New GHA lima ci testing setup

The main gh action is just there to install lima and then call the main
ci.sh script which uses lima to start the right VM and then run the
tests inside there mostly for linux tasks where possible.

Inside the VM we use the runner.sh script to setup the env and launch the
final test.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This commit is contained in:
Paul Holzinger committed 2026-06-01 13:01:34 +02:00
1 parent f9db3cbd2b
commit 399e822ca4
8 files changed
+674 -613

No files matched your search

Executable
+43
View File
@@ -0,0 +1,43 @@
#!/usr/bin/env bash
set -eo pipefail
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" && pwd )
source "$SCRIPT_DIR/lib.sh"
AUTOMATION_RELEASE="20260520t200858z"
LIMA_VM_NAME=podman-ci
REPO_DIR="$SCRIPT_DIR/../.."
parse_args "$@"
IMAGE="$DISTRO_NAME.x86_64.qcow2.zst"
# IMAGE_URL="~/Downloads/fedora-rawhide.x86_64.qcow2.zst"
IMAGE_URL="https://objectstorage.us-ashburn-1.oraclecloud.com/n/id0lmbbwgcdv/b/podman-ci-vm-images/o/releases/$AUTOMATION_RELEASE/$IMAGE"
trap "limactl delete --force $LIMA_VM_NAME" EXIT
limactl --yes start --plain --name=$LIMA_VM_NAME --cpus $(nproc) --memory 8 --nested-virt \
--set ".images=[{\"location\":\"$IMAGE_URL\", \"arch\": \"x86_64\"}]" \
"$SCRIPT_DIR/template.lima.yml"
limactl copy "$REPO_DIR" $LIMA_VM_NAME:/var/tmp/podman
set +e
limactl shell --workdir /var/tmp/podman $LIMA_VM_NAME ./hack/ci/runner.sh "${@}"
rc=$?
limactl shell --workdir /var/tmp/podman $LIMA_VM_NAME sudo ./hack/ci/logcollector.sh journal &> "$SCRIPT_DIR/journal.log"
# TODO: figure out how to cache the binaries from the build job to the actual test tasks
# Copy the binaries out of the VM in gh actions so we can upload them as artifact
# if [[ -n "$GITHUB_ACTIONS" && "$TEST" == build ]]; then
# limactl copy $LIMA_VM_NAME:/var/tmp/podman/bin "$REPO_DIR/bin" || die "failed to copy binaries"
# fi
exit $rc
+68 -237
View File
@@ -1,233 +1,70 @@
# This must be sourced from other scripts to work.
OS_RELEASE_VER="$(source /etc/os-release; echo $VERSION_ID | tr -d '.')"
OS_RELEASE_ID="$(source /etc/os-release; echo $ID)"
OS_REL_VER="$OS_RELEASE_ID-$OS_RELEASE_VER"
# Library of common, shared utility functions. This file is intended
# to be sourced by other scripts, not called directly.
# BEGIN Global export of all variables
set -a
# Due to differences across platforms and runtime execution environments,
# handling of the (otherwise) default shell setup is non-uniform. Rather
# than attempt to workaround differences, simply force-load/set required
# items every time this library is utilized.
USER="$(whoami)"
HOME="$(getent passwd $USER | cut -d : -f 6)"
# Some platforms set and make this read-only
[[ -n "$UID" ]] || \
UID=$(getent passwd $USER | cut -d : -f 3)
# Automation library installed at image-build time,
# defining $AUTOMATION_LIB_PATH in this file.
if [[ -r "/etc/automation_environment" ]]; then
source /etc/automation_environment
fi
# shellcheck disable=SC2154
if [[ -n "$AUTOMATION_LIB_PATH" ]]; then
# shellcheck source=/usr/share/automation/lib/common_lib.sh
source $AUTOMATION_LIB_PATH/common_lib.sh
else
(
echo "WARNING: It does not appear that containers/automation was installed."
echo " Functionality of most of this library will be negatively impacted"
echo " This ${BASH_SOURCE[0]} was loaded by ${BASH_SOURCE[1]}"
) > /dev/stderr
fi
# Managed by setup_environment.sh; holds task-specific definitions.
if [[ -r "/etc/ci_environment" ]]; then source /etc/ci_environment; fi
# Set DEST_BRANCH automatically, this var used for many checks,
# i.e. to find out the merge base to do build/commit checks.
# To avoid having to set it manually for each branch try to
# generate based of the CIRRUS env.
# shellcheck disable=SC2154
if [[ -z "$CIRRUS_PR" ]]; then
# shellcheck disable=SC2154
DEST_BRANCH="$CIRRUS_BRANCH"
else
# shellcheck disable=SC2154
DEST_BRANCH="$CIRRUS_BASE_BRANCH"
fi
if [[ -z "${DEST_BRANCH}" ]]; then
die "DEST_BRANCH is undefined, not running under cirrus?"
