From d35fd6612f8649e60969d512161aee24e9a54244 Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Mon, 10 Aug 2026 17:17:23 +0000 Subject: [PATCH 1/2] ci: Remove dead code, unused inputs and honor input refs - Delete unused typos.toml (spell-check runs cspell, not typos). - Remove useless "Get revision SHA" steps and inline github.ref_name where the branch value is still needed (build-latest). - Remove the dead "Get image digest" and "Set short SHA" steps in build-latest. - Drop unused workflow inputs (runner, runner-arch-map, unused runner-archs, dead ref) and their call-site passes - Use the declared ref input into checkout (lint, unit_test, vm_test, kind_test) - Remove unused GIT_CLONE_PAT secret and no-op workflow_dispatch triggers that cannot run standalone (upload_s3, vm_test, kind_test) - Drop redundant host dependency install in kind_test (used only inside the node) Signed-off-by: Charalampos Mainas --- .github/linters/typos.toml | 18 ---------- .github/linters/urunc-dict.txt | 1 + .github/workflows/build-latest.yml | 47 +------------------------ .github/workflows/build-trigger.yml | 1 - .github/workflows/build.yml | 30 ---------------- .github/workflows/ci.yml | 6 +++- .github/workflows/kind_test.yml | 19 ++-------- .github/workflows/lint.yml | 2 +- .github/workflows/pr-merge.yml | 2 -- .github/workflows/unit_test.yml | 2 +- .github/workflows/urunc-deploy-test.yml | 6 ---- .github/workflows/vm_test.yml | 31 ++++------------ 12 files changed, 17 insertions(+), 148 deletions(-) delete mode 100644 .github/linters/typos.toml diff --git a/.github/linters/typos.toml b/.github/linters/typos.toml deleted file mode 100644 index 605b9ebb5..000000000 --- a/.github/linters/typos.toml +++ /dev/null @@ -1,18 +0,0 @@ -[default] -extend-ignore-re = [ - "(?Rm)^.*(#|//)\\s*spellchecker:disable-line$", - "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on" -] - -[default.extend-words] -SEH = "SEH" -ser = "ser" -nd = "nd" - -[files] -extend-exclude = [ - "subprojects/*", - "third-party/*", - "test/catch2/*", - "test/fff/*" -] diff --git a/.github/linters/urunc-dict.txt b/.github/linters/urunc-dict.txt index 2912e2018..c38ddff05 100644 --- a/.github/linters/urunc-dict.txt +++ b/.github/linters/urunc-dict.txt @@ -471,3 +471,4 @@ Crootfs APIC makefs Nachiket +archs diff --git a/.github/workflows/build-latest.yml b/.github/workflows/build-latest.yml index 2dfa801d6..11dccb11f 100644 --- a/.github/workflows/build-latest.yml +++ b/.github/workflows/build-latest.yml @@ -3,18 +3,12 @@ name: 🍜 Build/publish urunc-deploy image on: workflow_call: inputs: - runner: - type: string - default: '["base", "dind", "2204"]' runner-archs: type: string default: '["amd64", "aarch64"]' dockerfiles: type: string default: '["Dockerfile"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64", "aarch64":"aarch64", "armv7l":"armv7l"}]' registry: type: string default: 'ghcr.io' @@ -57,9 +51,6 @@ jobs: - name: Checkout the repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Set short SHA - run: echo "SHA_SHORT=${GITHUB_SHA::7}" >> $GITHUB_ENV - - name: Set up Docker Buildx uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 @@ -78,36 +69,6 @@ jobs: tags: | type=sha,prefix=${{ env.ARCH }}- - - name: Get revision SHA and branch (safe) - id: get-rev - env: - EVENT_NAME: ${{ github.event_name }} - IS_MERGED: ${{ github.event.pull_request.merged }} - GITHUB_SHA: ${{ github.sha }} - PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} - PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} - PR_BASE_REF: ${{ github.event.pull_request.base.ref }} - REF_NAME: ${{ github.ref_name }} - run: | - if [ "$EVENT_NAME" == "pull_request" ]; then - if [ "$IS_MERGED" == "true" ]; then - sha="$GITHUB_SHA" - branch="$PR_BASE_REF" - echo "PR merged. SHA: ${sha}, Branch: ${branch}" - else - sha="$PR_HEAD_SHA" - branch="$PR_HEAD_REF" - echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}" - fi - else - sha="$GITHUB_SHA" - branch="$REF_NAME" - echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}" - fi - - echo "sha=${sha}" >> "$GITHUB_OUTPUT" - echo "branch=${branch}" >> "$GITHUB_OUTPUT" - - name: Build and push urunc-deploy-${{ matrix.arch}} id: build-and-push uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # master @@ -118,15 +79,9 @@ jobs: push: true file: ${{ inputs.dockerfiles }} build-args: | - BRANCH=${{ steps.get-rev.outputs.branch }} + BRANCH=${{ github.ref_name }} REPO=${{ github.repository }} provenance: false - - - name: Get image digest - run: | - echo "IMAGE_DIGEST=$(docker inspect \ - ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.ARCH }}-${{ env.SHA_SHORT }} | \ - jq -r '.[0].Id')" >> $GITHUB_ENV - name: Install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # main diff --git a/.github/workflows/build-trigger.yml b/.github/workflows/build-trigger.yml index f6d7d7b84..b97f4acfd 100644 --- a/.github/workflows/build-trigger.yml +++ b/.github/workflows/build-trigger.yml @@ -61,7 +61,6 @@ jobs: uses: ./.github/workflows/build-latest.yml secrets: inherit with: - runner: '["base", "dind", "2204"]' runner-archs: '["amd64", "arm64"]' dockerfiles: 'deployment/urunc-deploy/Dockerfile' version-tag: ${{ needs.get-changed-files.outputs.version == 'true' }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 63fad4b28..0fd1f6857 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -52,36 +52,6 @@ jobs: run: | go version - - name: Get revision SHA and branch (safe) - id: get-rev - env: - EVENT_NAME: ${{ github.event_name }} - IS_MERGED: ${{ github.event.pull_request.merged }} - GITHUB_SHA: ${{ github.sha }} - PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} - PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} - PR_BASE_REF: ${{ github.event.pull_request.base.ref }} - REF_NAME: ${{ github.ref_name }} - run: | - if [ "$EVENT_NAME" == "pull_request" ]; then - if [ "$IS_MERGED" == "true" ]; then - sha="$GITHUB_SHA" - branch="$PR_BASE_REF" - echo "PR merged. SHA: ${sha}, Branch: ${branch}" - else - sha="$PR_HEAD_SHA" - branch="$PR_HEAD_REF" - echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}" - fi - else - sha="$GITHUB_SHA" - branch="$REF_NAME" - echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}" - fi - - echo "sha=${sha}" >> "$GITHUB_OUTPUT" - echo "branch=${branch}" >> "$GITHUB_OUTPUT" - - name: Build urunc binaries id: build-urunc-binaries run: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fe4fe1651..72a51a4ad 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -67,7 +67,11 @@ jobs: name: E2E test uses: ./.github/workflows/vm_test.yml with: - ref: ${{ inputs.ref }} + # Run the e2e suite from the base branch, so a PR cannot silently weaken + # the tests that gate its own binary. Changes under tests/ are exercised + # with the PR's own test code by e2e-test-changes.yml. Falls back to the + # caller ref for non-PR runs (nightly/release), where base.sha is empty. + ref: ${{ github.event.pull_request.base.sha || inputs.ref }} go_version: ${{ inputs.go_version }} runner-archs: '["amd64", "arm64"]' runc_version: '1.3.0' diff --git a/.github/workflows/kind_test.yml b/.github/workflows/kind_test.yml index c77f757de..4e8d8057a 100644 --- a/.github/workflows/kind_test.yml +++ b/.github/workflows/kind_test.yml @@ -5,15 +5,6 @@ on: ref: type: string default: '' - runner: - type: string - default: '["base", "dind", "2204"]' - runner-archs: - type: string - default: '["amd64", "arm64"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]' firecracker_version: type: string required: true @@ -23,10 +14,6 @@ on: runc_version: required: true type: string - secrets: - GIT_CLONE_PAT: - required: false - workflow_dispatch: permissions: contents: read @@ -50,11 +37,9 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.ref }} - - name: Install base dependencies - run: | - sudo apt-get update - sudo apt-get install -y git wget build-essential libseccomp-dev pkg-config bc make - name: Install kind run: | ARCH=$(uname -m) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 484a308e7..439aab09b 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -33,7 +33,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ inputs.ref }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: ${{ inputs.go_version }} diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml index 2982dfb43..7717abbd2 100644 --- a/.github/workflows/pr-merge.yml +++ b/.github/workflows/pr-merge.yml @@ -51,8 +51,6 @@ jobs: GH_TOKEN: ${{ steps.generate-token.outputs.token }} PR_BRANCH: ${{ github.event.pull_request.base.ref }} run: | - PR_BRANCH=${{ github.event.pull_request.base.ref }} - # Create the pull request PR_URL=$(gh pr create \ --head "$PR_BRANCH" \ diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml index 05522255e..e517a5232 100644 --- a/.github/workflows/unit_test.yml +++ b/.github/workflows/unit_test.yml @@ -37,7 +37,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ inputs.ref }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: diff --git a/.github/workflows/urunc-deploy-test.yml b/.github/workflows/urunc-deploy-test.yml index 02d25100a..6f42ea902 100644 --- a/.github/workflows/urunc-deploy-test.yml +++ b/.github/workflows/urunc-deploy-test.yml @@ -5,12 +5,6 @@ on: ref: type: string default: "" - runner-archs: - type: string - default: '["amd64", "arm64"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64","arm64":"aarch64"}]' runc_version: required: true type: string diff --git a/.github/workflows/vm_test.yml b/.github/workflows/vm_test.yml index fb15dfbc9..64c2704bd 100644 --- a/.github/workflows/vm_test.yml +++ b/.github/workflows/vm_test.yml @@ -8,15 +8,9 @@ on: go_version: required: true type: string - runner: - type: string - default: '["base", "dind", "2204"]' runner-archs: type: string default: '["amd64"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]' runc_version: required: true type: string @@ -44,11 +38,6 @@ on: hyperlight_unikraft_version: required: true type: string - secrets: - GIT_CLONE_PAT: - required: false - - workflow_dispatch: permissions: contents: read @@ -82,18 +71,9 @@ jobs: SOLO5_VERSION: ${{ inputs.solo5_version }} HYPERLIGHT_UNIKRAFT_VERSION: ${{ inputs.hyperlight_unikraft_version }} run: | - SAFE_GO_VERSION="$GO_VERSION" - SAFE_RUNC_VERSION="$RUNC_VERSION" - SAFE_CONTAINERD_VERSION="$CONTAINERD_VERSION" - SAFE_CNI_VERSION="$CNI_VERSION" - SAFE_NERDCTL_VERSION="$NERDCTL_VERSION" - SAFE_CRICTL_VERSION="$CRICTL_VERSION" - SAFE_FIRECRACKER_VERSION="$FIRECRACKER_VERSION" - SAFE_CLOUD_HYPERVISOR_VERSION="$CLOUD_HYPERVISOR_VERSION" - SAFE_SOLO5_VERSION="$SOLO5_VERSION" - SAFE_HYPERLIGHT_UNIKRAFT_VERSION="$HYPERLIGHT_UNIKRAFT_VERSION" - - for var in SAFE_GO_VERSION SAFE_RUNC_VERSION SAFE_CONTAINERD_VERSION SAFE_CNI_VERSION SAFE_NERDCTL_VERSION SAFE_CRICTL_VERSION