Migrate 'build each commit' check from Cirrus to GHA

Add a 'Build each commit' step to the validate-source job. It builds the
PR fork point to record baseline binary sizes, then rebuilds and size-checks
each commit via 'git rebase -x', confirming every commit compiles on its own
and that no binary grows beyond the enforced limit.

Move hack/make-and-check-size to hack/ci/make-and-check-size.sh and replace
its Cirrus-specific GitHub GraphQL label query with a BLOAT_APPROVED env var
that the workflow derives from the 'bloat_approved' PR label.

Drop the now-migrated 'Build Each Commit' matrix entry from .cirrus.yml and
the corresponding *Each* case from hack/ci/runner.sh.

NOTE due to chicken-and-egg problem with make-and-check-size we need to
make a copy of it before working with git.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

.cirrus.yml

@@ -216,8 +216,6 @@ alt_build_task:
         TEST_BUILD_TAGS: ""
     gce_instance: *fastvm
     matrix:
-      - env:
-            ALT_NAME: 'Build Each Commit'
       - env:
             # TODO: Replace with task using `winmake` to build
             # binary and archive installation zip file.

.github/workflows/ci.yml

@@ -92,3 +92,36 @@ jobs:
             -v ./.github/renovate.json5:/usr/src/app/renovate.json5:z \
             ghcr.io/renovatebot/renovate:latest \
             renovate-config-validator
+
+      # IMPORTANT: keep this as the LAST step. Don't add anything after this.
+      # The 'git rebase' below rewrites HEAD and, on failure, leaves the
+      # checkout mid-rebase, so any step running afterwards would see a
+      # mutated/detached repo state.
+      - name: Build each commit
+        # Confirm that every commit in the PR builds on its own (so that
+        # 'git bisect' stays usable) and that no binary grows beyond the
+        # limit enforced by hack/ci/make-and-check-size.sh.
+        if: ${{ github.event_name == 'pull_request' }}
+        env:
+          # The 'bloat_approved' label lets a repo admin override the binary
+          # size growth check in hack/ci/make-and-check-size.sh.
+          BLOAT_APPROVED: ${{ contains(github.event.pull_request.labels.*.name, 'bloat_approved') }}
+        run: |
+          # git rebase rewrites commits, so it needs a committer identity.
+          git config user.name "CI"
+          git config user.email "ci@podman.io"
+          context_dir=$(mktemp -d --tmpdir make-size-check.XXXXXXX)
+          savedhead=$(git rev-parse HEAD)
+          # Make a copy of the script as we'll be rolling git back.
+          cp -a ./hack/ci/make-and-check-size.sh .
+          # Replay only the PR's own commits: the fork point against the base
+          # branch, not the (possibly advanced) base branch tip.
+          pr_base=$(git merge-base "$DEST_BRANCH" HEAD)
+          # Build the PR base first; this run records the baseline binary
+          # sizes that subsequent (per-commit) runs compare against.
+          git checkout --quiet "$pr_base"
+          ./make-and-check-size.sh "$context_dir"
+          # Back to the PR head, then build (and size-check) each commit.
+          git checkout --quiet "$savedhead"
+          git rebase "$pr_base" -x "./make-and-check-size.sh $context_dir"
+          rm -rf "$context_dir" ./make-and-check-size.sh

hack/ci/make-and-check-size.sh

@@ -1,11 +1,13 @@
 #!/bin/bash
 #
-# make-and-check-size - wrapper around 'make' that also checks binary growth
+# make-and-check-size.sh - wrapper around 'make' that also checks binary growth
+#
+# Introduced 2022-03-22 in #13518.
 #
 # This script is intended to be run via 'git rebase -x', in a form such as:
 #
 #     context_dir=$(mktemp -d --tmpdir make-size-check.XXXXXXX)
-#     git rebase ${GIT_BASE_BRANCH}^ -x "hack/make-and-check-size $context_dir"
+#     git rebase ${GIT_BASE_BRANCH}^ -x "hack/ci/make-and-check-size.sh $context_dir"
 #     rm -rf $context_dir
 #
 # (Carefully note the '^' next to GIT_BASE_BRANCH!)
@@ -22,10 +24,10 @@
 #
 # *IMPORTANT NOTE*: this script will leave the git checkout in a funky state!
 # (because we rebase onto a nonterminal commit). I believe this is OK, since
-# this script is only invoked in CI from runner.sh and only in a scratch VM.
-# Running this in a development environment would yield unpredictable results
-# anyway, by rebasing onto origin/main by default and by leaving an aborted
-# rebase on failure.
+# this script is only invoked in CI (from the validate-source workflow) on a
+# throwaway checkout. Running this in a development environment would yield
+# unpredictable results anyway, by rebasing onto origin/main by default and by
+# leaving an aborted rebase on failure.
 #
 ME=$(basename $0)
 
