ci: fix baseline checks and release hooks

.github/actions/prepare-ce-test-env/action.yml

@@ -2,76 +2,130 @@ name: "Prepare test environment with Tarantool CE"
 description: "Prepares test environment with Tarantool CE"
 
 inputs:
+  build-tt:
+    description: Build tt when no binary artifact has been supplied
+    default: 'true'
+  cache:
+    description: Enable Go caching
+    default: 'true'
   tarantool-version:
+    description: Tarantool CE version, or min or latest from ci/tarantool-versions.env
     required: true
-    type: string
   skip-tarantool-install:
     description: Whether to skip tarantool installation
-    type: boolean
     required: false
-    default: false
+    default: 'false'
   skip-etcd-install:
     description: Whether to skip etcd installation
-    type: boolean
     required: false
-    default: false
-
-env:
-  # Note: Use exactly match version of tool, to avoid unexpected issues with test on CI.
-  GO_VERSION: '1.27.3'
+    default: 'false'
 
 runs:
   using: "composite"
   steps:
     - name: Setup Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '${{ env.GO_VERSION }}'
+        cache: ${{ inputs.cache == 'true' }}
+        cache-dependency-path: '**/go.sum'
 
     - name: Setup python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: '${{ env.PYTHON_VERSION }}'
 
     - name: Setup Mage
-      run: |
-        git clone https://github.com/magefile/mage
-        cd mage
-        go run bootstrap.go
+      run: go install github.com/magefile/mage@v1.15.0
       shell: bash
 
-    - name: Install build requirements
+    - name: Install Linux requirements
+      if: runner.os == 'Linux'
       run: |
         sudo apt -y update
         sudo apt -y install git gcc make cmake unzip zip
         sudo apt-get --allow-releaseinfo-change update
         sudo apt-get -y -f install \
         build-essential ninja-build \
-        lua5.1 luarocks lcov \
-        ruby-dev liblz4-dev  autoconf \
-        automake libtool zsh fish
-        sudo luarocks install luacheck 0.26.1
-        sudo gem install coveralls-lcov
-        sudo pip3 install tarantool
+        liblz4-dev autoconf \
+        automake libtool zsh fish gdb
+        # Tests that run tt binary install --source-build build Tarantool.
+        sudo apt-get -y install pkg-config libreadline-dev libssl-dev libunwind-dev \
+          libicu-dev libncurses-dev zlib1g-dev libcurl4-openssl-dev libyaml-dev
+      shell: bash
+
+    - name: Install macOS requirements
+      if: runner.os == 'macOS'
+      # The completion tests need bash 4 or later with bash-completion.
+      run: |
+        brew install autoconf automake libtool ninja pkgconf lz4 openssl@3 readline zsh fish \
+          bash bash-completion@2
+      shell: bash
+
+    - name: Install test requirements
+      # Install the pinned CMake before building Tarantool on macOS.
+      run: pip3 install -r test/requirements.txt
+      shell: bash
+
+    - name: Enable network isolation for rocks tests
+      if: runner.os == 'Linux'
+      run: |
+        # Ubuntu 24.04 restricts the user namespace used by unshare -r -n.
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+        unshare -r -n true
       shell: bash
 
-    - name: Install Tarantool
+    - name: Resolve the Tarantool version
+      id: version
+      env:
+        REQUESTED: ${{ inputs.tarantool-version }}
+      run: |
+        version=$(ci/tarantool-version.sh ce "$REQUESTED")
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+      shell: bash
+
+    # download.tarantool.org times out now and then: try once more.
+    - name: Install Tarantool on Linux
+      id: tarantool
       if: |
-        inputs.skip-tarantool-install == 'false'
-      uses: tarantool/setup-tarantool@v3
+        runner.os == 'Linux' && inputs.skip-tarantool-install == 'false' &&
+        inputs.tarantool-version != 'master'
+      continue-on-error: true
+      uses: tarantool/setup-tarantool@8b72738988f4b0ce0aac18ffd060756871197ec0 # v3
+      env:
+        # The action's default cache key omits the architecture. CE 3.9 has
+        # both amd64 and arm64 packages in its linux-deb/static repository.
+        TARANTOOL_CACHE_KEY_SUFFIX: -${{ runner.arch }}
+      with:
+        tarantool-version: '${{ steps.version.outputs.version }}'
+
+    - name: Install Tarantool on Linux, second attempt
+      if: steps.tarantool.outcome == 'failure'
+      uses: tarantool/setup-tarantool@8b72738988f4b0ce0aac18ffd060756871197ec0 # v3
+      env:
+        TARANTOOL_CACHE_KEY_SUFFIX: -${{ runner.arch }}
       with:
-        tarantool-version: '${{ inputs.tarantool-version }}'
+        tarantool-version: '${{ steps.version.outputs.version }}'
 
     - name: Install etcd
-      uses: ./.github/actions/setup-etcd
+      uses: ./.github/actions/setup-etcd # zizmor: ignore[self-repository] -- Test the checked-out revision.
       if: ${{ inputs.skip-etcd-install == 'false' }}
 
     - name: Build tt
+      if: inputs.build-tt == 'true'
       run: mage build
       shell: bash
 
-    - name: Install test requirements
-      run: |
-        sudo apt -y install gdb
-        pip3 install -r test/requirements.txt
+    - name: Install Tarantool through tt
+      if: |
+        (runner.os == 'macOS' || inputs.tarantool-version == 'master') &&
+        inputs.skip-tarantool-install == 'false'
+      env:
+        TARANTOOL_VERSION: ${{ steps.version.outputs.version }}
+      # The prefix is fixed by this action, not PR metadata.
+      run: | # zizmor: ignore[github-env]
+        ./tt binary install tarantool --scope project "$TARANTOOL_VERSION"
+        ./.tarantool/bin/tarantool --version
+        echo "$GITHUB_WORKSPACE/.tarantool/bin" >> "$GITHUB_PATH"
+        echo "TT_CLI_TARANTOOL_PREFIX=$GITHUB_WORKSPACE/.tarantool" >> "$GITHUB_ENV"
       shell: bash