fi
msg "DEST_BRANCH is $DEST_BRANCH"
export DEST_BRANCH
# This is normally set from .cirrus.yml but default is necessary when
# running under hack/get_ci_vm.sh since it cannot infer the value.
DISTRO_NV="${DISTRO_NV:-$OS_REL_VER}"
# Essential default paths, many are overridden when executing under Cirrus-CI
GOPATH="${GOPATH:-/var/tmp/go}"
if type -P go &> /dev/null
then
# Cirrus-CI caches $GOPATH contents
export GOCACHE="${GOCACHE:-$GOPATH/cache/go-build}"
# called processes like `make` and other tools need these vars.
eval "export $(go env)"
# Ensure compiled tooling is reachable
PATH="$PATH:$GOPATH/bin:$HOME/.local/bin"
fi
CIRRUS_WORKING_DIR="${CIRRUS_WORKING_DIR:-$(realpath $(dirname ${BASH_SOURCE[0]})/../../)}"
GOSRC="${GOSRC:-$CIRRUS_WORKING_DIR}"
PATH="$HOME/bin:/usr/local/bin:$PATH"
LD_LIBRARY_PATH="/usr/local/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
# Saves typing / in case location ever moves
SCRIPT_BASE=${SCRIPT_BASE:-./hack/ci}
# Downloaded, but not installed packages.
PACKAGE_DOWNLOAD_DIR=/var/cache/download
# Log remote-client system test server output here
PODMAN_SERVER_LOG=$CIRRUS_WORKING_DIR/podman-server.log
# Defaults when not running under CI
export CI="${CI:-false}"
CIRRUS_CI="${CIRRUS_CI:-false}"
CONTINUOUS_INTEGRATION="${CONTINUOUS_INTEGRATION:-false}"
CIRRUS_REPO_NAME=${CIRRUS_REPO_NAME:-podman}
# All CI jobs use a local registry
export CI_USE_REGISTRY_CACHE=true
# shellcheck disable=SC2154
if [[ -n "$CIRRUS_PR" ]] && [[ -z "$PR_BASE_SHA" ]]; then
# shellcheck disable=SC2154
PR_BASE_SHA=$(git merge-base ${DEST_BRANCH:-main} HEAD)
export PR_BASE_SHA
fi
# The next three values define regular expressions matching env. vars. necessary
# for all possible testing contexts (rootless, container, etc.). These values
# are consumed by the passthrough_envars() automation library function.
#
# List of envariables which must be EXACT matches
PASSTHROUGH_ENV_EXACT='CGROUP_MANAGER|DEST_BRANCH|DISTRO_NV|GOCACHE|GOPATH|GOSRC|NETWORK_BACKEND|OCI_RUNTIME|PR_BASE_SHA|ROOTLESS_USER|SCRIPT_BASE|SKIP_USERNS|EC2_INST_TYPE|PODMAN_DB|STORAGE_FS|PODMAN_BATS_LEAK_CHECK'
# List of envariable patterns which must match AT THE BEGINNING of the name.
# Consumed by the passthrough_envars() automation library function.
PASSTHROUGH_ENV_ATSTART='CI|LANG|LC_|STORAGE_OPTIONS_|TEST'
# List of envariable patterns which can match ANYWHERE in the name.
# Consumed by the passthrough_envars() automation library function.
PASSTHROUGH_ENV_ANYWHERE='_NAME|_FQIN'
# Unsafe env. vars for display
SECRET_ENV_RE='ACCOUNT|GC[EP]..|SSH|PASSWORD|SECRET|TOKEN'
# Type of filesystem used for cgroups
CG_FS_TYPE="$(stat -f -c %T /sys/fs/cgroup)"
# Set to 1 in all podman container images
CONTAINER="${CONTAINER:-0}"
# Without this, perl garbles "f39β" command-line args
PERL_UNICODE=A
# END Global export of all variables
set +a
lilto() { err_retry 8 1000 "" "$@"; } # just over 4 minutes max
bigto() { err_retry 7 5670 "" "$@"; } # 12 minutes max
setup_rootless() {
req_env_vars GOPATH GOSRC SECRET_ENV_RE
ROOTLESS_USER="${ROOTLESS_USER:-some${RANDOM}dude}"
ROOTLESS_UID=""