SAFE_FIRECRACKER_VERSION SAFE_CLOUD_HYPERVISOR_VERSION SAFE_SOLO5_VERSION SAFE_HYPERLIGHT_UNIKRAFT_VERSION; do + for var in GO_VERSION RUNC_VERSION CONTAINERD_VERSION CNI_VERSION \ + NERDCTL_VERSION CRICTL_VERSION FIRECRACKER_VERSION \ + CLOUD_HYPERVISOR_VERSION SOLO5_VERSION HYPERLIGHT_UNIKRAFT_VERSION; do value="${!var}" if ! [[ "$value" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then echo "Invalid format for $var: $value" @@ -108,6 +88,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.ref }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: @@ -362,14 +344,13 @@ jobs: EOF sudo chmod +x /usr/local/bin/containerd-shim-urunc-fc-v2 - - name: Add runner user to KVM group + - name: Grant access to /dev/kvm if: ${{ matrix.arch == 'amd64' }} id: kvm-setup run: | echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules sudo udevadm control --reload-rules sudo udevadm trigger --name-match=kvm - sudo usermod -a -G kvm $USER - name: Prepare urunc folder id: prepare From 091e69e1220e4f984fd8636be24d0f8757196812 Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Tue, 18 Aug 2026 19:55:47 +0000 Subject: [PATCH 2/2] ci: Invoke the vm_tests with different base for changes in tests/ We currently execute the end-to-end tests using the base ref of a PR in order to ensure that the PR's code works as expected and nothing in the PR trickes the tests in order to succeed. However, we also need to tests the changes that take place in the e2e tests. For that reason, another run of vm_tests is triggered using the PR's branch ref to check if the new code of end-to-end tests is working properly. Signed-off-by: Charalampos Mainas --- .github/workflows/ci.yml | 53 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 72a51a4ad..8d4dc44e3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -96,3 +96,56 @@ jobs: solo5_version: 'v0.9.3' runc_version: '1.3.0' secrets: inherit + + # The vm_test job above runs the base branch's e2e code. In order to also + # test changes in the e2e testing code, re-run the vm_test with the changed + # e2e test code. HOwever, do that only when a change in these files has + # taken place. + detect-test-changes: + if: ${{ github.event_name == 'pull_request' && inputs.skip-build != 'yes' }} + name: Detect test changes + runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read + outputs: + tests_changed: ${{ steps.check.outputs.tests_changed }} + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + egress-policy: audit + + - name: Check whether the PR touches tests/ + id: check + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const files = await github.paginate(github.rest.pulls.listFiles, { + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: context.payload.pull_request.number, + }); + const roots = ['tests/', 'Makefile', 'script/dm_create.sh']; + const changed = files.some(f => roots.some(r => f.filename.startsWith(r))); + core.setOutput('tests_changed', changed ? 'yes' : 'no'); + + vm_test_head: + if: ${{ inputs.skip-build != 'yes' && needs.detect-test-changes.outputs.tests_changed == 'yes' }} + needs: [build, unit_test, detect-test-changes] + name: E2E test (PR test code) + uses: ./.github/workflows/vm_test.yml + with: + ref: ${{ inputs.ref }} + go_version: ${{ inputs.go_version }} + runner-archs: '["amd64", "arm64"]' + runc_version: '1.3.0' + containerd_version: '2.1.3' + cni_version: '1.7.1' + nerdctl_version: '2.1.3' + crictl_version: 'v1.30.0' + firecracker_version: 'v1.7.0' + cloud_hypervisor_version: 'v50.0' + solo5_version: 'v0.9.3' + hyperlight_unikraft_version: 'v0.12.1' + secrets: inherit