path: root/.cirrus.yml

---

# Only github users with write-access can define or use encrypted variables
# This credential represents a service account with access to manage both VMs
# and storage.
gcp_credentials: ENCRYPTED[885c6e4297dd8d6f67593c42b810353af0c505a7a670e2c6fd830c56e86bbb2debcc3c18f942d0d46ab36b63521061d4]

# Default timeout for each task
timeout_in: 120m

# Main collection of env. vars to set for all tasks and scripts.
env:
    ####
    #### Global variables used for all tasks
    ####
    # File to update in home-dir with task-specific env. var values
    ENVLIB: ".bash_profile"
    # Overrides default location (/tmp/cirrus) for repo clone
    CIRRUS_WORKING_DIR: "/var/tmp/go/src/github.com/containers/libpod"
    # Required so $ENVLIB gets loaded
    CIRRUS_SHELL: "/bin/bash"
    # Save a little typing (path relative to $CIRRUS_WORKING_DIR)
    SCRIPT_BASE: "./contrib/cirrus"
    PACKER_BASE: "./contrib/cirrus/packer"
    CIRRUS_CLONE_DEPTH: 200
    # Command to prefix every output line with a timestamp
    # (can't do inline awk script, Cirrus-CI or YAML mangles quoting)
    TIMESTAMP: "awk --file ${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/timestamp.awk"

    ####
    #### Cache-image names to test with
    ###
    ACTIVE_CACHE_IMAGE_NAMES: >-
        fedora-29-libpod-548c1c05
        fedora-28-libpod-548c1c05
        ubuntu-18-libpod-548c1c05
        rhel-7-libpod-548c1c05
        image-builder-image-1541772081
    FEDORA_CACHE_IMAGE_NAME: "fedora-29-libpod-548c1c05"
    PRIOR_FEDORA_CACHE_IMAGE_NAME: "fedora-28-libpod-548c1c05"
    UBUNTU_CACHE_IMAGE_NAME: "ubuntu-18-libpod-548c1c05"
    PRIOR_RHEL_CACHE_IMAGE_NAME: "rhel-7-libpod-548c1c05"
    # RHEL_CACHE_IMAGE_NAME: "rhel-8-notready"
    # CENTOS_CACHE_IMAGE_NAME: "centos-7-notready"

    ####
    #### Variables for composing new cache-images (used in PR testing) from
    #### base-images (pre-existing in GCE)
    ####
    # Git commits to use while building dependencies into cache-images
    FEDORA_CNI_COMMIT: "412b6d31280682bb4fab4446f113c22ff1886554"
    CNI_COMMIT: "7480240de9749f9a0a5c8614b17f1f03e0c06ab9"
    CRIO_COMMIT: "7a283c391abb7bd25086a8ff91dbb36ebdd24466"
    CRIU_COMMIT: "c74b83cd49c00589c0c0468ba5fe685b67fdbd0a"
    RUNC_COMMIT: "029124da7af7360afa781a0234d1b083550f797c"
    # CSV of cache-image names to build (see $PACKER_BASE/libpod_images.json)
    PACKER_BUILDS: "ubuntu-18,fedora-29,fedora-28,rhel-7"  # TODO: rhel-8,centos-7
    # Version of packer to use
    PACKER_VER: "1.3.2"
    # Special image w/ nested-libvirt + tools for creating new cache and base images
    IMAGE_BUILDER_CACHE_IMAGE_NAME: "image-builder-image-1541772081"
    # Google-maintained base-image names
    UBUNTU_BASE_IMAGE: "ubuntu-1804-bionic-v20181203a"
    CENTOS_BASE_IMAGE: "centos-7-v20181113"
    # Manually produced base-image names (see $SCRIPT_BASE/README.md)
    FEDORA_BASE_IMAGE: "fedora-cloud-base-29-1-2-1541789245"
    PRIOR_FEDORA_BASE_IMAGE: "fedora-cloud-base-28-1-1-1544474897"
    FAH_BASE_IMAGE:  "fedora-atomichost-29-20181025-1-1541787861"
    # RHEL image must be imported, google bills extra for their native image.
    RHEL_BASE_IMAGE: "rhel-guest-image-7-6-210-x86-64-qcow2-1548099756"

    ####
    #### Default to NOT operating in any special-case testing mode
    ####
    SPECIALMODE: "none"  # don't do anything special

