testsuite, ci: expand coverage and rework the test matrix

.github/workflows/actionlint.yml

@@ -30,16 +30,20 @@ permissions:
 jobs:
   actionlint:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     name: actionlint
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: install actionlint
-        # Pin a version so this job is reproducible; bump deliberately.
-        # The download script verifies a SHA256 of the release tarball.
         run: |
-          bash <(curl --proto '=https' --tlsv1.2 -fsSL \
-              https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) \
-              1.7.12
+          archive=actionlint_1.7.12_linux_amd64.tar.gz
+          curl --proto '=https' --tlsv1.2 -fsSLO \
+            "https://github.com/rhysd/actionlint/releases/download/v1.7.12/$archive"
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  $archive" \
+            | sha256sum --check --strict
+          tar -xzf "$archive" actionlint
           echo "$PWD" >>"$GITHUB_PATH"
       - name: actionlint --version
         run: actionlint -version

.github/workflows/almalinux-8-build.yml

@@ -24,19 +24,24 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     container:
       image: almalinux:8
     name: Test rsync on AlmaLinux 8
     steps:
     - name: install git
       # actions/checkout needs git in the container before the checkout step.
       run: dnf -y install git
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       # PowerTools is needed for libzstd-devel etc; xxhash and lz4 dev
       # headers live in EPEL on RHEL 8. The default python3 on RHEL 8
@@ -67,14 +72,14 @@ jobs:
       # crtimes-not-supported skip matches the other Linux jobs;
       # daemon-chroot-acl and proxy-response-line-too-long skip because
       # the default (secure) transport opens no listening socket.
-      run: RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt make check
+      run: RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,linux,no-zstd-threads RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt make check
     - name: check (TCP daemon transport)
       # Second run exercising the real loopback-TCP daemon path.
-      run: ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
+      run: RSYNC_TEST_PROFILES=non-asan,root,self-peer,linux,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
     - name: ssl file list
       run: ./rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: almalinux-8-bin

.github/workflows/android-static-build.yml

@@ -28,6 +28,9 @@ on:
     - cron: '42 8 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   # Minimum supported API level. 24 (Android 7.0) runs on every modern
   # phone while keeping broad reach; bump if you need newer Bionic APIs.
@@ -36,6 +39,7 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: ${{ matrix.abi }}
     strategy:
       fail-fast: false
@@ -48,9 +52,10 @@ jobs:
             triple: armv7a-linux-androideabi
             qemu: qemu-arm-static
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install build prerequisites
         run: sudo apt-get update && sudo apt-get install -y autoconf automake gawk qemu-user-static
@@ -118,7 +123,7 @@ jobs:
           echo "ARTIFACT_NAME=rsync-android-${{ matrix.abi }}" >>"$GITHUB_ENV"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           retention-days: 45
           name: ${{ env.ARTIFACT_NAME }}

.github/workflows/asan-build.yml

@@ -23,9 +23,13 @@ on:
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   asan:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: rsync ASan+UBSan (clang)
     env:
       # rsync intentionally leaks small allocations at process exit, so leak
@@ -39,9 +43,10 @@ jobs:
       # intentional unaligned accessors are suppressed, with no_sanitize.
       UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
@@ -69,8 +74,8 @@ jobs:
     - name: check (stdio-pipe transport)
       # ASan+UBSan-instrumented coverage of the transfer, daemon, sender,
       # receiver and metadata paths over the default stdio-pipe transport.
-      run: ./runtests.py --rsync-bin="$PWD/rsync" -j8
+      run: ./testsuite/runtests.py --rsync-bin="$PWD/rsync" -j8
     - name: check (TCP daemon transport)
       # --use-tcp also exercises the loopback rsyncd listener and the client's
       # TCP connection path.
-      run: ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j8
+      run: ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j8

.github/workflows/coverage.yml

@@ -19,14 +19,19 @@ on:
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: gcov coverage
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
@@ -67,7 +72,7 @@ jobs:
         } >> "$GITHUB_STEP_SUMMARY"
     - name: upload HTML reports
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: coverage-html

