mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
fd59bb5a91
Policy evaluation at scale needs to be able to set memory limits so that a bad policy does not hog memory or to ensure that policy evaluation itself does not use too much memory which could cause other components to suffer. This PR introduces capability to set and enforce global memory limits. It also lays the groundwork for enabling per evaluation limits in future. Once a global memory limit is set, Regorus maintains per thread counters to track memory activity (allocation, deallocation) of a thread. These counters are periodically flushed to global memory counters. Per thread counters avoid the contention that updating global counters on each alloc/free would cause. Policy evaluation periodically checks these counters and raises errors if allocated memory has exceeded the configured limit. Currently memory limit capability is exposed only to FFI and C#. Also update mimalloc to v2.2.6 Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
177 lines
6.2 KiB
YAML
177 lines
6.2 KiB
YAML
name: bindings/csharp
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [ "main" ]
|
|
pull_request:
|
|
branches: [ "main" ]
|
|
schedule:
|
|
# Run at 8:00 AM every day
|
|
- cron: "0 8 * * *"
|
|
|
|
env:
|
|
VersionSuffix: ${{ github.run_id }}
|
|
|
|
jobs:
|
|
build-ffi:
|
|
name: 'Build Regorus FFI: (${{ matrix.runtime.target }})'
|
|
runs-on: ${{ matrix.runtime.os }}
|
|
strategy:
|
|
# let us get failures from other jobs even if one fails
|
|
fail-fast: false
|
|
matrix:
|
|
runtime:
|
|
- os: windows-latest
|
|
target: x86_64-pc-windows-msvc
|
|
libpath: |
|
|
**/release/regorus_ffi.dll
|
|
**/release/regorus_ffi.pdb
|
|
- os: ubuntu-latest
|
|
target: x86_64-unknown-linux-gnu
|
|
libpath: |
|
|
**/release/libregorus_ffi.so
|
|
# Disabled for now
|
|
#- os: macos-latest
|
|
# target: aarch64-apple-darwin
|
|
# libpath: |
|
|
# **/release/libregorus_ffi.dylib
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: ./.github/actions/toolchains/rust
|
|
|
|
- name: Fetch crates
|
|
run: cargo fetch
|
|
working-directory: ./bindings/ffi
|
|
|
|
- name: Check Regorus binding formatting
|
|
run: cargo fmt --check
|
|
working-directory: ./bindings/ffi
|
|
|
|
- name: Check Clippy linting for Regorus binding
|
|
run: cargo clippy --frozen -- -D warnings
|
|
working-directory: ./bindings/ffi
|
|
|
|
- name: Build Regorus binding
|
|
run: cargo build -r --target ${{ matrix.runtime.target }} --locked
|
|
working-directory: ./bindings/ffi
|
|
|
|
- name: Upload regorus ffi shared library
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: regorus-ffi-artifacts-${{ matrix.runtime.target }}
|
|
# Note: The full path of each artifact relative to . is preserved.
|
|
path: ${{ matrix.runtime.libpath }}
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
build-nuget:
|
|
name: 'Build Regorus nuget'
|
|
runs-on: ubuntu-latest
|
|
needs: build-ffi
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
|
|
with:
|
|
global-json-file: ./bindings/csharp/global.json
|
|
|
|
- run: echo '${{ steps.stepid.outputs.dotnet-version }}'
|
|
|
|
- name: Download regorus ffi shared libraries
|
|
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
|
|
with:
|
|
pattern: regorus-ffi-artifacts-*
|
|
merge-multiple: true
|
|
path: ./bindings/csharp/Regorus/tmp
|
|
|
|
- name: Display regorus ffi artifacts
|
|
run: ls -R ./bindings/csharp/Regorus/tmp
|
|
|
|
# Note that we need to supply the target folder within the folder where artifacts are downloaded.
|
|
- name: Build Regorus binding
|
|
run: dotnet build /p:Configuration=Release /p:RegorusFFIArtifactsDir=./tmp/bindings/ffi/target /p:VersionSuffix=${{ env.VersionSuffix }}
|
|
working-directory: ./bindings/csharp/Regorus
|
|
|
|
- name: Pack
|
|
run: dotnet pack /p:RegorusFFIArtifactsDir=./tmp/bindings/ffi/target /p:VersionSuffix=${{ env.VersionSuffix }}
|
|
working-directory: ./bindings/csharp/Regorus
|
|
|
|
- name: Upload Regorus nuget
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: regorus-nuget
|
|
path: bindings/csharp/Regorus/bin/Release/Regorus*.nupkg
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
test-nuget:
|
|
name: 'Test Regorus Nuget: (${{ matrix.runtime.target }})'
|
|
needs: build-nuget
|
|
runs-on: ${{ matrix.runtime.os }}
|
|
strategy:
|
|
# let us get failures from other jobs even if one fails
|
|
fail-fast: false
|
|
matrix:
|
|
runtime:
|
|
- os: windows-latest
|
|
target: x86_64-pc-windows-msvc
|
|
- os: ubuntu-latest
|
|
target: x86_64-unknown-linux-gnu
|
|
#- os: macos-latest
|
|
# target: aarch64-apple-darwin
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
|
|
with:
|
|
global-json-file: ./bindings/csharp/global.json
|
|
|
|
- run: echo '${{ steps.stepid.outputs.dotnet-version }}'
|
|
|
|
- name: Download regorus nuget
|
|
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
|
|
with:
|
|
name: regorus-nuget
|
|
path: ./bindings/csharp/regorus-nuget/
|
|
|
|
- name: Restore Regorus.Tests
|
|
run: dotnet restore /p:UseLocalRegorus=false /p:VersionSuffix=${{ env.VersionSuffix }} /p:RestoreAdditionalProjectSources=../regorus-nuget
|
|
working-directory: ./bindings/csharp/Regorus.Tests
|
|
|
|
- name: Run Regorus.Tests
|
|
run: dotnet test --no-restore /p:UseLocalRegorus=false /p:VersionSuffix=${{ env.VersionSuffix }}
|
|
working-directory: ./bindings/csharp/Regorus.Tests
|
|
|
|
- name: Restore TestApp
|
|
run: dotnet restore /p:VersionSuffix=${{ env.VersionSuffix }} /p:RestoreAdditionalProjectSources=../regorus-nuget
|
|
working-directory: ./bindings/csharp/TestApp
|
|
|
|
- name: Build TestApp
|
|
run: dotnet build --no-restore
|
|
working-directory: ./bindings/csharp/TestApp
|
|
|
|
- name: Run TestApp
|
|
run: dotnet run --no-build --framework net8.0
|
|
working-directory: ./bindings/csharp/TestApp
|
|
|
|
- name: Restore TargetExampleApp
|
|
run: dotnet restore /p:VersionSuffix=${{ env.VersionSuffix }} /p:RestoreAdditionalProjectSources=../regorus-nuget
|
|
working-directory: ./bindings/csharp/TargetExampleApp
|
|
|
|
- name: Build TargetExampleApp
|
|
run: dotnet build --no-restore
|
|
working-directory: ./bindings/csharp/TargetExampleApp
|
|
|
|
- name: Run TargetExampleApp
|
|
run: dotnet run --no-build --framework net8.0
|
|
working-directory: ./bindings/csharp/TargetExampleApp
|