local rootless_uid
local rootless_gid
local env_var_val
local akfilepath
local sshcmd
# Only do this once; established by setup_environment.sh
# shellcheck disable=SC2154
if passwd --status $ROOTLESS_USER
then
# Farm tests utilize the rootless user to simulate a "remote" podman instance.
# Root still needs to own the repo. clone and all things under `$GOPATH`. The
# opposite is true for the lower-level podman e2e tests, the rootless user
# runs them, and therefore needs permissions.
if [[ $PRIV_NAME = "rootless" ]] && [[ "$TEST_FLAVOR" != "farm" ]]; then
msg "Updating $ROOTLESS_USER user permissions on possibly changed libpod code"
chown -R $ROOTLESS_USER:$ROOTLESS_USER "$GOPATH" "$GOSRC"
return 0
fi
fi
msg "************************************************************"
msg "Setting up rootless user '$ROOTLESS_USER'"
msg "************************************************************"
cd $GOSRC || exit 1
# Guarantee independence from specific values
rootless_uid=$((1500 + RANDOM % 5000))
ROOTLESS_UID=$rootless_uid
rootless_gid=$((1500 + RANDOM % 5000))
msg "creating $rootless_uid:$rootless_gid $ROOTLESS_USER user"
showrun groupadd -g $rootless_gid $ROOTLESS_USER
showrun useradd -g $rootless_gid -u $rootless_uid --no-user-group --create-home $ROOTLESS_USER
# use tmpfs to speed up IO
mount -t tmpfs -o size=75%,mode=0700,uid=$rootless_uid,gid=$rootless_gid none /home/$ROOTLESS_USER
echo "$ROOTLESS_USER ALL=(root) NOPASSWD: ALL" > /etc/sudoers.d/ci-rootless
mkdir -p "$HOME/.ssh" "/home/$ROOTLESS_USER/.ssh"
msg "Creating ssh key pairs"
[[ -r "$HOME/.ssh/id_rsa" ]] || \
ssh-keygen -t rsa -P "" -f "$HOME/.ssh/id_rsa"
showrun ssh-keygen -t ed25519 -P "" -f "/home/$ROOTLESS_USER/.ssh/id_ed25519"
showrun ssh-keygen -t rsa -P "" -f "/home/$ROOTLESS_USER/.ssh/id_rsa"
msg "Set up authorized_keys"
cat $HOME/.ssh/*.pub /home/$ROOTLESS_USER/.ssh/*.pub >> $HOME/.ssh/authorized_keys
cat $HOME/.ssh/*.pub /home/$ROOTLESS_USER/.ssh/*.pub >> /home/$ROOTLESS_USER/.ssh/authorized_keys
msg "Configure ssh file permissions"
chmod -R 700 "$HOME/.ssh"
chmod -R 700 "/home/$ROOTLESS_USER/.ssh"
chown -R $ROOTLESS_USER:$ROOTLESS_USER "/home/$ROOTLESS_USER/.ssh"
# N/B: We're clobbering the known_hosts here on purpose. There should
# never be any non-localhost connections made from tests (using strict-mode).
# If there are, it's either a security problem or a broken test, both of which
# we want to lead to test failures.
msg " set up known_hosts for $USER"
ssh-keyscan localhost > /root/.ssh/known_hosts
msg " set up known_hosts for $ROOTLESS_USER"
# Maintain access-permission consistency with all other .ssh files.
install -Z -m 700 -o $ROOTLESS_USER -g $ROOTLESS_USER \
/root/.ssh/known_hosts /home/$ROOTLESS_USER/.ssh/known_hosts
if [[ -n "$ROOTLESS_USER" ]]; then
showrun echo "conditional setup for ROOTLESS_USER [=$ROOTLESS_USER]"
# Make all future CI scripts aware of these values
echo "ROOTLESS_USER=$ROOTLESS_USER" >> /etc/ci_environment
echo "ROOTLESS_UID=$ROOTLESS_UID" >> /etc/ci_environment
fi
function die() {
echo "$1" >&2
exit 1
}
install_test_configs() {
# Which registries.conf to use. By default we always want the cached one...
cached="-cached"
# ...except for podman-machine, where it's antihelpful
if [[ -n "$1" ]]; then
if [[ "$1" = "nocache" ]]; then
cached=""
else
die "Internal error: install_test_configs(): unknown arg '$*'"
fi
fi
function parse_args() {
# TEST name, i.e. int or sys
TEST=
# i.e. fedora-current
DISTRO_NAME=
# local or remote podman
MODE=local
# root or rootless
PRIV=rootless
case "$#" in
2)
TEST=$1
DISTRO_NAME=$2
;;
3)
TEST=$1
PRIV=$2
DISTRO_NAME=$3
;;
4)
TEST=$1
MODE=$2
PRIV=$3
DISTRO_NAME=$4
;;
*)
die "Invalid number of arguments $#, need 2-4"
;;
esac
msg "Installing ./test/registries$cached.conf system-wide."
