For a while now we trigger CI tests based on if source files, i.e. *.go
files were changed. The "No New Tests" filter however checked something
else via a exclude list that was not being updated.
That means in many cases we needed to add the label when it is clear
that these thing should not need tests, i.e. packit or rpm/ changes.
To avoid the manual updates of all directories just grep for source
files.
Fixes: #28849
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 126d3e27ae)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When the validate-source job is re-run manually after adding a label,
it uses stale labels (from the "pull_request" event that originally
triggered it), and so the steps that check labels don't see new labels.
Fix by querying the labels live (similar to how it was done before
commits 6e597af6dc and 1da154117c).
Note the logic differs slightly between hack/ci/make-and-check-size.sh
and hack/ci/pr-should-include-tests. This is because
pr-should-include-tests is also executed locally as well as on non-PRs,
while make-and-check-size is run strictly in CI for PRs only.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit d05c113acd)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Podman v5.8 is not designed to run with it, we want to test with the
actual packaged one from the image.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The new config parser is not in 5.8, so revert to the older config
format where all is in one file.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add some basic test checks for the new ci.yml to ensure all job
dependencies are set up right.
We can expand this with more checks later.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 66e7c06073)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Makes for easier cleanup, and follows previous cirrus convention.
Signed-off-by: Ashley Cui <acui@redhat.com>
(cherry picked from commit 2984c2450b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Copied from Tim, but directly integrated into the main yml file to allow
for proper task dependencies.
Co-authored-by: Tim Zhou <tizhou@redhat.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit a758d09b64)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The main gh action is just there to install lima and then call the main
ci.sh script which uses lima to start the right VM and then run the
tests inside there mostly for linux tasks where possible.
Inside the VM we use the runner.sh script to setup the env and launch the
final test.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 399e822ca4)
[fixed merge conflict]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add a 'Build each commit' step to the validate-source job. It builds the
PR fork point to record baseline binary sizes, then rebuilds and size-checks
each commit via 'git rebase -x', confirming every commit compiles on its own
and that no binary grows beyond the enforced limit.
Move hack/make-and-check-size to hack/ci/make-and-check-size.sh and replace
its Cirrus-specific GitHub GraphQL label query with a BLOAT_APPROVED env var
that the workflow derives from the 'bloat_approved' PR label.
Drop the now-migrated 'Build Each Commit' matrix entry from .cirrus.yml and
the corresponding *Each* case from hack/ci/runner.sh.
NOTE due to chicken-and-egg problem with make-and-check-size we need to
make a copy of it before working with git.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 1da154117c)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Move the Cirrus validate-source_task to a GitHub Actions workflow
(.github/workflows/ci.yml) running as a single job on the CNCF-hosted
runner. The job runs the same stages: make validate-source,
tests-included, and the conditional renovate config check.
golangci-lint for FreeBSD and macOS now runs cross-compiled (GOOS) on
the native Linux runner instead of on dedicated Cirrus VMs/workers, so
the lint steps are dropped from osx_alt_build and freebsd_alt_build.
The PR helper scripts are de-Cirrus'd: they read CI-neutral env vars
(PR_HEAD, PR_NUMBER, PR_BODY) and the "No New Tests" label override is
now handled natively in the workflow instead of via a GraphQL query.
The shared clone/setup/main YAML anchors are relocated into build_task,
and the dead _run_validate-source runner.sh function is removed.
The tests-of-tests (.t files) are fixed for new setup (mostly removing
test cases which are now obsoleted, like [CI:DOCS] and [NO NEW TESTS]
markers. NOTE we still don't run tests in CI (although we could), but
I ran them locally and fixed all the issues.
Finally, test-jira-links-included is removed as it is RHEL-branch
specific and have no place in the new repo.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 6e597af6dc)
[fixed merge commit]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The install script only reuses the binary from $PATH if the version
matches otherwise installs into ./bin, if the version of $PATH matches
then the binary from ./bin is removed there.
