view .github/workflows/build-xapian.yml @ 8356:63390dcfcfe9

bug: fix template use of structure with untrusted data Looks like an xSS bug with an early version of the template that was fixed in the code but never in the deployed tracker. It has been a while since this particular construct has been in the classic template which is the base for the tracker. This has been fixed on the deployed tracker as well. reported by 4bug of ChaMd5 Security Team H1 Group
author John Rouillard <rouilj@ieee.org>
date Tue, 08 Jul 2025 10:23:09 -0400
parents 6137598ac8b0
children 3db40a355a6c
line wrap: on
line source


name: build-xapian

on: 
    push:
         # skip if github.ref is 'refs/heads/maint-1.6'
         #   aka github.ref_name of 'maint-1.6'
         # see https://github.com/orgs/community/discussions/26253
         # for mechanism to control matrix based on branch
         branches: [ "*", '!maint-1.6' ]
    workflow_dispatch:
      inputs:
        debug_enabled:
          type: boolean
          description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
          required: false
          default: false
# GITHUB_TOKEN only has read repo context.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: build xapian
    runs-on: ubuntu-24.04

    env:
     # get colorized pytest output even without a controlling tty
      PYTEST_ADDOPTS: "--color=yes"
      #  OS: ${{ matrix.os }}
      PYTHON_VERSION: 3.13

    steps:
      # Checkout the latest code from the repo
      - name: Checkout source
        # example directives:
          # disable step
        # if: {{ false }}
          # continue running if step fails
        # continue-on-error: true
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        # Setup version of Python to use
      - name: Set Up Python 3.13
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: 3.13
          allow-prereleases: true
          cache: 'pip'

      - name: Install build tools - setuptools
        run: pip install setuptools

      # Display the Python version being used
      - name: Display Python and key module versions
        run: |
          python -c "import sys; print('python version: ', sys.version)"
          python -c "import sqlite3; print('sqlite version: ', sqlite3.sqlite_version)"
          python -c "import setuptools; print('setuptools version: ', setuptools.__version__);"

      - name: Update pip
        run: python -m pip install --upgrade pip
            
      # https://github.com/mxschmitt/action-tmate
      # allow remote ssh into the CI container. I need this to debug
      # some xfail cases 
      - name: Setup tmate session
        uses: mxschmitt/action-tmate@v3
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        timeout-minutes: 60
        with:
          limit-access-to-actor: true

      - name: Install xapian
        run: |
          set -xv
          sudo apt-get install libxapian-dev
          # Sphinx required to build the xapian python bindings. Use 1.8.5 on
          # older python and newest on newer.
          pip install sphinx
          XAPIAN_VER="1.4.22"; echo $XAPIAN_VER;
          cd /tmp
          curl -s -O https://oligarchy.co.uk/xapian/$XAPIAN_VER/xapian-bindings-$XAPIAN_VER.tar.xz
          tar -Jxvf xapian-bindings-$XAPIAN_VER.tar.xz
          cd xapian-bindings-$XAPIAN_VER/
          # edit the configure script.
          # distutils.sysconfig.get_config_vars('SO')  doesn't work for
          # 3.11 or newer.
          # Change distutils.sysconfig... to just sysconfig and SO
          # to EXT_SUFFIX to get valid value.
          # DISABLED use their script
          if [[ $PYTHON_VERSION == "X."* ]]; then
            cp configure configure.FCS;
            sed -i \
              -e '/PYTHON3_SO=/s/distutils\.//g' \
              -e '/PYTHON3_SO=/s/"SO"/"EXT_SUFFIX"/g' \
              -e '/PYTHON3_CACHE_TAG=/s/imp;print(imp.get_tag())/sys;print(sys.implementation.cache_tag)/' \
              -e '/PYTHON3_CACHE_OPT1_EXT=/s/imp\.get_tag()/sys.implementation.cache_tag/g' \
              -e '/PYTHON3_CACHE_OPT1_EXT=/s/imp\b/importlib/g' \
            configure;
            diff -u configure.FCS configure || true;
          fi
          ./configure --prefix=$VIRTUAL_ENV --with-python3 --disable-documentation
          make && sudo make install
          python -c 'import xapian'

Roundup Issue Tracker: http://roundup-tracker.org/