ci: support Rust 1.97 and modernize workflows (#210)

* Modernize workflow actions and permissions

* Test the fentry tutorial in CI

* Support Rust 1.97 symbol mangling

* Limit documentation writes to main

* Harden Rust symbol resolution

---------

Co-authored-by: LinuxDev9002 <i@littlefisher.me>

.github/workflows/auto-generate-docs.yml

@@ -2,6 +2,7 @@ name: Auto Generate Documentation
 
 on:
   push:
+    branches: [main]
     paths:
       - 'src/**/README.md'
       - 'src/**/README.zh.md'
@@ -10,19 +11,22 @@ on:
       - 'scripts/*.template'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   generate-docs:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
 

.github/workflows/test-bpftrace.yml

@@ -7,27 +7,27 @@ on:
     branches: [ "main" ]
   schedule:
     - cron:  '0 0 * * 0'
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
       with:
         submodules: 'recursive'
     
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        toolchain: stable
-        profile: minimal
-        override: true
+      uses: dtolnay/rust-toolchain@1.97.0
     
     - name: test 37 uprobe-rust helloworld
       run: |
         cd src/37-uprobe-rust/helloworld
         cargo build
         # Verify the hello function symbol exists in debug build
-        nm target/debug/helloworld | grep "_ZN10helloworld5hello" || (echo "Error: hello function symbol not found in debug build" && exit 1)
+        nm -C target/debug/helloworld | grep -F "helloworld::hello" || (echo "Error: hello function symbol not found in debug build" && exit 1)
         echo "✓ helloworld debug build has correct hello symbol"
         
     - name: test 37 uprobe-rust args
@@ -35,7 +35,7 @@ jobs:
         cd src/37-uprobe-rust/args
         cargo build
         # Verify the hello function symbol exists in debug build
-        nm target/debug/helloworld | grep "_ZN10helloworld5hello" || (echo "Error: hello function symbol not found in debug build" && exit 1)
+        nm -C target/debug/helloworld | grep -F "helloworld::hello" || (echo "Error: hello function symbol not found in debug build" && exit 1)
         echo "✓ args debug build has correct hello symbol"
         # Run the binary to ensure it works
         ./target/debug/helloworld 1 2 3 | grep -q "Hello, world!" || (echo "Error: binary execution failed" && exit 1)
@@ -44,12 +44,15 @@ jobs:
     - name: test 37 uprobe-rust bpftrace attach
       run: |
         cd src/37-uprobe-rust/args
-        # Test that bpftrace can attach to the hello function with wildcard pattern
-        # Run bpftrace with the binary and verify it can trace the function
-        sudo timeout 3 bpftrace -e 'uprobe:target/debug/helloworld:_ZN10helloworld5hello* { printf("traced\n"); exit(); }' -c "./target/debug/helloworld 1" > /tmp/bpftrace_output.txt 2>&1 || true
+        # Rust 1.97 uses v0 mangling by default, so resolve the raw symbol dynamically.
+        hello_address=$(nm -C target/debug/helloworld | awk '$2 ~ /^[tT]$/ && $3 ~ /^helloworld::hello(::h[[:xdigit:]]+)?$/ && !matched { found = $1; matched = 1 } END { if (matched) print found }')
+        test -n "$hello_address" || (echo "Error: demangled hello function symbol not found" && exit 1)
+        hello_symbol=$(nm target/debug/helloworld | awk -v address="$hello_address" '$1 == address && $2 ~ /^[tT]$/ && !matched { found = $3; matched = 1 } END { if (matched) print found }')
+        test -n "$hello_symbol" || (echo "Error: raw hello function symbol not found" && exit 1)
+        sudo timeout 3 bpftrace -e "uprobe:target/debug/helloworld:${hello_symbol} { printf(\"traced\\n\"); exit(); }" -c "./target/debug/helloworld 1" > /tmp/bpftrace_output.txt 2>&1 || true
         # Check if bpftrace successfully attached and traced the function
         if grep -q "traced" /tmp/bpftrace_output.txt && grep -q "Attaching 1 probe" /tmp/bpftrace_output.txt; then
-          echo "✓ bpftrace successfully attached to hello function with wildcard pattern"
+          echo "✓ bpftrace successfully attached to hello function"
         else
           echo "Error: bpftrace failed to attach or trace the hello function"
           cat /tmp/bpftrace_output.txt

.github/workflows/test-eunomia.yaml

@@ -7,11 +7,15 @@ on:
     branches: [ "main" ]
   schedule:
     - cron:  '0 0 * * 0'
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
       with:
         submodules: 'recursive'
     - name: install deps
@@ -30,8 +34,8 @@ jobs:
         sudo timeout -s 2 3 ./ecli run src/2-kprobe-unlink/package.json || if [ $? = 124 ]; then exit 0; else exit $?; fi
     - name: test 3 fentry
       run: |
-        ./ecc src/2-kprobe-unlink/kprobe-link.bpf.c
-        sudo timeout -s 2 3 ./ecli run src/2-kprobe-unlink/package.json || if [ $? = 124 ]; then exit 0; else exit $?; fi
+        ./ecc src/3-fentry-unlink/fentry-link.bpf.c
+        sudo timeout -s 2 3 ./ecli run src/3-fentry-unlink/package.json || if [ $? = 124 ]; then exit 0; else exit $?; fi
     - name: test 4 opensnoop
       run: |
         ./ecc src/4-opensnoop/opensnoop.bpf.c

.github/workflows/test-libbpf.yml

@@ -7,11 +7,15 @@ on:
     branches: [ "main" ]
   schedule:
     - cron:  '0 0 * * 0'
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
       with:
         submodules: 'recursive'
     - name: install deps

.github/workflows/trigger-sync.yml

@@ -7,18 +7,21 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   trigger:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout website repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           repository: ${{ github.repository_owner }}/eunomia.dev
           ref: main
           path: ./.
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
 
@@ -32,7 +35,7 @@ jobs:
 
       - name: Trigger sync workflow
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ secrets.PAT }}
           repository: ${{ github.repository_owner }}/eunomia.dev