# All CI VMs run with a local registry
install -v -D -m 644 ./test/registries$cached.conf /etc/containers/registries.conf
validate_distro "$DISTRO_NAME"
validate_mode "$MODE"
}
function validate_distro() {
case "$1" in
"fedora-current"|"fedora-prior"|"fedora-rawhide"|"debian-sid")
;;
*)
die "Unknown DISTRO_NAME '$1' set"
;;
esac
}
function validate_mode() {
case "$1" in
"local"|"remote")
;;
*)
# upgrade test uses mode to pass the upgrade version
if [[ "$TEST" != "upgrade" ]]; then
die "Unknown MODE '$1' set"
fi
;;
esac
}
# Remove all files provided by the distro version of podman.
@@ -236,20 +73,19 @@ install_test_configs() {
# of pulling in necessary prerequisites packages as the set can change over time.
# For general CI testing however, calling this function makes sure the system
# can only run the compiled source version.
remove_packaged_podman_files() {
function remove_packaged_podman_files() {
echo "Removing packaged podman files to prevent conflicts with source build and testing."
req_env_vars OS_RELEASE_ID
# If any binaries are resident they could cause unexpected pollution
for unit in podman.socket podman-auto-update.timer
do
for state in enabled active
do
if systemctl --quiet is-$state $unit
if sudo systemctl --quiet is-$state $unit
then
echo "Warning: $unit found $state prior to packaged-file removal"
showrun systemctl --quiet disable $unit || true
showrun systemctl --quiet stop $unit || true
sudo systemctl --quiet disable $unit || true
sudo systemctl --quiet stop $unit || true
fi
done
done
@@ -265,18 +101,13 @@ remove_packaged_podman_files() {
# delete the podman socket in case it has been created previously.
# Do so without running podman, lest that invocation initialize unwanted state.
rm -f /run/podman/podman.sock /run/user/$(id -u)/podman/podman.sock || true
sudo rm -f /run/podman/podman.sock /run/user/$(id -u)/podman/podman.sock || true
# yum/dnf/dpkg may list system directories, only remove files
$LISTING_CMD | while read fullpath
do
# Sub-directories may contain unrelated/valuable stuff
if [[ -d "$fullpath" ]]; then continue; fi
showrun ooe.sh rm -vf "$fullpath"
sudo rm -f "$fullpath"
done
# Be super extra sure and careful vs performant and completely safe
sync && echo 3 > /proc/sys/vm/drop_caches || true
}
showrun echo "finished"
+6 -8
View File
@@ -5,8 +5,6 @@ set -e
# shellcheck source=hack/ci/lib.sh
source $(dirname $0)/lib.sh
req_env_vars CIRRUS_WORKING_DIR OS_RELEASE_ID
# Assume there are other log collection commands to follow - Don't
# let one break another that may be useful, but also keep any
# actual script-problems fatal so they are noticed right away.
@@ -22,6 +20,11 @@ showrun() {
set -e
}
bad_os_id_ver() {
die "Unknown OS '$OS_RELEASE_ID'"
}
case $1 in
audit)
case $OS_RELEASE_ID in
@@ -74,10 +77,5 @@ case $1 in
# Any not-present packages will be listed as such
$PKG_LST_CMD "${PKG_NAMES[@]}" | sort -u
;;
time)
# Assumed to be empty/undefined outside of Cirrus-CI (.cirrus.yml)
# shellcheck disable=SC2154
if [[ -r "$STATS_LOGFILE" ]]; then cat "$STATS_LOGFILE"; fi
;;
*) die "Warning, $(basename $0) doesn't know how to handle the parameter '$1'"
ip) showrun sh -c "ip addr && ip route && ip -6 route" ;;
esac
+186 -365
View File
@@ -1,408 +1,229 @@
#!/bin/bash
#!/usr/bin/env bash
# This script is only intended to be run inside the lima VM to configure it and start the tests.
# Do not run locally.
set -eo pipefail
# This script runs in the Cirrus CI environment, invoked from .cirrus.yml .
# It can also be invoked manually in a `hack/get_ci_cm.sh` environment,
# documentation of said usage is TBI.
#
# The principal deciding factor is the $TEST_FLAVOR envariable: for any
# given value 'xyz' there must be a function '_run_xyz' to handle that
# test. Several other envariables are used to differentiate further,
# most notably:
#
# PODBIN_NAME : "podman" (i.e. local) or "remote"
# TEST_ENVIRON : 'host', or 'container'; desired environment in which to run
# CONTAINER : 1 if *currently* running inside a container, 0 if host
#
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" && pwd )
# shellcheck source=hack/ci/lib.sh
source $(dirname $0)/lib.sh
source "$SCRIPT_DIR/lib.sh"
showrun echo "starting"
parse_args "$@"
function _run_unit() {
# shellcheck disable=SC2154
if [[ "$PODBIN_NAME" != "podman" ]]; then
# shellcheck disable=SC2154
die "$TEST_FLAVOR: Unsupported PODBIN_NAME='$PODBIN_NAME'"
PRESERVE_ENVS="CI_USE_REGISTRY_CACHE,CI_DESIRED_COMPOSEFS,OCI_RUNTIME,CGROUP_MANAGER,STORAGE_FS,STORAGE_OPTIONS_OVERLAY,STORAGE_OPTIONS_VFS,PODMAN_UPGRADE_FROM"
# run as root or or not
SUDO=""
if [[ "$PRIV" == "root" ]]; then
SUDO="sudo --non-interactive --preserve-env=$PRESERVE_ENVS"
fi
STORAGE_FS=overlay
case "$DISTRO_NAME" in
fedora-current)
;;
fedora-prior)
STORAGE_FS=vfs
;;
fedora-rawhide)
# On rawhide enable composefs testing
CI_DESIRED_COMPOSEFS="composefs"
# Enable sequoia testing
TEST_BUILD_TAGS="containers_image_sequoia"
