Containerfile: use hummingbird base images #360
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| BINK_COMMIT: a38101a436b96a82698363f0d07d8dba2cf088c6 | |
| permissions: {} | |
| concurrency: | |
| group: ci-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| unit: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true # zizmor: ignore[cache-poisoning] | |
| - name: Check generated files | |
| run: | | |
| make fmt manifests generate | |
| git diff --exit-code || { echo "Run 'make fmt manifests generate' and commit the results"; exit 1; } | |
| - name: Unit tests | |
| run: make unit | |
| - name: Vet | |
| run: make vet | |
| - name: Lint | |
| run: make lint | |
| build-bink: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout bink | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: bootc-dev/bink | |
| ref: ${{ env.BINK_COMMIT }} | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true # zizmor: ignore[cache-poisoning] | |
| - name: Install build dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| libgpgme-dev \ | |
| libbtrfs-dev \ | |
| libdevmapper-dev \ | |
| pkg-config | |
| - name: Build bink | |
| run: make build-bink | |
| - name: Upload bink binary | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bink | |
| path: bink | |
| build-operator: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Build operator image | |
| run: make buildimg | |
| - name: Save operator image | |
| run: podman save -o operator-image.tar bootc-operator:dev | |
| - name: Upload operator image | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: operator-image | |
| path: operator-image.tar | |
| e2e: | |
| name: e2e (${{ matrix.kube-minor }}) | |
| runs-on: ubuntu-latest | |
| needs: [build-bink, build-operator] | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| # TODO: set up Renovate to keep these digests fresh and | |
| # to help discover new Kubernetes minor versions to add here. | |
| matrix: | |
| include: | |
| - kube-minor: "1.34" | |
| digest: sha256:f7f487ea2a4722163b44bba184ba6814fed657bd08355e60f9a9e7c546be2bcb | |
| - kube-minor: "1.35" | |
| digest: sha256:d3077c99027db0c196d5c6531ef07b8955be827651b9e3d2bc4b8e7c6ebf5612 | |
| - kube-minor: "1.36" | |
| digest: sha256:0db6e56357ffd238a44a17d5e1d5b8cd75e9e54448fd466e568042077796a14b | |
| env: | |
| BINK_NODE_DISK_IMAGE: ghcr.io/bootc-dev/bink/node@${{ matrix.digest }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download bink binary | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: bink | |
| path: /usr/local/bin | |
| - name: Make bink executable | |
| run: chmod +x /usr/local/bin/bink | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true # zizmor: ignore[cache-poisoning] | |
| - name: Set up KVM | |
| run: sudo chmod 666 /dev/kvm | |
| - name: Enable KSM | |
| run: | | |
| sudo sh -c 'echo 1 > /sys/kernel/mm/ksm/run' | |
| sudo sh -c 'echo 5000 > /sys/kernel/mm/ksm/pages_to_scan' | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y podman | |
| - name: Configure kernel | |
| run: | | |
| # Disable AppArmor service and unload all profiles. | |
| # The host-loaded passt profile blocks passt's self-sandboxing | |
| # inside bink node containers. | |
| # Must run AFTER installing podman, whose passt dependency | |
| # loads the profile during package installation. | |
| sudo systemctl disable --now apparmor 2>/dev/null || true | |
| sudo aa-teardown 2>/dev/null || true | |
| echo "AppArmor status after teardown:" | |
| sudo aa-status 2>/dev/null || echo "(aa-status failed)" | |
| # Allow unprivileged user namespace creation (needed by passt | |
| # inside containers). | |
| sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 | |
| - name: Start podman socket | |
| run: systemctl --user start podman.socket | |
| - name: Download operator image | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: operator-image | |
| - name: Load operator image | |
| run: podman load -i operator-image.tar | |
| - name: Fix registries configuration | |
| run: | | |
| sudo tee /etc/containers/registries.conf > /dev/null <<'EOF' | |
| unqualified-search-registries = ["docker.io"] | |
| EOF | |
| - name: Start bink cluster | |
| run: make start-bink | |
| - name: Deploy to bink cluster | |
| run: make deploy-bink | |
| - name: Gather deploy logs | |
| if: failure() | |
| run: make gather-bink | |
| - name: Run e2e tests | |
| run: make e2e V=1 | |
| - name: Upload logs | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: e2e-logs-${{ matrix.kube-minor }} | |
| path: _output/logs/ | |
| if-no-files-found: ignore | |
| push: | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| needs: e2e | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository }} | |
| steps: | |
| - name: Download operator image | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: operator-image | |
| - name: Load operator image | |
| run: podman load -i operator-image.tar | |
| - name: Push to GHCR | |
| env: | |
| ACTOR: ${{ github.actor }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| SHA: ${{ github.sha }} | |
| REF: ${{ github.ref }} | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| podman login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io | |
| podman push bootc-operator:dev "${IMAGE}":dev | |
| podman push bootc-operator:dev "${IMAGE}":"${SHA}" | |
| if [[ "${REF}" == refs/tags/v* ]]; then | |
| podman push bootc-operator:dev "${IMAGE}":"${REF_NAME}" | |
| fi | |
| if [[ "${REF}" == refs/heads/main ]]; then | |
| podman push bootc-operator:dev "${IMAGE}":latest | |
| fi |