@@ -42,7 +44,7 @@ OVERRIDE_LABEL=bloat_approved
 ###############################################################################
 
 #
-# Helper function: queries github for labels on this PR
+# Helper function: checks whether the size growth has been approved.
 #
 function bloat_approved() {
     # Argument is the actual size increase in this build.
@@ -51,34 +53,9 @@ function bloat_approved() {
     #        requiring a MAX_BIN_GROWTH=nnn statement in github comments.
     local actual_growth="$1"
 
-    if [[ -z "$CIRRUS_PR" ]]; then
-        echo "$ME: cannot query github: \$CIRRUS_PR is undefined" >&2
-        return 1
-    fi
-    if [[ -z "$CIRRUS_REPO_CLONE_TOKEN" ]]; then
-        echo "$ME: cannot query github: \$CIRRUS_REPO_CLONE_TOKEN is undefined" >&2
-        return 1
-    fi
-
-    query="{
-  \"query\": \"query {
-  repository(owner: \\\"containers\\\", name: \\\"podman\\\") {
-    pullRequest(number: $CIRRUS_PR) {
-      labels(first: 100) {
-        nodes {
-          name
-        }
-      }
-    }
-  }
-}\"
-}"
-
-    result=$(curl -s -H "Authorization: bearer $CIRRUS_REPO_CLONE_TOKEN" -H "Accept: application/vnd.github.antiope-preview+json" -H "Content-Type: application/json" -X POST --data @- https://api.github.com/graphql <<<"$query")
-
-    labels=$(jq -r '.data.repository.pullRequest.labels.nodes[].name' <<<"$result")
-
-    grep -q -w "$OVERRIDE_LABEL" <<<"$labels"
+    # The validate-source GitHub Actions workflow sets BLOAT_APPROVED=true when
+    # the PR carries the '$OVERRIDE_LABEL' label.
+    [[ "$BLOAT_APPROVED" == "true" ]]
 }
 
 # ACTUAL CODE BEGINS HERE

hack/ci/runner.sh

@@ -216,32 +216,6 @@ function _run_altbuild() {
     set -x
     cd $GOSRC
     case "$ALT_NAME" in
-        *Each*)
-            if [[ -z "$CIRRUS_PR" ]]; then
-                echo ".....only meaningful on PRs"
-                return
-            fi
-            showrun git fetch origin
-            # The make-and-check-size script, introduced 2022-03-22 in #13518,
-            # runs 'make' (the original purpose of this check) against
-            # each commit, then checks image sizes to make sure that
-            # none have grown beyond a given limit. That of course
-            # requires a baseline, so our first step is to build the
-            # branch point of the PR.
-            local context_dir savedhead pr_base
-            context_dir=$(mktemp -d --tmpdir make-size-check.XXXXXXX)
-            savedhead=$(git rev-parse HEAD)
-            # Push to PR base. First run of the script will write size files
-            # shellcheck disable=SC2154
-            pr_base=$PR_BASE_SHA
-            showrun git checkout $pr_base
-            showrun hack/make-and-check-size $context_dir
-            # pop back to PR, and run incremental makes. Subsequent script
-            # invocations will compare against original size.
-            showrun git checkout $savedhead
-            showrun git rebase $pr_base -x "hack/make-and-check-size $context_dir"
-            rm -rf $context_dir
-            ;;
         *Windows*)
 	    showrun make .install.pre-commit
             showrun make lint GOOS=windows CGO_ENABLED=0