# mount a tmpfs for the container storage. This is a work around for the staging pull composefs flake.
# FIXME: https://github.com/containers/podman/issues/28813
sudo mount -t tmpfs -o size=75%,mode=0700 none /var/lib/containers
;;
debian-sid)
;;
*)
die "Unknown DISTRO_NAME passed $DISTRO_NAME"
;;
esac
# As of July 2024, CI VMs come built-in with a registry.
LCR=/var/cache/local-registry/local-cache-registry
if [[ -x $LCR ]]; then
# Images in cache registry are prepopulated at the time
# VMs are built. If any PR adds a dependency on new images,
# those must be fetched now, at VM start time. This should
# be rare, and must be fixed in next automation images build.
while read new_image; do
$LCR cache $new_image
done < <(grep '^[^#]' test/NEW-IMAGES || true)
fi
## Used in tests so we need to export them
export STORAGE_FS
export CI_DESIRED_COMPOSEFS
### SETUP HERE
# Custom storage.conf setup to test different drivers
conf=/etc/containers/storage.conf
if [[ -e $conf ]]; then
die "FATAL! INTERNAL ERROR! Cannot override $conf"
fi
sudo tee $conf <<EOF
[storage]
driver = "$STORAGE_FS"
EOF
if [[ -n "$CI_DESIRED_COMPOSEFS" ]]; then
# composefs only works as root so we must set it in the rootful config
sudo mkdir /etc/containers/storage.rootful.conf.d/
conf=/etc/containers/storage.rootful.conf.d/99-composefs.conf
sudo tee $conf <<EOF
# BEGIN CI-enabled composefs
[storage.options]
pull_options = {enable_partial_images = "true", use_hard_links = "false", ostree_repos="", convert_images = "true"}
[storage.options.overlay]
use_composefs = "true"
# END CI-enabled composefs
EOF
# KLUDGE ALERT! Magic options needed for testing composefs.
# This option was intended for passing one arg to --storage-opt
# but we're hijacking it to pass an extra option+arg. And it
# actually works.
# This is needed for the e2e tests as they do not use the config file.
if [[ "$PRIV" == "root" ]]; then
export STORAGE_OPTIONS_OVERLAY='overlay.use_composefs=true --pull-option=enable_partial_images=true --pull-option=convert_images=true'
fi
showrun make localunit
}
fi
function _run_apiv2() {
(
showrun make localapiv2-bash
source .venv/requests/bin/activate
showrun make localapiv2-python
) |& logformatter
}
function _run_compose_v2() {
showrun ./test/compose/test-compose |& logformatter
}
# Machine image is not cached by design.
if [[ "$TEST" != machine ]]; then
# Install test registries.conf
sudo install -v -D -m 644 ./test/registries-cached.conf /etc/containers/registries.conf
fi
function _run_int() {
dotest integration
}
function _run_sys() {
dotest system
}
function _run_upgrade_test() {
export SUPPRESS_BOLTDB_WARNING=true
showrun bats test/upgrade |& logformatter
}
function _run_bud() {
showrun ./test/buildah-bud/run-buildah-bud-tests |& logformatter
}
function _run_bindings() {
# install ginkgo
showrun make .install.ginkgo
# if logformatter sees this, it can link directly to failing source lines
local gitcommit_magic=
if [[ -n "$GIT_COMMIT" ]]; then
gitcommit_magic="/define.gitCommit=${GIT_COMMIT}"
# Add Root user namespace for --userns=auto support in tests
for which in uid gid;do
if ! grep -qE '^containers:' /etc/sub$which; then
echo 'containers:10000000:1048576' | sudo tee --append /etc/sub$which
fi
done
(echo "$gitcommit_magic" && \
showrun make testbindings) |& logformatter
}
function _run_docker-py() {
source .venv/docker-py/bin/activate
showrun make run-docker-py-tests
}
# Load null_blk to use /dev/nullb0 for testing block
# devices limits
sudo modprobe null_blk nr_devices=1 || :
function _run_endpoint() {
showrun make test-binaries
showrun make endpoint
}
# Ensure our CI uses the cache registry
export CI_USE_REGISTRY_CACHE=1
function _run_farm() {
msg "Testing podman farm."
