summaryrefslogtreecommitdiff
path: root/.cirrus.yml
blob: 01689971aec6487c4a81e36c4ef806027fe4a497 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
---

# Only github users with write-access can define or use encrypted variables
# This credential represents a service account with access to manage both VMs
# and storage.
gcp_credentials: ENCRYPTED[885c6e4297dd8d6f67593c42b810353af0c505a7a670e2c6fd830c56e86bbb2debcc3c18f942d0d46ab36b63521061d4]

# Default timeout for each task
timeout_in: 120m

# Main collection of env. vars to set for all tasks and scripts.
env:
    ####
    #### Global variables used for all tasks
    ####
    # File to update in home-dir with task-specific env. var values
    ENVLIB: ".bash_profile"
    # Overrides default location (/tmp/cirrus) for repo clone
    CIRRUS_WORKING_DIR: "/var/tmp/go/src/github.com/containers/libpod"
    # Required so $ENVLIB gets loaded
    CIRRUS_SHELL: "/bin/bash"
    # Save a little typing (path relative to $CIRRUS_WORKING_DIR)
    SCRIPT_BASE: "./contrib/cirrus"
    PACKER_BASE: "./contrib/cirrus/packer"
    CIRRUS_CLONE_DEPTH: 200

    ####
    #### Cache-image names to test with
    ###
    ACTIVE_CACHE_IMAGE_NAMES: >-
        fedora-28-libpod-6318419153518592
        fedora-29-libpod-6318419153518592
        ubuntu-18-libpod-6318419153518592
        rhel-7-libpod-6318419153518592
        image-builder-image-1541772081
    FEDORA_CACHE_IMAGE_NAME: "fedora-29-libpod-6318419153518592"
    PRIOR_FEDORA_CACHE_IMAGE_NAME: "fedora-28-libpod-6318419153518592"
    UBUNTU_CACHE_IMAGE_NAME: "ubuntu-18-libpod-6318419153518592"
    PRIOR_RHEL_CACHE_IMAGE_NAME: "rhel-7-libpod-6318419153518592"
    # RHEL_CACHE_IMAGE_NAME: "rhel-8-notready"
    # CENTOS_CACHE_IMAGE_NAME: "centos-7-notready"

    ####
    #### Variables for composing new cache-images (used in PR testing) from
    #### base-images (pre-existing in GCE)
    ####
    # Git commits to use while building dependencies into cache-images
    FEDORA_CNI_COMMIT: "412b6d31280682bb4fab4446f113c22ff1886554"
    CNI_COMMIT: "7480240de9749f9a0a5c8614b17f1f03e0c06ab9"
    CRIO_COMMIT: "7a283c391abb7bd25086a8ff91dbb36ebdd24466"
    CRIU_COMMIT: "c74b83cd49c00589c0c0468ba5fe685b67fdbd0a"
    RUNC_COMMIT: "25f3f893c86d07426df93b7aa172f33fdf093fbd"
    # CSV of cache-image names to build (see $PACKER_BASE/libpod_images.json)
    PACKER_BUILDS: "ubuntu-18,fedora-29,fedora-28,rhel-7"  # TODO: rhel-8,centos-7
    # Version of packer to use
    PACKER_VER: "1.3.2"
    # Special image w/ nested-libvirt + tools for creating new cache and base images
    IMAGE_BUILDER_CACHE_IMAGE_NAME: "image-builder-image-1541772081"
    # Google-maintained base-image names
    UBUNTU_BASE_IMAGE: "ubuntu-1804-bionic-v20181203a"
    CENTOS_BASE_IMAGE: "centos-7-v20181113"
    # Manually produced base-image names (see $SCRIPT_BASE/README.md)
    FEDORA_BASE_IMAGE: "fedora-cloud-base-29-1-2-1541789245"
    PRIOR_FEDORA_BASE_IMAGE: "fedora-cloud-base-28-1-1-1544474897"
    FAH_BASE_IMAGE:  "fedora-atomichost-29-20181025-1-1541787861"
    # RHEL image must be imported, google bills extra for their native image.
    RHEL_BASE_IMAGE: "rhel-guest-image-7-6-210-x86-64-qcow2-1548099756"

    ####
    #### Default to NOT running in rootless-testing mode
    ####
    ROOTLESS_USER: ""
    ROOTLESS_UID: ""
    ROOTLESS_GID: ""

    ####
    #### Credentials and other secret-sauces, decrypted at runtime when authorized.
    ####
    # Freenode IRC credentials for posting status messages
    IRCID: ENCRYPTED[e87bba62a8e924dc70bdb2b66b16f6ab4a60d2870e6e5534ae9e2b0076f483c71c84091c655ca239101e6816c5ec0883]
    # Command to register a RHEL VM to install/update packages
    RHSM_COMMAND: ENCRYPTED[5caa5ff8c5370c3d25c7a1a28168501ab0fa2e5e3b627926f6eaba02b3fed965a7638a6151657809661f8c905c7dc187]
    # Needed to build GCE images, within a GCE VM
    SERVICE_ACCOUNT: ENCRYPTED[99e9a0b1c23f8dd29e83dfdf164f064cfd17afd9b895ca3b5e4c41170bd4290a8366fe2ad8e7a210b9f751711d1d002a]
    # User ID for cirrus to ssh into VMs
    GCE_SSH_USERNAME: cirrus-ci
    # Name where this repositories cloud resources are located
    GCP_PROJECT_ID: ENCRYPTED[7c80e728e046b1c76147afd156a32c1c57d4a1ac1eab93b7e68e718c61ca8564fc61fef815952b8ae0a64e7034b8fe4f]

    # Space separated list of environment variables to unset before testing
    UNSET_ENV_VARS: >-
        GCP_PROJECT_ID GCE_SSH_USERNAME SERVICE_ACCOUNT RHSM_COMMAND BUILT_IMAGE_SUFFIX
        IRCID RHEL_BASE_IMAGE FAH_BASE_IMAGE FEDORA_BASE_IMAGE CENTOS_BASE_IMAGE
        UBUNTU_BASE_IMAGE PACKER_VER PACKER_BUILDS RUNC_COMMIT CRIU_COMMIT
        CRIO_COMMIT CNI_COMMIT FEDORA_CNI_COMMIT PACKER_BASE SCRIPT_BASE
        CIRRUS_SHELL CIRRUS_WORKING_DIR ENVLIB BUILT_IMAGE_SUFFIX CIRRUS_CI
        CI_NODE_INDEX CI_NODE_TOTAL CIRRUS_BASE_BRANCH CIRRUS_BASE_SHA
        CIRRUS_BRANCH CIRRUS_BUILD_ID CIRRUS_CHANGE_IN_REPO CIRRUS_CLONE_DEPTH
        CIRRUS_COMMIT_MESSAGE CIRRUS_CHANGE_MESSAGE CIRRUS_REPO_CLONE_HOST
        CIRRUS_DEFAULT_BRANCH CIRRUS_PR CIRRUS_TAG CIRRUS_OS CIRRUS_TASK_NAME
        CIRRUS_TASK_ID CIRRUS_REPO_NAME CIRRUS_REPO_OWNER CIRRUS_REPO_FULL_NAME
        CIRRUS_REPO_CLONE_URL CIRRUS_SHELL CIRRUS_USER_COLLABORATOR CIRRUS_USER_PERMISSION
        CIRRUS_WORKING_DIR CIRRUS_HTTP_CACHE_HOST PACKER_BUILDS BUILT_IMAGE_SUFFIX
        XDG_DATA_DIRS XDG_RUNTIME_DIR XDG_SESSION_ID ROOTLESS_USER ROOTLESS_UID ROOTLESS_GID


# Every *_task runs in parallel in separate VMsd. The name prefix only for reference
# in WebUI, and will be followed by matrix details.  This task gates all others with
# quick format, lint, and unit tests on the standard platform.
gating_task:

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"

    # Runs within Cirrus's "community cluster"
    container:
        image: "quay.io/libpod/gate:latest"
        cpu: 4
        memory: 12

    gate_script:
        - '/usr/local/bin/entrypoint.sh validate'
        - '/usr/local/bin/entrypoint.sh lint'
        - '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/test/test_dot_cirrus_yaml.py'

    # This task runs `make vendor` followed by ./hack/tree_status.sh to check
    # whether the git tree is clean.  The reasoning for that is to make sure
    # that the vendor.conf, the code and the vendored packages in ./vendor are
    # in sync at all times.
    vendor_script:
        - '/usr/local/bin/entrypoint.sh .install.vndr'
        - '/usr/local/bin/entrypoint.sh vendor'
        - 'cd /go/src/github.com/containers/libpod && ./hack/tree_status.sh'

    # This task builds Podman with different buildtags to ensure the build does
    # not break.
    build_script:
        - '/usr/local/bin/entrypoint.sh clean podman'
        - '/usr/local/bin/entrypoint.sh clean podman-remote'
        - '/usr/local/bin/entrypoint.sh clean podman BUILDTAGS="exclude_graphdriver_devicemapper selinux seccomp"'
        - '/usr/local/bin/entrypoint.sh clean podman-remote-darwin'

    on_failure:
        master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


build_each_commit_task:

    depends_on:
        - "gating"

    # $CIRRUS_BASE_BRANCH is only set when testing a PR
    only_if: $CIRRUS_BRANCH != 'master'

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 2
        memory: "4Gb"
        disk: 40
        matrix:
            image_name: "${FEDORA_CACHE_IMAGE_NAME}"

    timeout_in: 30m

    script:
        - '$SCRIPT_BASE/setup_environment.sh'
        - 'git fetch --depth $CIRRUS_CLONE_DEPTH origin $CIRRUS_BASE_BRANCH'
        - 'env GOPATH=/var/tmp/go/ make build-all-new-commits GIT_BASE_BRANCH=origin/$CIRRUS_BASE_BRANCH'

    on_failure:
        master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


# Update metadata on VM images referenced by this repository state
meta_task:

    depends_on:
        - "gating"

    container:
        image: "quay.io/libpod/imgts:latest"  # see contrib/imgts
        cpu: 1
        memory: 1

    env:
        # Space-separated list of images used by this repository state
        IMGNAMES: "${ACTIVE_CACHE_IMAGE_NAMES}"
        BUILDID: "${CIRRUS_BUILD_ID}"
        REPOREF: "${CIRRUS_CHANGE_IN_REPO}"
        GCPJSON: ENCRYPTED[950d9c64ad78f7b1f0c7e499b42dc058d2b23aa67e38b315e68f557f2aba0bf83068d4734f7b1e1bdd22deabe99629df]
        GCPNAME: ENCRYPTED[b05d469a0dba8cb479cb00cc7c1f6747c91d17622fba260a986b976aa6c817d4077eacffd4613d6d5f23afc4084fab1d]
        GCPPROJECT: ENCRYPTED[7c80e728e046b1c76147afd156a32c1c57d4a1ac1eab93b7e68e718c61ca8564fc61fef815952b8ae0a64e7034b8fe4f]
        CIRRUS_CLONE_DEPTH: 1  # source not used

    script: '/usr/local/bin/entrypoint.sh'


# This task does the unit and integration testing for every platform
testing_task:

    depends_on:
        - "gating"
        - "build_each_commit"

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 2
        memory: "4Gb"
        disk: 200  # see https://developers.google.com/compute/docs/disks#performance
        # Generate multiple parallel tasks, covering all possible
        # 'matrix' combinations.
        matrix:
            # Images are generated separately, from build_images_task (below)
            image_name: "${FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${UBUNTU_CACHE_IMAGE_NAME}"

            # TODO: Make these work (also optional_testing_task below)
            # image_name: "${PRIOR_RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${CENTOS_CACHE_IMAGE_NAME}"

    timeout_in: 120m

    # Every *_script runs in sequence, for each task. The name prefix is for
    # WebUI reference.  The values may be strings...
    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh'
    unit_test_script: '$SCRIPT_BASE/unit_test.sh'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh'

    on_failure:
        master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


# This task executes tests as a regular user on a system
rootless_testing_task:

    depends_on:
        - "gating"
        - "build_each_commit"

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 2
        memory: "4Gb"
        disk: 200
        # A matrix could be used here, for now just one VM
        image_name: "${FEDORA_CACHE_IMAGE_NAME}"

    env:
        ROOTLESS_USER: "olympiclongjumpingwithjesus"
        ROOTLESS_UID: 123456
        ROOTLESS_GID: 123456

    timeout_in: 120m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh'
    rootless_test_script: >-
        ssh $ROOTLESS_USER@localhost
        -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o CheckHostIP=no
        $CIRRUS_WORKING_DIR/$SCRIPT_BASE/rootless_test.sh

    on_failure:
        master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


# Because system tests are stored within the repository, it is sometimes
# necessary to execute them within a PR to validate changes.
optional_testing_task:

    # Only run system tests in PRs (not on merge) if magic string is present
    # in the PR description.  Post-merge system testing is assumed to happen
    # later from OS distribution's build systems.
    only_if: >-
        $CIRRUS_BRANCH != 'master' &&
        $CIRRUS_CHANGE_MESSAGE =~ '.*\*\*\*\s*CIRRUS:\s*SYSTEM\s*TEST\s*\*\*\*.*'

    gce_instance:
        image_project: "libpod-218412"
        matrix:
            image_name: "${FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${UBUNTU_CACHE_IMAGE_NAME}"
            # TODO: Make these work (also testing_task above)
            # image_name: "${RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${PRIOR_RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${CENTOS_CACHE_IMAGE_NAME}"

    timeout_in: 60m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh'
    system_test_script: '$SCRIPT_BASE/system_test.sh'


# Build new cache-images for future PR testing, but only after a PR merge.
# The cache-images save install/setup time needed test every PR.  The 'active' images
# are selected by the 'image_name' items tasks above.  Currently this requires
# manually updating the names, but this could be automated (see comment below).
cache_images_task:
    # Only produce new cache-images after a PR merge, and if a magic string
    # is present in the most recent commit-message.
    only_if: >-
        $CIRRUS_BRANCH == 'master' &&
        $CIRRUS_CHANGE_MESSAGE =~ '.*\*\*\*\s*CIRRUS:\s*REBUILD\s*IMAGES\s*\*\*\*.*'

    # Require tests to pass first.
    depends_on:
        - "gating"
        - "testing"

    # VMs created by packer are not cleaned up by cirrus
    auto_cancellation: $CI != "true"

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 4
        memory: "4Gb"
        disk: 200
        image_name: "${IMAGE_BUILDER_CACHE_IMAGE_NAME}"
        # Additional permissions for building GCE images, within a GCE VM
        scopes:
            - compute
            - devstorage.full_control
    environment_script: '$SCRIPT_BASE/setup_environment.sh'
    build_vm_images_script: '$SCRIPT_BASE/build_vm_images.sh'

    # TODO,Continuous Delivery: Automatically open a libpod PR after using 'sed' to replace
    #                           the image_names with the new (just build) images.  That will
    #                           cause a new round of testing to happen (via the PR) using
    #                           the new images.  When all is good, the PR may be manually
    #                           merged so all PR testing uses the new images.  The script
    #                           names (below) describe their purpose in this workflow.
    # deploy_images_script:
    #   - clone_podman_release_branch.sh
    #   - modify_cirrus_yaml_image_names.sh
    #   - commit_and_create_upstream_pr.sh

    on_failure:
        master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


# Post message to IRC if everything passed
success_task:

    only_if: $CIRRUS_BRANCH != 'master'

    depends_on:  # ignores any dependent task conditions
        - "gating"
        - "build_each_commit_task"
        - "testing"
        - "rootless_testing_task"
        - "optional_testing"

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"

    container:
        image: "quay.io/libpod/gate:latest"
        cpu: 1
        memory: 1

    success_script: '$SCRIPT_BASE/success.sh'