    ####
    #### Credentials and other secret-sauces, decrypted at runtime when authorized.
    ####
    # Freenode IRC credentials for posting status messages
    IRCID: ENCRYPTED[e87bba62a8e924dc70bdb2b66b16f6ab4a60d2870e6e5534ae9e2b0076f483c71c84091c655ca239101e6816c5ec0883]
    # Command to register a RHEL VM to install/update packages
    RHSM_COMMAND: ENCRYPTED[5caa5ff8c5370c3d25c7a1a28168501ab0fa2e5e3b627926f6eaba02b3fed965a7638a6151657809661f8c905c7dc187]
    # Needed to build GCE images, within a GCE VM
    SERVICE_ACCOUNT: ENCRYPTED[99e9a0b1c23f8dd29e83dfdf164f064cfd17afd9b895ca3b5e4c41170bd4290a8366fe2ad8e7a210b9f751711d1d002a]
    # User ID for cirrus to ssh into VMs
    GCE_SSH_USERNAME: cirrus-ci
    # Name where this repositories cloud resources are located
    GCP_PROJECT_ID: ENCRYPTED[7c80e728e046b1c76147afd156a32c1c57d4a1ac1eab93b7e68e718c61ca8564fc61fef815952b8ae0a64e7034b8fe4f]

    # Space separated list of environment variables to unset before testing
    UNSET_ENV_VARS: >-
        GCP_PROJECT_ID GCE_SSH_USERNAME SERVICE_ACCOUNT RHSM_COMMAND BUILT_IMAGE_SUFFIX
        IRCID RHEL_BASE_IMAGE FAH_BASE_IMAGE FEDORA_BASE_IMAGE CENTOS_BASE_IMAGE
        UBUNTU_BASE_IMAGE PACKER_VER PACKER_BUILDS RUNC_COMMIT CRIU_COMMIT
        CRIO_COMMIT CNI_COMMIT FEDORA_CNI_COMMIT PACKER_BASE SCRIPT_BASE
        CIRRUS_SHELL CIRRUS_WORKING_DIR ENVLIB BUILT_IMAGE_SUFFIX CIRRUS_CI
        CI_NODE_INDEX CI_NODE_TOTAL CIRRUS_BASE_BRANCH CIRRUS_BASE_SHA
        CIRRUS_BRANCH CIRRUS_BUILD_ID CIRRUS_CHANGE_IN_REPO CIRRUS_CLONE_DEPTH
        CIRRUS_COMMIT_MESSAGE CIRRUS_CHANGE_MESSAGE CIRRUS_REPO_CLONE_HOST
        CIRRUS_DEFAULT_BRANCH CIRRUS_PR CIRRUS_TAG CIRRUS_OS CIRRUS_TASK_NAME
        CIRRUS_TASK_ID CIRRUS_REPO_NAME CIRRUS_REPO_OWNER CIRRUS_REPO_FULL_NAME
        CIRRUS_REPO_CLONE_URL CIRRUS_SHELL CIRRUS_USER_COLLABORATOR CIRRUS_USER_PERMISSION
        CIRRUS_WORKING_DIR CIRRUS_HTTP_CACHE_HOST PACKER_BUILDS BUILT_IMAGE_SUFFIX
        XDG_DATA_DIRS XDG_RUNTIME_DIR XDG_SESSION_ID ROOTLESS_USER


# Every *_task runs in parallel in separate VMsd. The name prefix only for reference
# in WebUI, and will be followed by matrix details.  This task gates all others with
# quick format, lint, and unit tests on the standard platform.
gating_task:

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"
        GOSRC: "/go/src/github.com/containers/libpod"

    # Runs within Cirrus's "community cluster"
    container:
        image: "quay.io/libpod/gate:latest"
        cpu: 4
        memory: 12

    timeout_in: 20m

    gate_script:
        # N/B: entrypoint.sh resets $GOSRC (same as make clean)
        - '/usr/local/bin/entrypoint.sh install.tools |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh validate |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh lint |& ${TIMESTAMP}'
        - '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/test/test_dot_cirrus_yaml.py |& ${TIMESTAMP}'

    # This task builds Podman with different buildtags to ensure the build does
    # not break.  It also verifies all sub-commands have man pages.
    build_script:
        - '/usr/local/bin/entrypoint.sh podman |& ${TIMESTAMP}'
        - 'cd $GOSRC && ./hack/podman-commands.sh |& ${TIMESTAMP}'
        # N/B: need 'clean' so some commited files are re-generated.
        - '/usr/local/bin/entrypoint.sh clean podman-remote |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh clean podman BUILDTAGS="exclude_graphdriver_devicemapper selinux seccomp" |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh podman-remote-darwin |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh podman-remote-windows |& ${TIMESTAMP}'

    # Verify expected bash environment (-o pipefail)
    pipefail_enabledscript: 'if /bin/false | /bin/true; then echo "pipefail fault" && exit 72; fi'

    on_failure:
        failed_master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


# This task runs `make vendor` followed by ./hack/tree_status.sh to check
# whether the git tree is clean.  The reasoning for that is to make sure
# that the vendor.conf, the code and the vendored packages in ./vendor are
# in sync at all times.
vendor_task:

    depends_on:
        - "gating"