showrun bats test/farm |& logformatter
}
exec_container() {
local var_val
local cmd
# Required to be defined by caller
# shellcheck disable=SC2154
msg "Re-executing runner inside container: $CTR_FQIN"
msg "************************************************************"
if [[ "$TEST" != build && "$TEST" != unit ]]; then
## Remove packaged podman and install the compiled podman
remove_packaged_podman_files
make docs binaries EXTRA_BUILDTAGS="$TEST_BUILD_TAGS"
sudo make install PREFIX=/usr ETCDIR=/etc
fi
req_env_vars CTR_FQIN TEST_ENVIRON CONTAINER SECRET_ENV_RE
# Setup git user, bud tests need this.
$SUDO git config --global user.name "Podman CI"
$SUDO git config --global user.email "no-reply@podman.io"
# Line-separated arguments which include shell-escaped special characters
declare -a envargs
while read -r var; do
# Pass "-e VAR" on the command line, not "-e VAR=value". Podman can
# do a much better job of transmitting the value than we can,
# especially when value includes spaces.
envargs+=("-e" "$var")
done <<<"$(passthrough_envars)"
### LOG various relevant things
# VM Images and Container images are built using (nearly) identical operations.
set -x
env CONTAINERS_REGISTRIES_CONF=/dev/null bin/podman pull -q $CTR_FQIN
# shellcheck disable=SC2154
exec bin/podman run --rm --privileged --net=host --cgroupns=host \
-v `mktemp -d -p /var/tmp`:/var/tmp:Z \
--tmpfs /tmp:mode=1777 \
-v /dev/fuse:/dev/fuse \
-v "$GOPATH:$GOPATH:Z" \
--workdir "$GOSRC" \
-e "CONTAINER=1" \
"${envargs[@]}" \
$CTR_FQIN bash -c "$SCRIPT_BASE/setup_environment.sh && $SCRIPT_BASE/runner.sh"
}
echo
echo "#################"
echo "Setup complete, logging versions"
echo "#################"
function _run_build() {
"$SCRIPT_DIR/logcollector.sh" packages
"$SCRIPT_DIR/logcollector.sh" ip
### TEST functions
function run_build() {
# Ensure always start from clean-slate with all vendor modules downloaded
showrun make clean
showrun make vendor
make clean
# make vendor
# shellcheck disable=SC2154
showrun make -j $(nproc) --output-sync=target podman-release EXTRA_BUILDTAGS="$TEST_BUILD_TAGS" # includes podman, podman-remote, and docs
make -j $(nproc) --output-sync=target podman-release EXTRA_BUILDTAGS="$TEST_BUILD_TAGS" # includes podman, podman-remote, and docs
# There's no reason to validate-binaries across multiple linux platforms
# shellcheck disable=SC2154
if [[ "$DISTRO_NV" =~ $FEDORA_NAME ]]; then
showrun make -j $(nproc) --output-sync=target validate-binaries
fi
if [[ "$DISTRO_NAME" == fedora-current ]]; then
make -j $(nproc) --output-sync=target validate-binaries
# Last-minute confirmation that we're testing the desired runtime.
# This Can't Possibly Fail™ in regular CI; only when updating VMs.
# $CI_DESIRED_RUNTIME must be defined in .cirrus.yml.
req_env_vars CI_DESIRED_RUNTIME
runtime=$(bin/podman info --format '{{.Host.OCIRuntime.Name}}')
# shellcheck disable=SC2154
if [[ "$runtime" != "$CI_DESIRED_RUNTIME" ]]; then
die "Built podman is using '$runtime'; this CI environment requires $CI_DESIRED_RUNTIME"
fi
msg "Built podman is using expected runtime='$runtime'"
}
function _run_altbuild() {
local -a arches
local arch
req_env_vars ALT_NAME
# Var. defined in .cirrus.yml
# shellcheck disable=SC2154
msg "Performing alternate build: $ALT_NAME"
msg "************************************************************"
set -x
cd $GOSRC
case "$ALT_NAME" in
*Windows*)
showrun make .install.pre-commit
showrun make lint GOOS=windows CGO_ENABLED=0
showrun make podman-remote-release-windows_amd64.zip
;;
*RPM*)
showrun make package
;;
Alt*x86*Cross)
_build_altbuild_archs "386"
;;
Alt*ARM*Cross)
_build_altbuild_archs "arm"
;;
Alt*Other*Cross)
arches=(\
ppc64le
s390x)
_build_altbuild_archs "${arches[@]}"
;;
Alt*MIPS*Cross)
arches=(\
mips
mipsle)
_build_altbuild_archs "${arches[@]}"
;;
Alt*MIPS64*Cross*)
arches=(\
mips64
mips64le)
_build_altbuild_archs "${arches[@]}"
;;
Alt*RISCV64*Cross)
_build_altbuild_archs "riscv64"
;;
*)
die "Unknown/Unsupported \$$ALT_NAME '$ALT_NAME'"
esac
}
function _build_altbuild_archs() {
for arch in "$@"; do
msg "Building release archive for $arch"
showrun make cross-binaries GOARCH=$arch
done
}
function _run_release() {
msg "podman info:"
bin/podman info
msg "Checking podman release (or potential release) criteria."
