ruby/.github/workflows/shstk-amd64.yml at master · github/ruby · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: SHSTK AMD64

on:
  push:
    paths-ignore:
      - 'doc/**'
      - '**/man/*'
      - '**.md'
      - '**.rdoc'
      - '**/.document'
      - '.*.yml'
  pull_request:
    paths-ignore:
      - 'doc/**'
      - '**/man/*'
      - '**.md'
      - '**.rdoc'
      - '**/.document'
      - '.*.yml'
  merge_group:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}

permissions:
  contents: read

jobs:
  shstk:
    name: make (check, SHSTK)
    runs-on: ubuntu-24.04

    if: >-
      ${{!(false
      || contains(github.event.head_commit.message, '[DOC]')
      || contains(github.event.pull_request.title, '[DOC]')
      || contains(github.event.pull_request.labels.*.name, 'Documentation')
      || (github.event.pull_request.user.login == 'dependabot[bot]')
      )}}

    container:
      image: ghcr.io/ruby/fedora:44

    env:
      CONFIGURE_TTY: never
      GLIBC_TUNABLES: glibc.cpu.hwcaps=SHSTK
      GNUMAKEFLAGS: -sj4
      RUBY_DEBUG: ci

    steps:
      - name: Install dependencies
        run: >-
          dnf install -y
          autoconf automake binutils gcc gcc-c++ git libffi-devel libtool
          libyaml-devel make ncurses-devel openssl-devel procps-ng
          readline-devel ruby ruby-devel shadow-utils zlib-devel
        working-directory:

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: /.github
          persist-credentials: false

      - uses: $/.github/actions/setup/directories
        with:
          srcdir: src
          builddir: build
          makeup: true
          clean: true

      - name: Create test user
        run: |
          useradd --create-home ruby
          chown -R ruby:ruby "$GITHUB_WORKSPACE"
        working-directory:

      - name: Run configure
        run: >-
          runuser -u ruby -- ../src/configure -C
          --enable-debug-env
          --disable-install-doc
          --with-gcc="gcc -fcf-protection=return"

      - run: runuser -u ruby -- make

      - name: Require active shadow stacks
        run: |
          readelf --notes ./miniruby | grep 'x86 feature: SHSTK'
          runuser -u ruby -- ./miniruby -e '
            line = File.foreach("/proc/self/status").find { |entry| entry.start_with?("x86_Thread_features:") }
            features = line&.split(":", 2)&.last&.split || []
            unless features.include?("shstk")
              warn "::notice::SHSTK is not active (x86_Thread_features: #{features.join(" ")})"
              cpuinfo = File.read("/proc/cpuinfo")
              model = cpuinfo[/^model name.*/]
              flags = cpuinfo[/^flags.*/]
              puts model, flags, ENV["GLIBC_TUNABLES"]
              exit !/\buser_shstk\b/.match?(flags)
            end
          '

      - name: make check
        env:
          RUBY_TESTOPTS: '-q --tty=no'
        run: runuser -u ruby -- make -s check RUBYOPT=-w
        timeout-minutes: 40

defaults:
  run:
    working-directory: build