That means the actual run must prefer ./bin as this has a known good
version when it exists unlike $PATH which can be the wrong version.
This fixes the logic added in commit cf021c4ba9.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 2e7178f428)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When a specific version of golangci-lint is already available in $PATH,
use it instead of installing one locally.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit cf021c4ba9)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Since commit def70012b9 git-validation is only used to check if the
commit subject is less than 90 characters.
Drop the vendored git-validation Go tool and the .gitvalidation make
target in favor of hack/commit-subject-check.sh.
This removes a Go build dependency and a vendored tree from
test/tools/ while keeping the same CI and local behavior.
Note the now-removed GIT_CHECK_EXCLUDE was not used by gitvalidation
since commit def70012b9 because it was not checking any specific
files, just the commit subject lengths.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit f45b4c506a)
[manually fixed merge conflicts]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The system tests can setup their own server now so just use that and
don't require the user to spawn its own.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This reverts commit c12b1b32bc.
The content contains incorrect information and misses a lot of details
from the previous page that must be restored.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Using golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize
+ some manual cleanup in libpod/lock/shm/shm_lock_test.go as it
generated an unused variable
+ restored one removed comment
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
There are endless of links pointing to this document we should not get
rid of that.
Also I find having two podman-quadlet with different numbers rather
confusing, while I understand the motivation I think for most users this
is not intuitive. Most people will not type the man section numbers.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This commit does the following:
- Splits the podman-systemd.unit.5.md into multiple files - one for each
quadlet file type, podman-quadlet.7.md for general quadlet information
and podman-quadlet-basic-usage.7.md for quadlet examples.
- Removes the original podman-systemd.unit.5.md file.
- Adds support for jinja2 templating language in the markdown_preprocess.
- Uses jinja2 in options/*.md to use the single .md file for both podman
subcommands man-pages and quadlet man-pages. This deduplicates
the Quadlet man-pages a lot.
- Adds new `@@option quadlet:source.md` preprocess command to import
such .md files from options directory.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
The distro-integration tag was added for fedora openQA to only run a
subset of tests. However since it was added only a few new tests have
been labelled like that and in general a normal contributor or even
maintianer has no idea when to add this tag.
We also have been seeing several regressions getting into fedora that
these tests would have caught. As such I worked with Adam to enable all
tests for fedora openQA so we actually have proper coverage. This has
been working for a few weeks so I think we can dop these tags so
upstream does not need to bother with them at all.
https://pagure.io/fedora-qa/os-autoinst-distri-fedora/issue/373
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It seems the new bpftrace version since 0.22 logs a warning if we try to
delete a key that does not exist.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
On bpftrace 0.22 this fails to compile and load so the script currently
does not show us anything in CI there.
We need to clamp the string size a bit 128 chars seems more than enough
for the podman/conmon binary path length.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The default has been set to 1024 which should bee good enough and better
than having to unroll this loop like that.
This is supported since bpftrace 0.22 which is in fedora 42.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This was not updated to the latest versions and CI and basically any
user should get in from their distro repos.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This script is no longer used as the device mapper storage driver was
removed over a year ago.
Commit 60692ca already removed the build tag reference but not this
script which set a buildtag for it.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Dynamically link sqlite3 when installed, the main motivation is that we
reduce the podman binary size with that. I see about 2.5 MB savings.
But also dynamically linking it means if there a vulnerabilities only
the sqlite3 distro package needs updating and we don't have to make a
new podman release with the vendored update.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This reverts commit d633824a95.
The issue has been fixed in commit 9a0c0b2eef and I have not seen it
since so remove this special case.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This could have been done by simply running
GOOS=freebsd ./bin/golangci-lint run [options] ./...
on Linux, but some freebsd code is using cgo (i.e. is linked to C
libraries), so real freebsd environment is required.
This also fixes the issue of ignoring linter errors for Windows and
Darwin (exit 0), introduced by commit c9b108d5b3.
