mirror of
https://github.com/zama-ai/tfhe-rs.git
synced 2026-01-09 14:47:56 -05:00
This is part of security issues remediation campaign after having analyzed workflow using zizmor cargo tool.
158 lines
5.7 KiB
YAML
158 lines
5.7 KiB
YAML
# Perfom tfhe-cuda-backend post-commit checks on an AWS instance
|
|
name: Cuda - Post-commit Checks
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
ACTION_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
RUSTFLAGS: "-C target-cpu=native"
|
|
RUST_BACKTRACE: "full"
|
|
RUST_MIN_STACK: "8388608"
|
|
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
|
|
SLACK_ICON: https://pbs.twimg.com/profile_images/1274014582265298945/OjBKP9kn_400x400.png
|
|
SLACK_USERNAME: ${{ secrets.BOT_USERNAME }}
|
|
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
|
|
SLACKIFY_MARKDOWN: true
|
|
PULL_REQUEST_MD_LINK: ""
|
|
CHECKOUT_TOKEN: ${{ secrets.REPO_CHECKOUT_TOKEN || secrets.GITHUB_TOKEN }}
|
|
# Secrets will be available only to zama-ai organization members
|
|
SECRETS_AVAILABLE: ${{ secrets.JOB_SECRET != '' }}
|
|
EXTERNAL_CONTRIBUTION_RUNNER: "large_ubuntu_16-22.04"
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
setup-instance:
|
|
name: Setup instance (cuda-pcc)
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
runner-name: ${{ steps.start-remote-instance.outputs.label || steps.start-github-instance.outputs.runner_group }}
|
|
steps:
|
|
- name: Start remote instance
|
|
id: start-remote-instance
|
|
if: env.SECRETS_AVAILABLE == 'true'
|
|
uses: zama-ai/slab-github-runner@79939325c3c429837c10d6041e4fd8589d328bac
|
|
with:
|
|
mode: start
|
|
github-token: ${{ secrets.SLAB_ACTION_TOKEN }}
|
|
slab-url: ${{ secrets.SLAB_BASE_URL }}
|
|
job-secret: ${{ secrets.JOB_SECRET }}
|
|
backend: aws
|
|
profile: gpu-build
|
|
|
|
# This instance will be spawned especially for pull-request from forked repository
|
|
- name: Start GitHub instance
|
|
id: start-github-instance
|
|
if: env.SECRETS_AVAILABLE == 'false'
|
|
run: |
|
|
echo "runner_group=${{ env.EXTERNAL_CONTRIBUTION_RUNNER }}" >> "$GITHUB_OUTPUT"
|
|
|
|
cuda-pcc:
|
|
name: CUDA post-commit checks
|
|
needs: setup-instance
|
|
concurrency:
|
|
group: ${{ github.workflow_ref }}
|
|
cancel-in-progress: true
|
|
runs-on: ${{ needs.setup-instance.outputs.runner-name }}
|
|
strategy:
|
|
fail-fast: false
|
|
# explicit include-based build matrix, of known valid options
|
|
matrix:
|
|
include:
|
|
- os: ubuntu-22.04
|
|
cuda: "12.2"
|
|
gcc: 9
|
|
env:
|
|
CUDA_PATH: /usr/local/cuda-${{ matrix.cuda }}
|
|
|
|
steps:
|
|
- name: Checkout tfhe-rs
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
|
with:
|
|
persist-credentials: 'false'
|
|
token: ${{ env.CHECKOUT_TOKEN }}
|
|
|
|
- name: Install CUDA
|
|
if: env.SECRETS_AVAILABLE == 'false'
|
|
shell: bash
|
|
run: |
|
|
TOOLKIT_VERSION="$(echo ${{ matrix.cuda }} | sed 's/\(.*\)\.\(.*\)/\1-\2/')"
|
|
wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb
|
|
sudo dpkg -i cuda-keyring_1.1-1_all.deb
|
|
sudo apt update
|
|
sudo apt -y install "cuda-toolkit-${TOOLKIT_VERSION}" cmake-format
|
|
|
|
- name: Install latest stable
|
|
uses: dtolnay/rust-toolchain@888c2e1ea69ab0d4330cbf0af1ecc7b68f368cc1
|
|
with:
|
|
toolchain: stable
|
|
|
|
- name: Export CUDA variables
|
|
if: ${{ !cancelled() }}
|
|
run: |
|
|
echo "CUDA_PATH=$CUDA_PATH" >> "${GITHUB_ENV}"
|
|
echo "$CUDA_PATH/bin" >> "${GITHUB_PATH}"
|
|
echo "LD_LIBRARY_PATH=$CUDA_PATH/lib:$LD_LIBRARY_PATH" >> "${GITHUB_ENV}"
|
|
echo "CUDACXX=/usr/local/cuda-${{ matrix.cuda }}/bin/nvcc" >> "${GITHUB_ENV}"
|
|
|
|
# Specify the correct host compilers
|
|
- name: Export gcc and g++ variables
|
|
if: ${{ !cancelled() }}
|
|
run: |
|
|
{
|
|
echo "CC=/usr/bin/gcc-${{ matrix.gcc }}";
|
|
echo "CXX=/usr/bin/g++-${{ matrix.gcc }}";
|
|
echo "CUDAHOSTCXX=/usr/bin/g++-${{ matrix.gcc }}";
|
|
} >> "${GITHUB_ENV}"
|
|
|
|
- name: Run fmt checks
|
|
run: |
|
|
make check_fmt_gpu
|
|
|
|
- name: Run clippy checks
|
|
run: |
|
|
make pcc_gpu
|
|
|
|
- name: Set pull-request URL
|
|
if: ${{ failure() && github.event_name == 'pull_request' }}
|
|
run: |
|
|
echo "PULL_REQUEST_MD_LINK=[pull-request](${PR_BASE_URL}${{ github.event.pull_request.number }}), " >> "${GITHUB_ENV}"
|
|
env:
|
|
PR_BASE_URL: ${{ vars.PR_BASE_URL }}
|
|
|
|
- name: Slack Notification
|
|
if: ${{ failure() && env.SECRETS_AVAILABLE == 'true' }}
|
|
continue-on-error: true
|
|
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661
|
|
env:
|
|
SLACK_COLOR: ${{ job.status }}
|
|
SLACK_MESSAGE: "CUDA AWS post-commit checks finished with status: ${{ job.status }}. (${{ env.PULL_REQUEST_MD_LINK }}[action run](${{ env.ACTION_RUN_URL }}))"
|
|
|
|
teardown-instance:
|
|
name: Teardown instance (cuda-pcc)
|
|
if: ${{ always() && needs.setup-instance.result == 'success' }}
|
|
needs: [ setup-instance, cuda-pcc ]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Stop remote instance
|
|
id: stop-instance
|
|
if: env.SECRETS_AVAILABLE == 'true'
|
|
uses: zama-ai/slab-github-runner@79939325c3c429837c10d6041e4fd8589d328bac
|
|
with:
|
|
mode: stop
|
|
github-token: ${{ secrets.SLAB_ACTION_TOKEN }}
|
|
slab-url: ${{ secrets.SLAB_BASE_URL }}
|
|
job-secret: ${{ secrets.JOB_SECRET }}
|
|
label: ${{ needs.setup-instance.outputs.runner-name }}
|
|
|
|
- name: Slack Notification
|
|
if: ${{ failure() }}
|
|
continue-on-error: true
|
|
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661
|
|
env:
|
|
SLACK_COLOR: ${{ job.status }}
|
|
SLACK_MESSAGE: "Instance teardown (cuda-pcc) finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})"
|