zeek/auxil/broker/.cirrus.yml

# The Community Cluster allows up to 8 CPUs and up to 24 GB of memory.
cpus: &CPUS 8
memory: &MEMORY 24GB

config: &CONFIG --build-type=release --enable-static -D FETCHCONTENT_FULLY_DISCONNECTED:BOOL=ON
memcheck_config: &MEMCHECK_CONFIG --build-type=debug --sanitizers=address -D FETCHCONTENT_FULLY_DISCONNECTED:BOOL=ON

resources_template: &RESOURCES_TEMPLATE
  cpu: *CPUS
  memory: *MEMORY

macos_resources_template: &MACOS_RESOURCES_TEMPLATE
  env:
    BROKER_CI_CPUS: 12
    BROKER_CI_CONFIGURE_FLAGS: *CONFIG
    # No permission to write to default location of /broker
    CIRRUS_WORKING_DIR: /tmp/broker

branch_whitelist: &BRANCH_WHITELIST
  only_if: >
    $CIRRUS_PR != '' ||
    $CIRRUS_BRANCH == 'master' ||
    $CIRRUS_BRANCH =~ 'release/.*'

ci_template: &CI_TEMPLATE
  << : *BRANCH_WHITELIST
  sync_submodules_script: git submodule update --recursive --init
  build_script: ./ci/build.sh
  test_script: ./ci/test.sh

  on_failure:
    upload_btest_tmp_dir_artifacts:
      path: "tests/btest/tmp.tar.gz"

unix_env: &UNIX_ENV
  env:
    CIRRUS_WORKING_DIR: /broker
    BROKER_CI_CPUS: *CPUS
    BROKER_CI_CONFIGURE_FLAGS: *CONFIG

    # This is the key used to create HMAC auth keys for the benchmark script. This
    # was generated by creating a new key using openssl, and then running sha256
    # on it.
    BROKER_BENCHMARK_HMAC_KEY: ENCRYPTED[!468e2f3ea05543c4d24eb6c776c0c10695b24faec3a11d22c8da99e1df0d5b56da5b705887b1c038962a7db3eae0b9a4!]

    # This is the https endpoint host and port used for benchmarking. It's kept
    # encrypted as a security measure to avoid leaking the host's information.
    BROKER_BENCHMARK_HOST: ENCRYPTED[!bcda5b49af0825ee5581b27f6a86106a15605a434c9c52827eb21eade8210e668af0456d14fffbe76c098cd2d30f5d48!]
    BROKER_BENCHMARK_PORT: ENCRYPTED[!793057d6d8a5d1ebb5e0392786e53cf81a2ff5adb1f5386b6c8914d2bf0c4d2ead09e8f3c08c28c91a17380a5db7e2fa!]

    # Give verbose error output on a test failure.
    CTEST_OUTPUT_ON_FAILURE: 1

# Linux EOL timelines: https://linuxlifecycle.com/
# Fedora (~13 months): https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle

clang_tidy_task:
  container:
    dockerfile: ci/debian-12/Dockerfile
    << : *RESOURCES_TEMPLATE
  sync_submodules_script: git submodule update --recursive --init
  build_script: ./ci/analyze.sh
  << : *UNIX_ENV
  << : *BRANCH_WHITELIST

fedora41_task:
  container:
    # Fedora 41 EOL: Around Nov 2025
    dockerfile: ci/fedora-41/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

fedora40_task:
  container:
    # Fedora 40 EOL: Around May 2025
    dockerfile: ci/fedora-40/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

centosstream9_task:
  container:
    # Stream 9 EOL: Around Dec 2027
    dockerfile: ci/centos-stream-9/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

debian12_task:
  container:
    # Debian 12 (bookworm) EOL: TBD
    dockerfile: ci/debian-12/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

debian11_task:
  container:
    # Debian 11 EOL: June 2026
    dockerfile: ci/debian-11/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