Fixes: c9b108d5b3 ("Bump golangci-lint to v2.0.2")
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
1. Strip leading v from VERSION.
This will allow to simplify renovate rule at [1].
2. Fix git branch in the URL.
In golangci-lint v2 they've switched from master to main,
and it's not clear what will happen to master over time,
so let's just switch to main prophylactically.
3. Use -b option instead of undocumented hack.
Instead of relying on an undocumented feature of having BINDIR,
let's use -b option as recommended by the official docs at [2].
4. Avoid stuttering in the output.
Before:
[kir@kir-tp1 podman]$ VERSION=2.0.2 ./hack/install_golangci.sh
golangci-lint has version 2.0.2 built with go1.24.1 from 2b224c2c on 2025-03-25T21:36:18Z
Using existing ./bin/golangci-lint has version 2.0.2 built with go1.24.1 from 2b224c2c on 2025-03-25T21:36:18Z
After:
[kir@kir-tp1 podman]$ VERSION=2.0.2 ./hack/install_golangci.sh
golangci-lint has version 2.0.2 built with go1.24.1 from 2b224c2c on 2025-03-25T21:36:18Z
Using existing ./bin/golangci-lint
5. Fix shellcheck warnings.
6. Also retry when reinstalling.
The code logic to retry install for up to 5 times when installation
fails was introduced by commit dd8574022d ("CI: retry the golangci
install").
For some reason, the above commit only uses the logic when the binary is
not found. In a situation when the binary is found but is of the wrong
version, no retries are done.
Fix that.
7. Add -f option to curl.
As recommended by the official installation docs at [2].
[1]: 16f757f699/renovate/defaults.json5 (L106-L108)
[2]: https://golangci-lint.run/welcome/install/#binaries
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This ended up slightly more complicated than anticipated, tin part
because golangci-lint v2 dropped support for --exclude-dirs, so
linter issues with GOOS=windows and GOOS=darwin which were previously
ignored had to be fixed now.
This is also the reason why the ./hack/golangci-lint was simplified.
In addition, it now runs linters on Linux without systemd tag set.
Tested locally with:
for OS in linux windows darwin; do GOOS=$OS ./hack/golangci-lint.sh; done
Linting for GOOS=linux
+ ./bin/golangci-lint run --build-tags=apparmor,seccomp,selinux
0 issues.
+ ./bin/golangci-lint run --build-tags=apparmor,seccomp,selinux,systemd
0 issues.
+ ./bin/golangci-lint run --build-tags=apparmor,seccomp,selinux,remote
0 issues.
Linting for GOOS=windows
+ ./bin/golangci-lint run --build-tags=remote,containers_image_openpgp
0 issues.
Linting for GOOS=darwin
+ ./bin/golangci-lint run --build-tags=remote,containers_image_openpgp
0 issues.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* treadmill script: handle an obscure corner case
wherein the script would bail because it thought
there were no buildah-vendor changes.
* two new test skips
* update the diffs; line-number changes due to buildah
PRs touching helpers.bash
Signed-off-by: Ed Santiago <santiago@redhat.com>
Debug for #23913, I though if we have no idea which process is nuking
the volume then we need to figure this out. As there is no reproducer
we can (ab)use the cleanup tracer. Simply trace all unlink syscalls to
see which process deletes our special named volume. Given the volume
name is used as path on the fs and is deleted on volume rm we should
know exactly which process deleted it the next time hopefully.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Equivalent to print() + system(). Shows individual commands
being run, which may help a developer understand and replicate
actions if they fail.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Initial purpose of treadmill PR was to run buildah-bud tests
early, and not run anything else if they fail. This was to
catch vendoring problems and not be distracted by flakes.
This was done by inspecting and massaging .cirrus.yml.
As of #21639 this code was a silent NOP because the entire
CI tree was overhauled. Here we make that work again.
Also, in #20947 I enhanced this script to run rootless
bud tests but neglected to updated the comments. Do so now.
Signed-off-by: Ed Santiago <santiago@redhat.com>
