Merge branch 'main' into ci_tests

Author: achamayou

.CodeQL.yml

@@ -0,0 +1,11 @@
+# https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/codeql/troubleshooting/bugs/generated-library-code
+path_classifiers:
+  # Everything under tests is test code
+  test:
+    - tests
+  # Everything under build is generated
+  generated:
+    - build
+  # Everything under 3rdparty is external libraries
+  library:
+    - 3rdparty

.azure-pipelines-release.yml

@@ -27,19 +27,19 @@ parameters:
       cmake_args: "-DCOMPILE_TARGET=sgx"
       cmake_env: ""
     SNPCC:
-      cmake_args: "-DCOMPILE_TARGET=snp -DLVI_MITIGATIONS=OFF -DLONG_TESTS=OFF"
+      cmake_args: "-DCOMPILE_TARGET=snp -DLONG_TESTS=OFF"
       cmake_env: "CC=`which clang-15` CXX=`which clang++-15`"
     debug:
-      cmake_args: "-DCMAKE_BUILD_TYPE=Debug -DLVI_MITIGATIONS=OFF"
+      cmake_args: "-DCMAKE_BUILD_TYPE=Debug"
       cmake_env: ""
     ASAN:
-      cmake_args: "-DSAN=ON"
+      cmake_args: "-DSAN=ON -DUSE_LIBCXX=OFF"
       cmake_env: ""
     TSAN:
       cmake_args: "-DTSAN=ON -DWORKER_THREADS=2"
       cmake_env: ""
     unsafe:
-      cmake_args: "-DLVI_MITIGATIONS=OFF -DVERBOSE_LOGGING=ON -DUNSAFE_VERSION=ON"
+      cmake_args: "-DVERBOSE_LOGGING=ON -DUNSAFE_VERSION=ON"
       cmake_env: ""
 
 jobs:

.azure-pipelines-templates/build_check.yml

@@ -50,7 +50,7 @@ jobs:
         env:
           ACR_REGISTRY_RESOURCE_NAME: ccfmsrc
           ACR_REGISTRY: ccfmsrc.azurecr.io
-          BASE_IMAGE: ghcr.io/microsoft/ccf/ci/default:build-08-10-2024
+          BASE_IMAGE: ghcr.io/microsoft/ccf/ci/default:build-14-01-2025
 
       - script: |
           set -ex

.azure-pipelines-templates/daily-matrix.yml

@@ -22,8 +22,8 @@ schedules:
 resources:
   containers:
     - container: virtual
-      image: ghcr.io/microsoft/ccf/ci/default:build-08-10-2024
-      options: --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE -v /lib/modules:/lib/modules:ro
+      image: ghcr.io/microsoft/ccf/ci/default:build-14-01-2025
+      options: --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
 
 jobs:
   - template: .azure-pipelines-templates/deploy_aci.yml

.azure-pipelines-templates/deploy_aci.yml

@@ -28,7 +28,6 @@
                 "CURL_CLIENT": "*",
                 "CONFIGURATIONS": "*",
                 "ADDITIONAL_ARGS": "*",
-                "CONTAINER_NODES": "*",
             },
         },
         "add_perf_test": {

.azure-pipelines-templates/release-matrix.yaml

@@ -1,4 +1,4 @@
 # https://help.github.com/en/articles/about-code-owners
 
 # Every review will request the CCF team as reviewer, unless a later match takes precedence
-* @Microsoft/ccf-code-reviewers
+* @Microsoft/ccf

.azure_pipelines_snp.yml

@@ -1,20 +1,14 @@
 Documents the various GitHub Actions workflows, the role they fulfil and 3rd party dependencies if any.
 
-# Backport
-
-Attempts to auto-open backport PRs from main to LTS branch(es) whenever possible. This works well in the absence of conflicts, typically early on during the life of an LTS, and less well later. The alternatives are running the backport tool manually, or cherry picking commits.
-Triggered when the label `auto-backport` is applied to a PR, along with the `X.*-todo` label to set the target branch.
-
-File: `backport.yml`
-3rd party dependencies: `sorenlouv/backport-github-action@main`
-
 # Bencher
 
 Builds and runs CCF performance tests, both end to end and micro-benchmarks. Results are posted to bencher.dev, and [plotted to make regressions obvious](https://bencher.dev/console/projects/ccf/plots).
 Triggered on every commit on `main`, but not on PR builds because the setup required to build from forks is complex and fragile in terms of security, and the increase in pool usage would be substantial.
 