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"

    # Runs within Cirrus's "community cluster"
    container:
        image: "quay.io/libpod/gate:latest"
        cpu: 4
        memory: 12

    timeout_in: 30m

    vendor_script:
        - '/usr/local/bin/entrypoint.sh .install.vndr |& ${TIMESTAMP}'
        - '/usr/local/bin/entrypoint.sh vendor |& ${TIMESTAMP}'
        - 'cd /go/src/github.com/containers/libpod && ./hack/tree_status.sh |& ${TIMESTAMP}'

    on_failure:
        failed_master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh |& ${TIMESTAMP}'


# This task runs `make varlink_api_generate` followed by ./hack/tree_status.sh to check
# whether the git tree is clean.
varlink_api_task:

    depends_on:
        - "gating"

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"
        # Used by tree_status.sh
        SUGGESTION: 'remove API.md, then "make varlink_api_generate" and commit changes.'

    # Runs within Cirrus's "community cluster"
    container:
        image: "quay.io/libpod/gate:latest"
        cpu: 4
        memory: 12

    timeout_in: 10m

    vendor_script:
        - '/usr/local/bin/entrypoint.sh varlink_api_generate'
        - 'cd /go/src/github.com/containers/libpod && ./hack/tree_status.sh'

    on_failure:
        failed_master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


build_each_commit_task:

    depends_on:
        - "gating"

    # $CIRRUS_BASE_BRANCH is only set when testing a PR
    only_if: $CIRRUS_BRANCH != 'master'

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 8
        memory: "8Gb"
        disk: 200
        image_name: "${FEDORA_CACHE_IMAGE_NAME}"

    timeout_in: 30m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    build_each_commit_script:
        - 'git fetch --depth $CIRRUS_CLONE_DEPTH origin $CIRRUS_BASE_BRANCH |& ${TIMESTAMP}'
        - 'env GOPATH=/var/tmp/go/ make build-all-new-commits GIT_BASE_BRANCH=origin/$CIRRUS_BASE_BRANCH |& ${TIMESTAMP}'

    on_failure:
        failed_master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'


# Update metadata on VM images referenced by this repository state
meta_task:

    depends_on:
        - "gating"

    container:
        image: "quay.io/libpod/imgts:latest"  # see contrib/imgts
        cpu: 1
        memory: 1

    env:
        # Space-separated list of images used by this repository state
        IMGNAMES: "${ACTIVE_CACHE_IMAGE_NAMES}"
        BUILDID: "${CIRRUS_BUILD_ID}"
        REPOREF: "${CIRRUS_CHANGE_IN_REPO}"
        GCPJSON: ENCRYPTED[950d9c64ad78f7b1f0c7e499b42dc058d2b23aa67e38b315e68f557f2aba0bf83068d4734f7b1e1bdd22deabe99629df]
        GCPNAME: ENCRYPTED[b05d469a0dba8cb479cb00cc7c1f6747c91d17622fba260a986b976aa6c817d4077eacffd4613d6d5f23afc4084fab1d]
        GCPPROJECT: ENCRYPTED[7c80e728e046b1c76147afd156a32c1c57d4a1ac1eab93b7e68e718c61ca8564fc61fef815952b8ae0a64e7034b8fe4f]
        CIRRUS_CLONE_DEPTH: 1  # source not used

    script: '/usr/local/bin/entrypoint.sh |& ${TIMESTAMP}'


# This task does the unit and integration testing for every platform
testing_task:

    depends_on:
        - "gating"
        - "build_each_commit"

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 2
        memory: "4Gb"
        disk: 200  # see https://developers.google.com/compute/docs/disks#performance
        # Generate multiple parallel tasks, covering all possible
        # 'matrix' combinations.
        matrix:
            # Images are generated separately, from build_images_task (below)
            image_name: "${FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${UBUNTU_CACHE_IMAGE_NAME}"

            # TODO: Make these work (also optional_testing_task below)
            # image_name: "${PRIOR_RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${CENTOS_CACHE_IMAGE_NAME}"

    timeout_in: 120m

    # Every *_script runs in sequence, for each task. The name prefix is for
    # WebUI reference.  The values may be strings...
    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    unit_test_script: '$SCRIPT_BASE/unit_test.sh |& ${TIMESTAMP}'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP}'
    audit_log_script: 'cat /var/log/audit/audit.log || cat /var/log/kern.log'
    journalctl_b_script: 'journalctl -b'

    on_failure:
        failed_master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'
        # Job has already failed, don't fail again and miss collecting data
        failed_audit_log_script: 'cat /var/log/audit/audit.log || cat /var/log/kern.log || echo "Uh oh, cat audit.log failed"'
        failed_journalctl_b_script: 'journalctl -b || echo "Uh oh, journalctl -b failed"'