# We're running under 'set -eo pipefail'; make sure this statement passes
dev=$(bin/podman info |& grep -- -dev || echo -n '')
if [[ -n "$dev" ]]; then
die "Releases must never contain '-dev' in output of 'podman info' ($dev)"
fi
commit=$(bin/podman info --format='{{.Version.GitCommit}}' | tr -d '[:space:]')
if [[ -z "$commit" ]]; then
die "Releases must contain a non-empty Version.GitCommit in 'podman info'"
fi
msg "All OK"
}
# ***WARNING*** ***WARNING*** ***WARNING*** ***WARNING***
# Please see gitlab comment in setup_environment.sh
# ***WARNING*** ***WARNING*** ***WARNING*** ***WARNING***
function _run_gitlab() {
rootless_uid=$(id -u)
systemctl enable --now --user podman.socket
export DOCKER_HOST=unix:///run/user/${rootless_uid}/podman/podman.sock
export CONTAINER_HOST=$DOCKER_HOST
cd $GOPATH/src/gitlab.com/gitlab-org/gitlab-runner
set +e
go test -v ./executors/docker |& tee $GOSRC/gitlab-runner-podman.log
ret=$?
set -e
# This file is collected and parsed by Cirrus-CI so must be in $GOSRC
cat $GOSRC/gitlab-runner-podman.log | \
go-junit-report > $GOSRC/gitlab-runner-podman.xml
return $ret
}
# Name pattern for logformatter output file, derived from environment
function output_name() {
# .cirrus.yml defines this as a short readable string for web UI
std_name_fmt=$(sed -ne 's/^.*std_name_fmt \"\(.*\)\"/\1/p' <.cirrus.yml)
test -n "$std_name_fmt" || die "Could not grep 'std_name_fmt' from .cirrus.yml"
# Interpolate envariables. 'set -u' throws fatal if any are undefined
(
set -u
eval echo "$std_name_fmt" | tr ' ' '-'
)
}
function logformatter() {
if [[ "$CI" == "true" ]]; then
# Requires stdin and stderr combined!
cat - \
|& awk --file "${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/timestamp.awk" \
|& "${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/logformatter" "$(output_name)"
else
# Assume script is run by a human, they want output immediately
cat -
# This will generate completion scripts so make sure the tree is clean
SUGGESTION="run 'make completions' and commit all changes" ./hack/tree_status.sh
fi
}
# Handle local|remote integration|system testing in a uniform way
dotest() {
local testsuite="$1"
req_env_vars testsuite CONTAINER TEST_ENVIRON PRIV_NAME
# shellcheck disable=SC2154
if ((CONTAINER==0)) && [[ "$TEST_ENVIRON" == "container" ]]; then
exec_container # does not return
fi;
# containers/automation sets this to 0 for its dbg() function
# but the e2e integration tests are also sensitive to it.
unset DEBUG
# shellcheck disable=SC2154
local localremote="$PODBIN_NAME"
case "$PODBIN_NAME" in
podman) localremote="local" ;;
esac
# We've had some oopsies where tests invoke 'podman' instead of
# /path/to/built/podman. Let's catch those.
sudo rm -f /usr/bin/podman /usr/bin/podman-remote
fallback_podman=$(type -p podman || true)
if [[ -n "$fallback_podman" ]]; then
die "Found fallback podman '$fallback_podman' in \$PATH; tests require none, as a guarantee that we're testing the right binary."
fi
# Catch invalid "TMPDIR == /tmp" assumptions; PR #19281
TMPDIR=$(mktemp --tmpdir -d CI_XXXX)
# tmp dir is commonly 1777 to allow all user to read/write
chmod 1777 $TMPDIR
export TMPDIR
fstype=$(findmnt -n -o FSTYPE --target $TMPDIR)
if [[ "$fstype" != "tmpfs" ]]; then
die "The CI test TMPDIR is not on a tmpfs mount, we need tmpfs to make the tests faster"
fi
showrun make ${localremote}${testsuite} PODMAN_SERVER_LOG=$PODMAN_SERVER_LOG EXTRA_BUILDTAGS="$TEST_BUILD_TAGS" \
|& logformatter
# FIXME: https://github.com/containers/podman/issues/22642
# Cannot delete this due cleanup errors, as the VM is basically
# done after this anyway let's not block on this for now.
# rm -rf $TMPDIR
# unset TMPDIR
function run_apiv2() {
virtualenv .venv/requests
source .venv/requests/bin/activate
pip install --upgrade pip
pip install --requirement ./test/apiv2/python/requirements.txt
$SUDO make localapiv2-bash
$SUDO sh -c "source .venv/requests/bin/activate && make localapiv2-python"