 File: `bencher.yml`
-3rd party dependencies: `bencherdev/bencher@main`
+3rd party dependencies:
+
+- `bencherdev/bencher@main`
 
 # Continuous Integration Containers GHCR
 
@@ -28,6 +22,8 @@ File: `ci-containers-ghcr.yml`
 - `docker/metadata-action@v5`
 - `docker/build-push-action@v6`
 
+Note: This job will be removed with Ubuntu support, because installing dependencies on Azure Linux images is very fast, and producing CI-specific images is no longer necessary there.
+
 # Continuous Integration
 
 Main continuous integration job. Builds CCF for all target platforms, runs unit, end to end and partition tests Virtual. Run on every commit, including PRs from forks, gates merging. Also runs once a week, regardless of commits.
@@ -37,10 +33,10 @@ File: `ci.yml`
 
 # Long Tests
 
-Secondary continuous integration job. Runs more expensive, longer tests, such as tests against ASAN builds, fuzzing etc.
+Secondary continuous integration job. Runs more expensive, longer tests, such as tests against ASAN and TSAN builds, fuzzing etc.
 
-- Runs daily.
-- Can be manually run on a PR by setting `run-long-test` label.
+- Runs daily on week days.
+- Can be manually run on a PR by setting `run-long-test` label, or via workflow dispatch.
 
 File: `long-test.yml`
 3rd party dependencies: None
@@ -50,7 +46,10 @@ File: `long-test.yml`
 Builds CCF with CodeQL, and runs the security-extended checks. Triggered on PRs that affect ".github/workflows/codeql-analysis.yml", and once a week on main.
 
 File: `codeql-analysis.yml`
-3rd party dependencies: None
+3rd party dependencies:
+
+- `github/codeql-action/init@v3`
+- `github/codeql-action/analyze@v3`
 
 # Continuous Verification
 
@@ -71,7 +70,7 @@ File: `long-verification.yml`
 
 # Release
 
-Produces CCF release artefacts from 5.0.0-rc0 onwards, for all languages and platforms. Triggered on tags matching "ccf-5.\*". The output of the job is a draft release, which needs to be published manually. Publishing triggers the downstream jobs listed below.
+Produces CCF release artefacts from 5.0.0-rc0 onwards, for all languages and platforms. Triggered on tags matching `ccf-[56].\*`. The output of the job is a draft release, which needs to be published manually. Publishing triggers the downstream jobs listed below.
 
 File: `release.yml`
 3rd party dependencies: None
@@ -106,12 +105,6 @@ File: `pypi.yml`
 Builds and publishes documentation to GitHub Pages. Triggered on pushes to main, and manually. Note that special permissions (Settings > Environment) are configured.
 
 File: `doc.yml`
-3rd party dependencies: None
-
-# Deprecated
-
-The following pipelines are still here to support 4.x, but will be removed when it reaches EOL.
-
-## Release containers ACR/MCR
+3rd party dependencies:
 
-File: `containers.yml`
+- peaceiris/actions-gh-pages@v3

.cmake-format.py

@@ -1,6 +1,8 @@
 name: "Bencher: Run Benchmarks"
 
 on:
+  schedule:
+    - cron: "0 0 * * 0"
   push:
     branches:
       - main
@@ -11,7 +13,7 @@ jobs:
     name: Continuous Benchmarking with Bencher
     runs-on: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
     container:
-      image: ghcr.io/microsoft/ccf/ci/default:build-08-10-2024
+      image: ghcr.io/microsoft/ccf/ci/default:build-14-01-2025
     steps:
       - uses: actions/checkout@v4
         with:

.github/CODEOWNERS

@@ -49,7 +49,7 @@ jobs:
           labels: ${{ steps.meta_default.outputs.labels }}
 
       - name: Attest default container
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@v2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ github.repository }}/ci/default
           subject-digest: ${{ steps.push_default.outputs.digest }}