# This task executes tests under unique environments/conditions
special_testing_task:

    depends_on:
        - "gating"
        - "build_each_commit"

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 2
        memory: "4Gb"
        disk: 200
        # A matrix could be used here, for now just one VM
        image_name: "${FEDORA_CACHE_IMAGE_NAME}"

    env:
        matrix:
            SPECIALMODE: 'rootless'  # See docs
            SPECIALMODE: 'in_podman'  # See docs

    timeout_in: 120m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP}'
    audit_log_script: 'cat /var/log/audit/audit.log || cat /var/log/kern.log'
    journalctl_b_script: 'journalctl -b'

    on_failure:
        failed_master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh'
        # Job has already failed, don't fail again and miss collecting data
        failed_audit_log_script: 'cat /var/log/audit/audit.log || cat /var/log/kern.log || echo "Uh oh, cat audit.log failed"'
        failed_journalctl_b_script: 'journalctl -b || echo "Uh oh, journalctl -b failed"'


# Because system tests are stored within the repository, it is sometimes
# necessary to execute them within a PR to validate changes.
optional_testing_task:

    # Only run system tests in PRs (not on merge) if magic string is present
    # in the PR description.  Post-merge system testing is assumed to happen
    # later from OS distribution's build systems.
    only_if: >-
        $CIRRUS_BRANCH != 'master' &&
        $CIRRUS_CHANGE_MESSAGE =~ '.*\*\*\*\s*CIRRUS:\s*SYSTEM\s*TEST\s*\*\*\*.*'

    gce_instance:
        image_project: "libpod-218412"
        matrix:
            image_name: "${FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${UBUNTU_CACHE_IMAGE_NAME}"
            # TODO: Make these work (also testing_task above)
            # image_name: "${RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${PRIOR_RHEL_CACHE_IMAGE_NAME}"
            # image_name: "${CENTOS_CACHE_IMAGE_NAME}"

    timeout_in: 60m

    setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    system_test_script: '$SCRIPT_BASE/system_test.sh |& ${TIMESTAMP}'


# Build new cache-images for future PR testing, but only after a PR merge.
# The cache-images save install/setup time needed test every PR.  The 'active' images
# are selected by the 'image_name' items tasks above.  Currently this requires
# manually updating the names, but this could be automated (see comment below).
cache_images_task:
    # Only produce new cache-images after a PR merge, and if a magic string
    # is present in the most recent commit-message.
    only_if: >-
        $CIRRUS_BRANCH == 'master' &&
        $CIRRUS_CHANGE_MESSAGE =~ '.*\*\*\*\s*CIRRUS:\s*REBUILD\s*IMAGES\s*\*\*\*.*'

    # Require tests to pass first.
    depends_on:
        - "gating"
        - "testing"

    # VMs created by packer are not cleaned up by cirrus
    auto_cancellation: $CI != "true"

    gce_instance:
        image_project: "libpod-218412"
        zone: "us-central1-a"  # Required by Cirrus for the time being
        cpu: 4
        memory: "4Gb"
        disk: 200
        image_name: "${IMAGE_BUILDER_CACHE_IMAGE_NAME}"
        # Additional permissions for building GCE images, within a GCE VM
        scopes:
            - compute
            - devstorage.full_control
    environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}'
    build_vm_images_script: '$SCRIPT_BASE/build_vm_images.sh |& ${TIMESTAMP}'

    # TODO,Continuous Delivery: Automatically open a libpod PR after using 'sed' to replace
    #                           the image_names with the new (just build) images.  That will
    #                           cause a new round of testing to happen (via the PR) using
    #                           the new images.  When all is good, the PR may be manually
    #                           merged so all PR testing uses the new images.  The script
    #                           names (below) describe their purpose in this workflow.
    # deploy_images_script:
    #   - clone_podman_release_branch.sh
    #   - modify_cirrus_yaml_image_names.sh
    #   - commit_and_create_upstream_pr.sh

    on_failure:
        failed_master_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_master_failure.sh |& ${TIMESTAMP}'


# Post message to IRC if everything passed
success_task:

    only_if: $CIRRUS_BRANCH != 'master'

    depends_on:  # ignores any dependent task conditions
        - "gating"
        - "build_each_commit_task"
        - "testing"
        - "rootless_testing_task"
        - "optional_testing"

    env:
        CIRRUS_WORKING_DIR: "/usr/src/libpod"

    container:
        image: "quay.io/libpod/gate:latest"
        cpu: 1
        memory: 1

    success_script: '$SCRIPT_BASE/success.sh |& ${TIMESTAMP}'