERTY" ]] || {
+                echo "ERROR: API property is $ACTUAL_PROPERTY; expected $EXPECTED_PROPERTY"
+                exit 1
+            }
+        fi
+    )
+done

.github/scripts/check-rerun.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Check the failed run again immediately before an automatic retry."""
+
+import argparse
+import json
+import os
+import subprocess
+from urllib.parse import urlencode
+
+
+def api(path):
+    result = subprocess.run(
+        ["gh", "api", "--method", "GET", path], check=True,
+        capture_output=True, timeout=30,
+    )
+    return json.loads(result.stdout)
+
+
+def decide(repository, run_id, expected_attempt, max_reruns, fetch=api):
+    run = fetch(f"repos/{repository}/actions/runs/{run_id}")
+    if (run.get("status") != "completed" or run.get("conclusion") != "failure"
+            or run.get("run_attempt") != expected_attempt):
+        return "skip", "source run changed or is no longer a completed failure"
+    if expected_attempt > max_reruns:
+        return "skip", "retry limit reached"
+    sha = run.get("head_sha")
+    if not sha:
+        return "skip", "missing head SHA"
+    if run.get("event") == "pull_request":
+        return "skip", "PR automatic retry paused: CI artifacts cannot independently prove the tested code"
+    if run.get("event") == "push":
+        if (run.get("repository", {}).get("full_name") != repository
+                or run.get("head_repository", {}).get("full_name") != repository):
+            return "skip", "push source repository differs"
+        branch = run.get("head_branch")
+        if not branch:
+            return "skip", "missing push branch"
+        # Read from the workflow repository, never a similarly named fork branch.
+        commits = fetch(f"repos/{repository}/commits?" + urlencode({"sha": branch, "per_page": 1}))
+        if commits and commits[0].get("sha") == sha:
+            return "rerun", "push branch head unchanged"
+        return "skip", "push branch head moved"
+    return "skip", "unsupported source event"
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--repository", required=True)
+    parser.add_argument("--run-id", required=True, type=int)
+    parser.add_argument("--run-attempt", required=True, type=int)
+    parser.add_argument("--max-reruns", required=True, type=int)
+    args = parser.parse_args()
+    try:
+        action, reason = decide(args.repository, args.run_id, args.run_attempt, args.max_reruns)
+    except (subprocess.SubprocessError, OSError, ValueError, KeyError, TypeError, AttributeError):
+        action, reason = "skip", "unable to verify current run and source metadata"
+    print(f"{action}: {reason}")
+    with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+        output.write(f"action={action}\nreason={reason}\n")
+
+
+if __name__ == "__main__":
+    main()