opensuse_leap_15_6_task:
  container:
    # Opensuse Leap 15.6 EOL: ~Dec 2025
    dockerfile: ci/opensuse-leap-15.6/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

opensuse_tumbleweed_task:
  container:
    # Opensuse Tumbleweed has no EOL
    dockerfile: ci/opensuse-tumbleweed/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

ubuntu24_10_task:
  container:
    # Ubuntu 24.10 EOL: 2025-07-30
    dockerfile: ci/ubuntu-24.10/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

ubuntu24_task:
  container:
    # Ubuntu 24.04 EOL: Jun 2029
    dockerfile: ci/ubuntu-24.04/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

ubuntu22_task:
  container:
    # Ubuntu 22.04 EOL: April 2027
    dockerfile: ci/ubuntu-22.04/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

alpine_task:
  container:
    # Alpine releases typically happen every 6 months w/ support for 2 years.
    # The Dockerfile simply tracks latest Alpine release and shouldn't
    # generally need updating based on particular Alpine release timelines.
    dockerfile: ci/alpine/Dockerfile
    << : *RESOURCES_TEMPLATE
  << : *CI_TEMPLATE
  << : *UNIX_ENV

# Cirrus only supports the following macos runner currently, selecting
# anything else automatically upgrades to this one.
#
#    ghcr.io/cirruslabs/macos-runner:sonoma
#
# See also: https://cirrus-ci.org/guide/macOS/
macos_sonoma_task:
  macos_instance:
    image: ghcr.io/cirruslabs/macos-runner:sonoma
  prepare_script: ./ci/macos/prepare.sh
  << : *CI_TEMPLATE
  << : *MACOS_RESOURCES_TEMPLATE

# FreeBSD EOL timelines: https://www.freebsd.org/security/#sup
freebsd14_task:
  freebsd_instance:
    # FreeBSD 14 EOL: Nov 30 2028
    image_family: freebsd-14-2
    cpu: 8
    # Not allowed to request less than 8GB for an 8 CPU FreeBSD VM.
    memory: 8GB
  prepare_script: ./ci/freebsd/prepare.sh
  << : *CI_TEMPLATE
  << : *UNIX_ENV

freebsd13_task:
  freebsd_instance:
    # FreeBSD 13 EOL: January 31, 2026
    image_family: freebsd-13-4
    cpu: 8
    # Not allowed to request less than 8GB for an 8 CPU FreeBSD VM.
    memory: 8GB
  prepare_script: ./ci/freebsd/prepare.sh
  << : *CI_TEMPLATE
  << : *UNIX_ENV

memcheck_task:
  container:
    # Just uses a recent/common distro to run memory error/leak checks.
    dockerfile: ci/debian-11/Dockerfile
    cpu: 8
    # AddressSanitizer uses more memory than normal config.
    memory: 8GB
  << : *CI_TEMPLATE
  env:
    CIRRUS_WORKING_DIR: /broker
    BROKER_CI_CPUS: *CPUS
    BROKER_CI_CONFIGURE_FLAGS: *MEMCHECK_CONFIG
    BROKER_CI_MEMCHECK: true
    # Give verbose error output on a test failure.
    CTEST_OUTPUT_ON_FAILURE: 1

windows_task:
  # 2 hour timeout just for potential of building Docker image taking a while
  timeout_in: 120m
  windows_container:
    # image: cirrusci/windowsservercore:cmake
    # image: zeekurity/broker-ci-windows:latest
    dockerfile: ci/windows/Dockerfile
    os_version: 2019
    cpu: 8
    # Not allowed to request less than 8GB for an 8 CPU Windows VM.
    memory: 8GB
  sync_submodules_script: git submodule update --recursive --init
  prepare_script: ci/windows/prepare.cmd
  build_script: ci/windows/build.cmd
  test_script: ci/windows/test.cmd
  env:
    BROKER_CI_CPUS: 8
    # Give verbose error output on a test failure.
    CTEST_OUTPUT_ON_FAILURE: 1
  <<: *BRANCH_WHITELIST