.github/workflows/cygwin-build.yml

@@ -18,14 +18,19 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: windows-2022
+    timeout-minutes: 60
     name: Test rsync on Cygwin
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: cygwin
       run: |
         $setup = Join-Path $Env:RUNNER_TEMP 'setup-x86_64.exe'
@@ -87,15 +92,15 @@ jobs:
       # chown/devices tests still skip (need root/mknod), as do the
       # RESOLVE_BENEATH symlink-race tests. Cygwin runs non-root, so the
       # namecvt empty-response regression can run despite its common root skip.
-      run: bash -c 'RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/cygwin.txt,-daemon-namecvt-empty-response make check'
+      run: bash -c 'RSYNC_TEST_PROFILES=pipe,non-asan,nonroot,self-peer,cygwin RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/cygwin.txt,-daemon-namecvt-empty-response make check'
     - name: check (TCP daemon transport)
       # Second run with daemon tests over a real loopback rsyncd; the default
       # 'make check' above uses the secure stdio-pipe transport.
-      run: bash -c './runtests.py --rsync-bin=`pwd`/rsync.exe --use-tcp -j 8'
+      run: bash -c 'RSYNC_TEST_PROFILES=non-asan,nonroot,self-peer,cygwin ./testsuite/runtests.py --rsync-bin=`pwd`/rsync.exe --use-tcp -j 8'
     - name: ssl file list
       run: bash -c 'PATH="/usr/local/bin:$PATH" rsync-ssl --no-motd download.samba.org::rsyncftp/ || true'
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: cygwin-bin

.github/workflows/fleettest.yml

@@ -16,29 +16,42 @@ on:
     paths:
       - 'testsuite/fleettest.py'
       - '.github/workflows/fleettest.yml'
-      - 'runtests.py'
+      - 'testsuite/runtests.py'
+      - 'testsuite/harness/**'
+      - 'testsuite/profiles/**'
+      - 'testsuite/tests/**'
+      - 'testsuite/exitcodes.py'
       - 'testsuite/skiplist/**'
-      - 'testsuite/skiplist-spec_test.py'
+      - 'testsuite/tests/skiplist-spec_test.py'
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
       - 'testsuite/fleettest.py'
       - '.github/workflows/fleettest.yml'
-      - 'runtests.py'
+      - 'testsuite/runtests.py'
+      - 'testsuite/harness/**'
+      - 'testsuite/profiles/**'
+      - 'testsuite/tests/**'
+      - 'testsuite/exitcodes.py'
       - 'testsuite/skiplist/**'
-      - 'testsuite/skiplist-spec_test.py'
+      - 'testsuite/tests/skiplist-spec_test.py'
   workflow_dispatch:
   schedule:
     - cron: '17 7 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   fleettest:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: fleettest against localhost
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update

.github/workflows/freebsd-build.yml

@@ -18,19 +18,32 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on FreeBSD
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
+    - name: prepare VM host
+      timeout-minutes: 10
+      run: |
+        packages=(qemu-utils qemu-system-x86 ovmf)
+        sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}" || {
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}"
+        }
     - name: Test in FreeBSD VM
       id: test
-      uses: vmactions/freebsd-vm@v1
+      uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
       with:
-        usesh: true
+        cache-after-prepare: true
         prepare: |
           pkg install -y bash autotools m4 devel/xxhash zstd liblz4 python3 archivers/liblz4 git
         run: |
@@ -41,10 +54,10 @@ jobs:
           make
           ./rsync --version
           make check
-          ./runtests.py --rsync-bin=`pwd`/rsync --use-tcp -j 8
+          ./testsuite/runtests.py --rsync-bin=`pwd`/rsync --use-tcp -j 8
           ./rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: freebsd-bin

.github/workflows/macos-build.yml

@@ -18,14 +18,19 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: macos-latest
+    timeout-minutes: 45
     name: Test rsync on macOS
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         brew install automake openssl xxhash zstd lz4 libidn2
@@ -48,15 +53,15 @@ jobs:
       # chown-fake / devices-fake / xattrs / xattrs-hlink now RUN on macOS
       # (rsyncfns.py drives xattrs via the `xattr` command), verified on a
       # real macOS host, so they're no longer in the skip set.
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/macos.txt make check
+      run: sudo RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,macos RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/macos.txt make check
     - name: check (TCP daemon transport)
       # Second run with daemon tests over a real loopback rsyncd; the default
       # 'make check' above uses the secure stdio-pipe transport.
-      run: sudo ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
+      run: sudo RSYNC_TEST_PROFILES=non-asan,root,self-peer,macos ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
     - name: ssl file list
       run: rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: macos-bin