From 6e841a4d0ea40270e5260f0466c55a4c9eb1e6df Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Mon, 10 Aug 2026 17:17:23 +0000 Subject: [PATCH 1/2] ci: Remove dead code, unused inputs and honor input refs - Run the PR e2e suite from the base ref (base.sha, falling back to the caller ref for non-PR runs) so a PR cannot silently weaken the tests that gate its own binary. - Delete unused typos.toml (spell-check runs cspell, not typos). - Remove useless "Get revision SHA" steps and inline github.ref_name where the branch value is still needed (build-latest). - Remove the dead "Get image digest" and "Set short SHA" steps in build-latest. - Drop unused workflow inputs (runner, runner-arch-map, unused runner-archs, dead ref) and their call-site passes - Use the declared ref input into checkout (lint, unit_test, vm_test, kind_test) - Remove unused GIT_CLONE_PAT secret and no-op workflow_dispatch triggers that cannot run standalone (vm_test, kind_test) - Drop redundant host dependency install in kind_test (used only inside the node) PR: https://github.com/urunc-dev/urunc/pull/941 Signed-off-by: Charalampos Mainas Reviewed-by: Anastassios Nanos Reviewed-by: Georgios Ntoutsos Approved-by: Anastassios Nanos --- .github/linters/typos.toml | 18 ---------- .github/linters/urunc-dict.txt | 1 + .github/workflows/build-latest.yml | 47 +------------------------ .github/workflows/build-trigger.yml | 1 - .github/workflows/build.yml | 30 ---------------- .github/workflows/ci.yml | 6 +++- .github/workflows/kind_test.yml | 19 ++-------- .github/workflows/lint.yml | 2 +- .github/workflows/pr-merge.yml | 2 -- .github/workflows/unit_test.yml | 2 +- .github/workflows/urunc-deploy-test.yml | 6 ---- .github/workflows/vm_test.yml | 31 ++++------------ 12 files changed, 17 insertions(+), 148 deletions(-) delete mode 100644 .github/linters/typos.toml diff --git a/.github/linters/typos.toml b/.github/linters/typos.toml deleted file mode 100644 index 605b9ebb5..000000000 --- a/.github/linters/typos.toml +++ /dev/null @@ -1,18 +0,0 @@ -[default] -extend-ignore-re = [ - "(?Rm)^.*(#|//)\\s*spellchecker:disable-line$", - "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on" -] - -[default.extend-words] -SEH = "SEH" -ser = "ser" -nd = "nd" - -[files] -extend-exclude = [ - "subprojects/*", - "third-party/*", - "test/catch2/*", - "test/fff/*" -] diff --git a/.github/linters/urunc-dict.txt b/.github/linters/urunc-dict.txt index 2912e2018..c38ddff05 100644 --- a/.github/linters/urunc-dict.txt +++ b/.github/linters/urunc-dict.txt @@ -471,3 +471,4 @@ Crootfs APIC makefs Nachiket +archs diff --git a/.github/workflows/build-latest.yml b/.github/workflows/build-latest.yml index 2dfa801d6..11dccb11f 100644 --- a/.github/workflows/build-latest.yml +++ b/.github/workflows/build-latest.yml @@ -3,18 +3,12 @@ name: 🍜 Build/publish urunc-deploy image on: workflow_call: inputs: - runner: - type: string - default: '["base", "dind", "2204"]' runner-archs: type: string default: '["amd64", "aarch64"]' dockerfiles: type: string default: '["Dockerfile"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64", "aarch64":"aarch64", "armv7l":"armv7l"}]' registry: type: string default: 'ghcr.io' @@ -57,9 +51,6 @@ jobs: - name: Checkout the repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Set short SHA - run: echo "SHA_SHORT=${GITHUB_SHA::7}" >> $GITHUB_ENV - - name: Set up Docker Buildx uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 @@ -78,36 +69,6 @@ jobs: tags: | type=sha,prefix=${{ env.ARCH }}- - - name: Get revision SHA and branch (safe) - id: get-rev - env: - EVENT_NAME: ${{ github.event_name }} - IS_MERGED: ${{ github.event.pull_request.merged }} - GITHUB_SHA: ${{ github.sha }} - PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} - PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} - PR_BASE_REF: ${{ github.event.pull_request.base.ref }} - REF_NAME: ${{ github.ref_name }} - run: | - if [ "$EVENT_NAME" == "pull_request" ]; then - if [ "$IS_MERGED" == "true" ]; then - sha="$GITHUB_SHA" - branch="$PR_BASE_REF" - echo "PR merged. SHA: ${sha}, Branch: ${branch}" - else - sha="$PR_HEAD_SHA" - branch="$PR_HEAD_REF" - echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}" - fi - else - sha="$GITHUB_SHA" - branch="$REF_NAME" - echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}" - fi - - echo "sha=${sha}" >> "$GITHUB_OUTPUT" - echo "branch=${branch}" >> "$GITHUB_OUTPUT" - - name: Build and push urunc-deploy-${{ matrix.arch}} id: build-and-push uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # master @@ -118,15 +79,9 @@ jobs: push: true file: ${{ inputs.dockerfiles }} build-args: | - BRANCH=${{ steps.get-rev.outputs.branch }} + BRANCH=${{ github.ref_name }} REPO=${{ github.repository }} provenance: false - - - name: Get image digest - run: | - echo "IMAGE_DIGEST=$(docker inspect \ - ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.ARCH }}-${{ env.SHA_SHORT }} | \ - jq -r '.[0].Id')" >> $GITHUB_ENV - name: Install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # main diff --git a/.github/workflows/build-trigger.yml b/.github/workflows/build-trigger.yml index f6d7d7b84..b97f4acfd 100644 --- a/.github/workflows/build-trigger.yml +++ b/.github/workflows/build-trigger.yml @@ -61,7 +61,6 @@ jobs: uses: ./.github/workflows/build-latest.yml secrets: inherit with: - runner: '["base", "dind", "2204"]' runner-archs: '["amd64", "arm64"]' dockerfiles: 'deployment/urunc-deploy/Dockerfile' version-tag: ${{ needs.get-changed-files.outputs.version == 'true' }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 63fad4b28..0fd1f6857 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -52,36 +52,6 @@ jobs: run: | go version - - name: Get revision SHA and branch (safe) - id: get-rev - env: - EVENT_NAME: ${{ github.event_name }} - IS_MERGED: ${{ github.event.pull_request.merged }} - GITHUB_SHA: ${{ github.sha }} - PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} - PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} - PR_BASE_REF: ${{ github.event.pull_request.base.ref }} - REF_NAME: ${{ github.ref_name }} - run: | - if [ "$EVENT_NAME" == "pull_request" ]; then - if [ "$IS_MERGED" == "true" ]; then - sha="$GITHUB_SHA" - branch="$PR_BASE_REF" - echo "PR merged. SHA: ${sha}, Branch: ${branch}" - else - sha="$PR_HEAD_SHA" - branch="$PR_HEAD_REF" - echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}" - fi - else - sha="$GITHUB_SHA" - branch="$REF_NAME" - echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}" - fi - - echo "sha=${sha}" >> "$GITHUB_OUTPUT" - echo "branch=${branch}" >> "$GITHUB_OUTPUT" - - name: Build urunc binaries id: build-urunc-binaries run: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fe4fe1651..72a51a4ad 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -67,7 +67,11 @@ jobs: name: E2E test uses: ./.github/workflows/vm_test.yml with: - ref: ${{ inputs.ref }} + # Run the e2e suite from the base branch, so a PR cannot silently weaken + # the tests that gate its own binary. Changes under tests/ are exercised + # with the PR's own test code by e2e-test-changes.yml. Falls back to the + # caller ref for non-PR runs (nightly/release), where base.sha is empty. + ref: ${{ github.event.pull_request.base.sha || inputs.ref }} go_version: ${{ inputs.go_version }} runner-archs: '["amd64", "arm64"]' runc_version: '1.3.0' diff --git a/.github/workflows/kind_test.yml b/.github/workflows/kind_test.yml index c77f757de..4e8d8057a 100644 --- a/.github/workflows/kind_test.yml +++ b/.github/workflows/kind_test.yml @@ -5,15 +5,6 @@ on: ref: type: string default: '' - runner: - type: string - default: '["base", "dind", "2204"]' - runner-archs: - type: string - default: '["amd64", "arm64"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]' firecracker_version: type: string required: true @@ -23,10 +14,6 @@ on: runc_version: required: true type: string - secrets: - GIT_CLONE_PAT: - required: false - workflow_dispatch: permissions: contents: read @@ -50,11 +37,9 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.ref }} - - name: Install base dependencies - run: | - sudo apt-get update - sudo apt-get install -y git wget build-essential libseccomp-dev pkg-config bc make - name: Install kind run: | ARCH=$(uname -m) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 484a308e7..439aab09b 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -33,7 +33,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ inputs.ref }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: ${{ inputs.go_version }} diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml index 2982dfb43..7717abbd2 100644 --- a/.github/workflows/pr-merge.yml +++ b/.github/workflows/pr-merge.yml @@ -51,8 +51,6 @@ jobs: GH_TOKEN: ${{ steps.generate-token.outputs.token }} PR_BRANCH: ${{ github.event.pull_request.base.ref }} run: | - PR_BRANCH=${{ github.event.pull_request.base.ref }} - # Create the pull request PR_URL=$(gh pr create \ --head "$PR_BRANCH" \ diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml index 05522255e..e517a5232 100644 --- a/.github/workflows/unit_test.yml +++ b/.github/workflows/unit_test.yml @@ -37,7 +37,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ inputs.ref }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: diff --git a/.github/workflows/urunc-deploy-test.yml b/.github/workflows/urunc-deploy-test.yml index 02d25100a..6f42ea902 100644 --- a/.github/workflows/urunc-deploy-test.yml +++ b/.github/workflows/urunc-deploy-test.yml @@ -5,12 +5,6 @@ on: ref: type: string default: "" - runner-archs: - type: string - default: '["amd64", "arm64"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64","arm64":"aarch64"}]' runc_version: required: true type: string diff --git a/.github/workflows/vm_test.yml b/.github/workflows/vm_test.yml index fb15dfbc9..64c2704bd 100644 --- a/.github/workflows/vm_test.yml +++ b/.github/workflows/vm_test.yml @@ -8,15 +8,9 @@ on: go_version: required: true type: string - runner: - type: string - default: '["base", "dind", "2204"]' runner-archs: type: string default: '["amd64"]' - runner-arch-map: - type: string - default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]' runc_version: required: true type: string @@ -44,11 +38,6 @@ on: hyperlight_unikraft_version: required: true type: string - secrets: - GIT_CLONE_PAT: - required: false - - workflow_dispatch: permissions: contents: read @@ -82,18 +71,9 @@ jobs: SOLO5_VERSION: ${{ inputs.solo5_version }} HYPERLIGHT_UNIKRAFT_VERSION: ${{ inputs.hyperlight_unikraft_version }} run: | - SAFE_GO_VERSION="$GO_VERSION" - SAFE_RUNC_VERSION="$RUNC_VERSION" - SAFE_CONTAINERD_VERSION="$CONTAINERD_VERSION" - SAFE_CNI_VERSION="$CNI_VERSION" - SAFE_NERDCTL_VERSION="$NERDCTL_VERSION" - SAFE_CRICTL_VERSION="$CRICTL_VERSION" - SAFE_FIRECRACKER_VERSION="$FIRECRACKER_VERSION" - SAFE_CLOUD_HYPERVISOR_VERSION="$CLOUD_HYPERVISOR_VERSION" - SAFE_SOLO5_VERSION="$SOLO5_VERSION" - SAFE_HYPERLIGHT_UNIKRAFT_VERSION="$HYPERLIGHT_UNIKRAFT_VERSION" - - for var in SAFE_GO_VERSION SAFE_RUNC_VERSION SAFE_CONTAINERD_VERSION SAFE_CNI_VERSION SAFE_NERDCTL_VERSION SAFE_CRICTL_VERSION SAFE_FIRECRACKER_VERSION SAFE_CLOUD_HYPERVISOR_VERSION SAFE_SOLO5_VERSION SAFE_HYPERLIGHT_UNIKRAFT_VERSION; do + for var in GO_VERSION RUNC_VERSION CONTAINERD_VERSION CNI_VERSION \ + NERDCTL_VERSION CRICTL_VERSION FIRECRACKER_VERSION \ + CLOUD_HYPERVISOR_VERSION SOLO5_VERSION HYPERLIGHT_UNIKRAFT_VERSION; do value="${!var}" if ! [[ "$value" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then echo "Invalid format for $var: $value" @@ -108,6 +88,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.ref }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: @@ -362,14 +344,13 @@ jobs: EOF sudo chmod +x /usr/local/bin/containerd-shim-urunc-fc-v2 - - name: Add runner user to KVM group + - name: Grant access to /dev/kvm if: ${{ matrix.arch == 'amd64' }} id: kvm-setup run: | echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules sudo udevadm control --reload-rules sudo udevadm trigger --name-match=kvm - sudo usermod -a -G kvm $USER - name: Prepare urunc folder id: prepare From 961ad3fa3cb22a41f08d8e5536da978fe8afcd34 Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Tue, 18 Aug 2026 19:55:47 +0000 Subject: [PATCH 2/2] ci: Invoke the vm_tests with different base for changes in tests/ The previous commit switched the main e2e run to the PR's base ref, so the PR's binary is validated against the base branch's test code. However, we also need to test the changes that take place in the e2e tests. For that reason, another run of vm_tests is triggered using the PR's branch ref to check if the new code of end-to-end tests is working properly. THe new job will execute only if the PR has changed a file that affects the e2e tests (`test/*`, `Makefile`, `scripts/dm_create.sh`). PR: https://github.com/urunc-dev/urunc/pull/941 Signed-off-by: Charalampos Mainas Reviewed-by: Anastassios Nanos Reviewed-by: Georgios Ntoutsos Approved-by: Anastassios Nanos --- .github/workflows/ci.yml | 55 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 72a51a4ad..5fcc549bd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -69,7 +69,7 @@ jobs: with: # Run the e2e suite from the base branch, so a PR cannot silently weaken # the tests that gate its own binary. Changes under tests/ are exercised - # with the PR's own test code by e2e-test-changes.yml. Falls back to the + # with the PR's own test code by the "vm_test_head" step. Falls back to the # caller ref for non-PR runs (nightly/release), where base.sha is empty. ref: ${{ github.event.pull_request.base.sha || inputs.ref }} go_version: ${{ inputs.go_version }} @@ -96,3 +96,56 @@ jobs: solo5_version: 'v0.9.3' runc_version: '1.3.0' secrets: inherit + + # The vm_test job above runs the base branch's e2e code. In order to also + # test changes in the e2e testing code, re-run the vm_test with the changed + # e2e test code. However, do that only when a change in the files that affect + # the e2e tests ("tests/*", "Makefile", "scripts/dm_create.sh") has taken place. + detect-test-changes: + if: ${{ github.event_name == 'pull_request' && inputs.skip-build != 'yes' }} + name: Detect test changes + runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read + outputs: + tests_changed: ${{ steps.check.outputs.tests_changed }} + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + egress-policy: audit + + - name: Check whether the PR touches files that affect e2e tests + id: check + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const files = await github.paginate(github.rest.pulls.listFiles, { + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: context.payload.pull_request.number, + }); + const roots = ['tests/', 'Makefile', 'script/dm_create.sh']; + const changed = files.some(f => roots.some(r => f.filename.startsWith(r))); + core.setOutput('tests_changed', changed ? 'yes' : 'no'); + + vm_test_head: + if: ${{ inputs.skip-build != 'yes' && needs.detect-test-changes.outputs.tests_changed == 'yes' }} + needs: [build, unit_test, detect-test-changes] + name: E2E test (PR test code) + uses: ./.github/workflows/vm_test.yml + with: + ref: ${{ inputs.ref }} + go_version: ${{ inputs.go_version }} + runner-archs: '["amd64", "arm64"]' + runc_version: '1.3.0' + containerd_version: '2.1.3' + cni_version: '1.7.1' + nerdctl_version: '2.1.3' + crictl_version: 'v1.30.0' + firecracker_version: 'v1.7.0' + cloud_hypervisor_version: 'v50.0' + solo5_version: 'v0.9.3' + hyperlight_unikraft_version: 'v0.12.1' + secrets: inherit