}
_run_machine-linux() {
showrun make localmachine |& logformatter
function run_bindings() {
make .install.ginkgo
$SUDO make testbindings
}
# Nearly every task in .cirrus.yml makes use of this shell script
# wrapped by /usr/bin/time to collect runtime statistics. Because the
# --output option is used to log stats to a file, every child-process
# inherits an open FD3 pointing at the log. However, some testing
# operations depend on making use of FD3, and so it must be explicitly
# closed here (and for all further child-processes).
# STATS_LOGFILE assumed empty/undefined outside of Cirrus-CI (.cirrus.yml)
# shellcheck disable=SC2154
exec 3<&-
function run_bud() {
$SUDO ./test/buildah-bud/run-buildah-bud-tests
}
msg "************************************************************"
# Required to be defined by caller
# shellcheck disable=SC2154
msg "Runner executing $TEST_FLAVOR $PODBIN_NAME-tests as $PRIV_NAME on $DISTRO_NV($OS_REL_VER)"
if ((CONTAINER)); then
# shellcheck disable=SC2154
msg "Current environment container image: $CTR_FQIN"
else
# shellcheck disable=SC2154
msg "Current environment VM image: $VM_IMAGE_NAME"
fi
msg "************************************************************"
function run_compose_v2() {
# FIXME do not hard code the version here, and likely it would be best to embed this in the VM image to begin with.
sudo curl --fail -SL https://github.com/docker/compose/releases/download/v2.32.3/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
$SUDO ./test/compose/test-compose
}
((${SETUP_ENVIRONMENT:-0})) || \
die "Expecting setup_environment.sh to have completed successfully"
function run_docker_py() {
virtualenv .venv/docker-py
source .venv/docker-py/bin/activate
pip install --upgrade pip
pip install --requirement ./test/python/requirements.txt
$SUDO sh -c "source .venv/docker-py/bin/activate && make run-docker-py-tests"
}
if [[ "$UID" -eq 0 ]] && ((CONTAINER==0)); then
# start ebpf cleanup tracer (#23487)
msg "start ebpf cleanup tracer"
# replace zero bytes to make the log more readable
bpftrace $GOSRC/hack/podman_cleanup_tracer.bt |& \
tr '\0' ' ' >$GOSRC/podman-cleanup-tracer.log &
TRACER_PID=$!
fi
function run_unit() {
make .install.ginkgo
$SUDO make localunit
}
# shellcheck disable=SC2154
if [[ "$PRIV_NAME" == "rootless" ]] && [[ "$UID" -eq 0 ]]; then
# Remove /var/lib/cni, it is not required for rootless cni.
# We have to test that it works without this directory.
# https://github.com/containers/podman/issues/10857
rm -rf /var/lib/cni
function run_upgrade() {
export SUPPRESS_BOLTDB_WARNING=true
export PODMAN_UPGRADE_FROM=${MODE}
$SUDO bats test/upgrade
}
# This must be done at the last second, otherwise `make` calls
# in setup_environment (as root) will balk about ownership.
msg "Recursively chowning \$GOPATH and \$GOSRC to $ROOTLESS_USER"
if [[ $PRIV_NAME = "rootless" ]]; then
chown -R $ROOTLESS_USER:$ROOTLESS_USER "$GOPATH" "$GOSRC"
fi
function run_int() {
$SUDO make ${MODE}integration
}
req_env_vars ROOTLESS_USER
msg "Re-executing runner through ssh as user '$ROOTLESS_USER'"
msg "************************************************************"
set -x
exec ssh $ROOTLESS_USER@localhost \
-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \
-o CheckHostIP=no $GOSRC/$SCRIPT_BASE/runner.sh
# Does not return!
fi
# else: not running rootless, do nothing special
function run_sys() {
$SUDO make ${MODE}system
}
# Dump important package versions. Before 2022-11-16 this took place as
# a separate .cirrus.yml step, but it really belongs here.
$(dirname $0)/logcollector.sh packages
msg "************************************************************"
function run_machine() {
$SUDO make ${MODE}machine
}
cd "${GOSRC}/"
echo
echo "#################"
echo "Starting Test"
echo "#################"
handler="_run_${TEST_FLAVOR}"
if [ "$(type -t $handler)" != "function" ]; then
die "Unknown/Unsupported \$TEST_FLAVOR=$TEST_FLAVOR"
fi
# Unset NOTIFY_SOCKET based on: https://github.com/containers/podman/pull/27514#issuecomment-3529125596
unset NOTIFY_SOCKET
showrun $handler
if [[ -n "$TRACER_PID" ]]; then
# ignore any error here
kill "$TRACER_PID" || true
fi
showrun echo "finished"
run_$TEST
+4
View File
@@ -0,0 +1,4 @@
# images is empty and should be override on the cli
# --set '.images=[{"location":"https://github.com/podman-io/automation/releases/latest/v0.2.31.rd5/alpine-lima-rd-3.18.0-x86_64.iso", "arch": "x86_64"}]'
images: