path: root/.cirrus.yml

---

# Only github users with write-access can define or use encrypted variables
# Ref: https://cirrus-ci.org/guide/writing-tasks/#encrypted-variables
# more specifically: https://cirrus-ci.com/settings/repository/6707778565701632
gcp_credentials: ENCRYPTED[a28959877b2c9c36f151781b0a05407218cda646c7d047fc556e42f55e097e897ab63ee78369dae141dcf0b46a9d0cdd]

# Default timeout for each task
timeout_in: 120m

# Main collection of env. vars to set for all tasks and scripts.
env:
    ####
    #### Global variables used for all tasks
    ####
    # Name of the ultimate destination branch for this CI run, PR or post-merge.
    DEST_BRANCH: "master"
    # Overrides default location (/tmp/cirrus) for repo clone
    GOPATH: "/var/tmp/go"
    GOBIN: "${GOPATH}/bin"
    GOSRC: "/var/tmp/go/src/github.com/containers/podman"
    CIRRUS_WORKING_DIR: "/var/tmp/go/src/github.com/containers/podman"
    # The default is 'sh' if unspecified
    CIRRUS_SHELL: "/bin/bash"
    # Save a little typing (path relative to $CIRRUS_WORKING_DIR)
    SCRIPT_BASE: "./contrib/cirrus"
    # Command to prefix output lines with timing information
    # (can't do inline awk script, Cirrus-CI or YAML mangles quoting)
    TIMESTAMP: "awk --file ${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/timestamp.awk"

    # HTMLify ginkgo and bats logs
    LOGFORMAT: "${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/logformatter"

    ####
    #### Cache-image names to test with (double-quotes around names are critical)
    ###
    FEDORA_NAME: "fedora-32"
    PRIOR_FEDORA_NAME: "fedora-31"
    UBUNTU_NAME: "ubuntu-20"
    PRIOR_UBUNTU_NAME: "ubuntu-19"

    _BUILT_IMAGE_SUFFIX: "c4948709391728640"
    FEDORA_CACHE_IMAGE_NAME: "fedora-${_BUILT_IMAGE_SUFFIX}"
    PRIOR_FEDORA_CACHE_IMAGE_NAME: "prior-fedora-${_BUILT_IMAGE_SUFFIX}"
    UBUNTU_CACHE_IMAGE_NAME: "ubuntu-${_BUILT_IMAGE_SUFFIX}"
    PRIOR_UBUNTU_CACHE_IMAGE_NAME: "prior-ubuntu-${_BUILT_IMAGE_SUFFIX}"

    ####
    #### Default to NOT operating in any special-case testing mode
    ####
    SPECIALMODE: "none"  # don't do anything special
    RCLI: 'false'  # don't test remote client by default
    ADD_SECOND_PARTITION: 'false'  # will certainly fail inside containers
    MOD_CONTAINERS_CONF: 'true'  # Update containers.conf runtime if required by OS environment

    ####
    #### Credentials and other secret-sauces, decrypted at runtime when authorized.
    ####
    # Name where this repositories VM images are stored
    GCP_PROJECT_ID: libpod-218412
    # Service-account client_email - needed to build images
    SERVICE_ACCOUNT: ENCRYPTED[702a8e07e27a6faf7988fcddcc068c2ef2bb182a5aa671f5ccb7fbbfb891c823aa4a7856fb17240766845dbd68bd3f90]
    # Service account username part of client_email - for ssh'ing into VMs
    GCE_SSH_USERNAME: 'cirrus-ci'

# Default VM to use unless set or modified by task
gce_instance:
    image_project: $GCP_PROJECT_ID
    zone: "us-central1-a"  # Required by Cirrus for the time being
    cpu: 2
    memory: "4Gb"
    disk: 200
    # A matrix could be used here, for now just one VM
    image_name: "${FEDORA_CACHE_IMAGE_NAME}"


# Every *_task runs in parallel in separate VMsd. The name prefix only for reference
# in WebUI, and will be followed by matrix details.  This task gates all others with
# quick format, lint, and unit tests on the standard platform.
gating_task:

    # Only run this on PRs, never during post-merge testing (for speed).
    only_if: $CIRRUS_BRANCH != $DEST_BRANCH

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"
        SRCPATH: "$CIRRUS_WORKING_DIR"

    # Runs within Cirrus's "community cluster"
    container:
        # Note: Image has dual purpose, see contrib/gate/README.md
        # The entrypoint.sh script ensures a prestine copy of $SRCPATH is
        # available at $GOSRC before executing make instructions.
        image: "quay.io/libpod/gate:master"
        cpu: 8
        memory: 12

    timeout_in: 20m

    # Custom cloning is required to satisfy lint/validation needs
    clone_script: |
        git clone --recursive --branch=$DEST_BRANCH https://x-access-token:${CIRRUS_REPO_CLONE_TOKEN}@github.com/${CIRRUS_REPO_FULL_NAME}.git $CIRRUS_WORKING_DIR
        git remote update origin
        if [[ -n "$CIRRUS_PR" ]]; then # running for a PR
            git fetch origin pull/$CIRRUS_PR/head:pull/$CIRRUS_PR
            git checkout pull/$CIRRUS_PR
        fi
        git reset --hard $CIRRUS_CHANGE_IN_REPO

    # Don't bother going further if something is down
    networking_script: '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/networking.sh'

    gate_script:
        # N/B: entrypoint.sh resets $GOSRC (same as make clean)
        - '/usr/local/bin/entrypoint.sh install.tools |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh validate |& ${TIMESTAMP}'

    # This task builds Podman with different buildtags to ensure the build does
    # not break.  It also verifies all sub-commands have man pages.
    build_script:
        - '/usr/local/bin/entrypoint.sh podman |& ${TIMESTAMP}'
        - 'cd $GOSRC && ./hack/podman-commands.sh |& ${TIMESTAMP}'
        # N/B: need 'clean' so some committed files are re-generated.
        - '/usr/local/bin/entrypoint.sh clean podman-remote |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh clean podman xref_helpmsgs_manpages BUILDTAGS="exclude_graphdriver_devicemapper selinux seccomp" |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh clean BUILDTAGS="varlink" binaries |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh local-cross |& ${TIMESTAMP}'

    # Verify some aspects of ci/related scripts
    ci_script:
        - '${GOSRC}/${SCRIPT_BASE}/lib.sh.t |& ${TIMESTAMP}'
        - '${GOSRC}/${SCRIPT_BASE}/cirrus_yaml_test.py |& ${TIMESTAMP}'

    # Verify expected bash environment (-o pipefail)
    pipefail_enabledscript: 'if /bin/false | /bin/true; then echo "pipefail fault" && exit 72; fi'


# Ensure these container images can build
container_image_build_task:
    alias: 'container_image_build'
    name: "build gate image $DEST_BRANCH branch"
    depends_on:
        - "gating"

    # Only run for PRs, quay.io will automatically build after branch-push
    only_if: $CIRRUS_BRANCH != $DEST_BRANCH

    container:
        dockerfile: contrib/gate/Dockerfile

    script: make install.remote


# This task checks to make sure that we can still build an rpm from the
# source code using contrib/rpm/podman.spec.in
rpmbuild_task:

    only_if: >-
        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*' &&
        $CIRRUS_BRANCH != $DEST_BRANCH

    depends_on:
        - "gating"
    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"

    container:
        image: quay.io/libpod/rpmbuild:$DEST_BRANCH
        cpu: 2
        memory: 4

    rpmbuild_script:
        - 'make -C ${CIRRUS_WORKING_DIR} -f ${CIRRUS_WORKING_DIR}/.copr/Makefile'
        - 'rpmbuild --rebuild ${CIRRUS_WORKING_DIR}/podman-*.src.rpm'

# This task runs `make vendor` followed by ./hack/tree_status.sh to check
# whether the git tree is clean.  The reasoning for that is to make sure
# that the vendor.conf, the code and the vendored packages in ./vendor are
# in sync at all times.
vendor_task:

    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    depends_on:
        - "gating"

    env:
        CIRRUS_WORKING_DIR: "/var/tmp/go/src/github.com/containers/podman"
        GOPATH: "/var/tmp/go"
        GOSRC: "$CIRRUS_WORKING_DIR"

    # Runs within Cirrus's "community cluster"
    container:
        image: docker.io/library/golang:1.13
        cpu: 4
        memory: 12

    timeout_in: 30m

    vendor_script:
        - 'cd ${CIRRUS_WORKING_DIR} && make vendor'
        - 'cd ${CIRRUS_WORKING_DIR} && ./hack/tree_status.sh'


# This task runs `make varlink_api_generate` followed by ./hack/tree_status.sh to check
# whether the git tree is clean.
varlink_api_task:

    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    depends_on:
        - "gating"

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"
        SRCPATH: "$CIRRUS_WORKING_DIR"
        EPOCH_TEST_COMMIT: "${CIRRUS_BASE_SHA}"  # repo clone missing this data
        # Used by tree_status.sh
        SUGGESTION: 'remove API.md, then "make varlink_api_generate" and commit changes.'

    # Runs within Cirrus's "community cluster"
    container:
        # Note: Image has dual purpose, see contrib/gate/README.md
        image: "quay.io/libpod/gate:master"
        cpu: 4
        memory: 12

    timeout_in: 10m

    api_md_script:
        - '/usr/local/bin/entrypoint.sh BUILDTAGS="varlink" varlink_api_generate |& ${TIMESTAMP}'
        - 'cd ${GOSRC} && ./hack/tree_status.sh |& ${TIMESTAMP}'


build_each_commit_task:

    depends_on:
        - "gating"
        - "vendor"
        - "varlink_api"

    only_if: >-
        $CIRRUS_BRANCH != $DEST_BRANCH &&
        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    gce_instance:
        cpu: 8
        memory: "8Gb"

    env:
        MOD_CONTAINERS_CONF: 'false'

    timeout_in: 30m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    build_each_commit_script:
        # set -x by default, no need to spew contents of lib.sh
        - 'source $SCRIPT_BASE/lib.sh &> /dev/null'
        - 'git fetch --depth 50 origin $DEST_BRANCH |& ${TIMESTAMP}'
        - 'make build-all-new-commits GIT_BASE_BRANCH=origin/$DEST_BRANCH |& ${TIMESTAMP}'


build_without_cgo_task:

    depends_on:
        - "gating"
        - "vendor"
        - "varlink_api"

    only_if: >-
        $CIRRUS_BRANCH != $DEST_BRANCH &&
        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    gce_instance:
        cpu: 8
        memory: "8Gb"

    env:
        MOD_CONTAINERS_CONF: 'false'

    timeout_in: 30m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    build_without_cgo_script:
        - 'source $SCRIPT_BASE/lib.sh'
        - 'make build-no-cgo'


# Update metadata on VM images referenced by this repository state
meta_task:

    container:
        image: "quay.io/libpod/imgts:${_BUILT_IMAGE_SUFFIX}"
        cpu: 1
        memory: 1

    env: &meta_env_vars
        # Space-separated list of images used by this repository state
        IMGNAMES: >-
            ${FEDORA_CACHE_IMAGE_NAME}
            ${PRIOR_FEDORA_CACHE_IMAGE_NAME}
            ${UBUNTU_CACHE_IMAGE_NAME}
            ${PRIOR_UBUNTU_CACHE_IMAGE_NAME}
        BUILDID: "${CIRRUS_BUILD_ID}"
        REPOREF: "${CIRRUS_CHANGE_IN_REPO}"
        GCPJSON: ENCRYPTED[3a198350077849c8df14b723c0f4c9fece9ebe6408d35982e7adf2105a33f8e0e166ed3ed614875a0887e1af2b8775f4]
        # needed for output-masking purposes
        GCPNAME: ENCRYPTED[2f9738ef295a706f66a13891b40e8eaa92a89e0e87faf8bed66c41eca72bf76cfd190a6f2d0e8444c631fdf15ed32ef6]
        GCPPROJECT: $GCP_PROJECT_ID

    timeout_in: 10m

    # Cirrus-CI ignores entrypoint defined in image
    script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/update_meta.sh |& ${TIMESTAMP}'


# This task does the unit and integration testing for every platform
testing_task:

    alias: "testing"
    depends_on:
        - "gating"
        - "vendor"
        - "varlink_api"
        - "build_each_commit"
        - "build_without_cgo"
        - "container_image_build"

    # Only test build cache-images, if that's what's requested
    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    matrix:
        - name: "test ${FEDORA_NAME}"
          gce_instance:
              image_name: "${FEDORA_CACHE_IMAGE_NAME}"
        - name: "test ${PRIOR_FEDORA_NAME}"
          gce_instance:
              image_name: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
        - name: "test ${UBUNTU_NAME}"
          gce_instance:
              image_name: "${UBUNTU_CACHE_IMAGE_NAME}"
        - name: "test ${PRIOR_UBUNTU_NAME}"
          gce_instance:
              image_name: "${PRIOR_UBUNTU_CACHE_IMAGE_NAME}"

    env:
        ADD_SECOND_PARTITION: 'true'
        matrix:
          - RCLI: 'true'
          - RCLI: 'false'

    networking_script: '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/networking.sh'
    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    unit_test_script: '$SCRIPT_BASE/unit_test.sh |& ${TIMESTAMP}'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} integration_test'
    system_test_script: '$SCRIPT_BASE/system_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} system_test'
    apiv2_test_script: '$SCRIPT_BASE/apiv2_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} apiv2_test'

    # When examining a particular run, provide convenient access to release files.
    tar_artifacts:
        path: "*.tar.gz"
        type: "application/x-tar"

    always: &standardlogs
        package_versions_script: '$SCRIPT_BASE/logcollector.sh packages'
        ginkgo_node_logs_script: '$SCRIPT_BASE/logcollector.sh ginkgo'
        df_script: '$SCRIPT_BASE/logcollector.sh df'
        audit_log_script: '$SCRIPT_BASE/logcollector.sh audit'
        journal_script: '$SCRIPT_BASE/logcollector.sh journal'
        varlink_script: '$SCRIPT_BASE/logcollector.sh varlink'
        podman_system_info_script: '$SCRIPT_BASE/logcollector.sh podman'
        html_artifacts:
            path: "*.log.html"
            type: "text/html"

# This task executes tests under unique environments/conditions
special_testing_rootless_task:

    depends_on:
        - "gating"
        - "varlink_api"
        - "vendor"
        - "build_each_commit"
        - "build_without_cgo"

    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    env:
        ADD_SECOND_PARTITION: 'true'
        SPECIALMODE: 'rootless'  # See docs
        matrix:
          - RCLI: 'true'
          - RCLI: 'false'

    networking_script: '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/networking.sh'
    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} integration_test'
    system_test_script: '$SCRIPT_BASE/system_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} system_test'
    apiv2_test_script: '$SCRIPT_BASE/apiv2_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} apiv2_test'

    always:
        <<: *standardlogs


special_testing_in_podman_task:

    alias: "special_testing_in_podman"
    depends_on:
        - "gating"
        - "varlink_api"
        - "vendor"
        - "build_each_commit"
        - "build_without_cgo"

    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    matrix:
        - name: "in-podman ${PRIOR_FEDORA_NAME}"
          gce_instance:
              image_name: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
        - name: "in-podman ${FEDORA_NAME}"
          gce_instance:
              image_name: "${FEDORA_CACHE_IMAGE_NAME}"

    env:
        ADD_SECOND_PARTITION: 'true'
        MOD_CONTAINERS_CONF: 'false'  # Use existing/native setup
        SPECIALMODE: 'in_podman'  # See docs

    networking_script: '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/networking.sh'
    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} integration_test'

    always:
        <<: *standardlogs


special_testing_cross_task:

    alias: "special_testing_cross"
    depends_on:
        - "gating"
        - "varlink_api"
        - "vendor"

    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    matrix:
        - name: 'cross-platform: windows'
          env:
              CROSS_PLATFORM: 'windows'
        - name: 'cross-platform: darwin'
          env:
              CROSS_PLATFORM: 'darwin'

    timeout_in: 20m

    networking_script: '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/networking.sh'
    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    build_release_script: '$SCRIPT_BASE/build_release.sh |& ${TIMESTAMP}'

    # When examining a particular run, provide convenient access to release files.
    zip_artifacts:
        path: "*.zip"
        type: "application/zip"

    msi_artifacts:
        path: "*.msi"
        type: "application/octet-stream"


special_testing_bindings_task:

    depends_on:
        - "gating"
        - "varlink_api"
        - "vendor"

    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    env:
        SPECIALMODE: 'bindings'  # See docs
        ADD_SECOND_PARTITION: 'true'  # More root fs space is required

    timeout_in: 40m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} integration_test'

    always:
        <<: *standardlogs


special_testing_endpoint_task:

    depends_on:
        - "gating"
        - "varlink_api"
        - "vendor"

    only_if: $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'

    env:
        SPECIALMODE: 'endpoint'  # See docs

    timeout_in: 20m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP} | ${LOGFORMAT} integration_test'
    always:
        <<: *standardlogs


docs_task:

    depends_on:
        - "gating"
    env:
        RELEASE_GCPJSON: ENCRYPTED[927dc01e755eaddb4242b0845cf86c9098d1e3dffac38c70aefb1487fd8b4fe6dd6ae627b3bffafaba70e2c63172664e]
        RELEASE_GCPNAME: ENCRYPTED[c145e9c16b6fb88d476944a454bf4c1ccc84bb4ecaca73bdd28bdacef0dfa7959ebc8171a27b2e4064d66093b2cdba49]
        RELEASE_GCPROJECT: $GCP_PROJECT_ID

    script:
        - "$SCRIPT_BASE/build_swagger.sh |& ${TIMESTAMP}"
        - "$SCRIPT_BASE/upload_release_archive.sh |& ${TIMESTAMP}"


# Post message to IRC if everything passed PR testing
success_task:

    # This task is a required-pass in github settings,
    # it blocks PRs from merging if a depends_on task fails
    only_if: $CIRRUS_BRANCH != $DEST_BRANCH

    # ignores any dependent task conditions
    depends_on:
        - "gating"
        - "vendor"
        - "varlink_api"
        - "build_each_commit"
        - "build_without_cgo"
        - "container_image_build"
        - "meta"
        - "testing"
        - "rpmbuild"
        - "special_testing_rootless"
        - "special_testing_in_podman"
        - "special_testing_cross"
        - "special_testing_endpoint"
        - "special_testing_bindings"
        - "docs"
        - "static_build"
        - "darwin_build"

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"
        SRCPATH: "$CIRRUS_WORKING_DIR"
        EPOCH_TEST_COMMIT: "${CIRRUS_BASE_SHA}"  # repo clone missing this data

    container:
        # Note: Image has dual purpose, see contrib/gate/README.md
        image: "quay.io/libpod/gate:master"
        cpu: 1
        memory: 1

    success_script: /bin/true

# Build the static binary
static_build_task:
    depends_on:
        - "gating"

    gce_instance:
        image_name: "${FEDORA_CACHE_IMAGE_NAME}"
        cpu: 8
        memory: 12
        disk: 200

    init_script: |
        set -ex
        setenforce 0
        growpart /dev/sda 1 || true
        resize2fs /dev/sda1 || true
        yum -y install podman

    nix_cache:
      folder: '.cache'
      fingerprint_script: |
        echo "nix-v1-$(sha1sum nix/nixpkgs.json | head -c 40)"

    build_script: |
        set -ex
        mkdir -p .cache
        mv .cache /nix
        if [[ -z $(ls -A /nix) ]]; then podman run --rm --privileged -ti -v /:/mnt nixos/nix cp -rfT /nix /mnt/nix; fi
        podman run --rm --privileged -ti -v /nix:/nix -v ${PWD}:${PWD} -w ${PWD} nixos/nix nix --print-build-logs --option cores 8 --option max-jobs 8 build --file nix/

    binaries_artifacts:
        path: "result/bin/podman"

    save_cache_script: |
        mv /nix .cache
        chown -Rf $(whoami) .cache


darwin_build_task:
    depends_on:
        - "gating"
    osx_instance:
        image: catalina-base
    setup-script:
        - brew install go
        - brew install go-md2man
    build-script:
        - make podman-remote-darwin
        - make install-podman-remote-darwin-docs
    binaries_artifacts:
        path: "bin/podman-remote-darwin"