CI: Run tests in VM based builders

This adds a first basic test to be run using GitHub Actions on push and pull
request for the CMake build (internally we run everything on Bazel/Blaze).

The Ubuntu runners are implemented as full VMs, so we can run tests directly.

In order to run Sandboxed API/Sandbox2 tests inside a container, it must be
started as privileged, unconfined and retain its capabilities.
Since GitHub does not support modifying the Docker invocation for container
based workflows, we need to manually run the `docker` command.

Until #118 is fixed, this change makes GitHub ignore the test failure on
Fedora.

PiperOrigin-RevId: 428485354
Change-Id: I6b55c5441c4c27b018d19498d2296c7d3da65846

.github/workflows/fedora-cmake.yml

@@ -13,36 +13,55 @@ jobs:
         include:
           - container: fedora:35
             compiler: gcc  # GCC 11
-            ignore-errors: false
-          # TODO(cblichmann): Add clang-13 build to matrix (currently fails)
+            ignore-errors: true  # Stack trace test fails on Fedora (issue #118)
     runs-on: ubuntu-latest
     continue-on-error: ${{ matrix.ignore-errors }}
 
-    container:
-      image: ${{ matrix.container }}
+    env:
+      RUN_CMD: docker exec --tty ${{matrix.compiler}}-build-container
 
     steps:
     - uses: actions/checkout@v2
 
-    - name: Install build tools
+    - name: Prepare container
+      # Note: For the sandbox tests to work, we need a privileged, unconfined
+      #       container that retains its capabilities.
       run: |
-        dnf update -y
-        dnf install -y git make automake patch glibc-static libstdc++-static \
-          cmake ninja-build python3 python3-pip clang-devel libcap-devel
+        docker run --name ${{matrix.compiler}}-build-container \
+          --tty \
+          --privileged \
+          --cap-add ALL \
+          --security-opt apparmor:unconfined \
+          -v $GITHUB_WORKSPACE:$GITHUB_WORKSPACE \
+          -e TERM=dumb \
+          -e BUILD_TYPE \
+          -e GITHUB_WORKSPACE \
+          -d ${{matrix.container}} \
+          sleep infinity
 
-    - name: Install/configure Clang compiler toolchain
-      if: matrix.compiler == 'clang'
+    - name: Install build tools
       run: |
-        echo "CXX=clang++" >> $GITHUB_ENV
-        echo "CC=clang" >> $GITHUB_ENV
+        $RUN_CMD dnf update -y --quiet
+        $RUN_CMD dnf install -y --quiet git make automake patch glibc-static \
+          libstdc++-static cmake ninja-build python3 python3-pip clang-devel \
+          libcap-devel
 
     - name: Create Build Environment
       run: |
-        pip3 install absl-py clang
-        cmake -E make_directory $GITHUB_WORKSPACE/build
+        $RUN_CMD pip3 install --progress-bar=off absl-py clang
+        $RUN_CMD cmake -E make_directory $GITHUB_WORKSPACE/build
 
     - name: Configure CMake
-      run: cmake $GITHUB_WORKSPACE -G Ninja -DCMAKE_BUILD_TYPE=$BUILD_TYPE
+      run: |
+        $RUN_CMD cmake -S $GITHUB_WORKSPACE -B $GITHUB_WORKSPACE/build \
+          -G Ninja -DCMAKE_BUILD_TYPE=$BUILD_TYPE
 
     - name: Build
-      run: cmake --build $GITHUB_WORKSPACE --config $BUILD_TYPE
+      run: |
+        $RUN_CMD cmake --build $GITHUB_WORKSPACE/build --config $BUILD_TYPE
+
+    - name: Test
+      run: |
+        $RUN_CMD ctest --test-dir $GITHUB_WORKSPACE/build -C $BUILD_TYPE \
+          --output-on-failure \
+          -R SapiTest

.github/workflows/ubuntu-cmake.yml

@@ -62,17 +62,17 @@ jobs:
     - name: Create Build Environment
       run: |
         pip3 install absl-py clang
-        cmake -E make_directory ${{runner.workspace}}/build
+        cmake -E make_directory $GITHUB_WORKSPACE/build
 
     - name: Configure CMake
-      working-directory: ${{runner.workspace}}/build
-      run: cmake $GITHUB_WORKSPACE -G Ninja -DCMAKE_BUILD_TYPE=$BUILD_TYPE
+      run: |
+        cmake $GITHUB_WORKSPACE -G Ninja -DCMAKE_BUILD_TYPE=$BUILD_TYPE
 
     - name: Build
-      working-directory: ${{runner.workspace}}/build
-      run: cmake --build . --config $BUILD_TYPE
+      run: |
+        cmake --build $GITHUB_WORKSPACE --config $BUILD_TYPE
 
-    # TODO(cblichmann): Before enabling this, make sure all OSS tests pass
-    #- name: Test
-    #  working-directory: ${{runner.workspace}}/build
-    #  run: ctest -C $BUILD_TYPE
+    - name: Test
+      run: |
+        ctest $GITHUB_WORKSPACE -C $BUILD_TYPE --output-on-failure \
+          -R SapiTest