path: root/.cirrus.yml

---

# Main collection of env. vars to set for all tasks and scripts.
env:
    ####
    #### Global variables used for all tasks
    ####
    # Name of the ultimate destination branch for this CI run, PR or post-merge.
    DEST_BRANCH: "main"
    # Netavark branch to use when TEST_ENVIRON=host-netavark
    NETAVARK_BRANCH: "main"
    # Aardvark branch to use
    AARDVARK_BRANCH: "main"
    # Overrides default location (/tmp/cirrus) for repo clone
    GOPATH: &gopath "/var/tmp/go"
    GOBIN: "${GOPATH}/bin"
    GOCACHE: "${GOPATH}/cache"
    GOSRC: &gosrc "/var/tmp/go/src/github.com/containers/podman"
    CIRRUS_WORKING_DIR: *gosrc
    # The default is 'sh' if unspecified
    CIRRUS_SHELL: "/bin/bash"
    # Save a little typing (path relative to $CIRRUS_WORKING_DIR)
    SCRIPT_BASE: "./contrib/cirrus"
    # Runner statistics log file path/name
    STATS_LOGFILE_SFX: 'runner_stats.log'
    STATS_LOGFILE: '$GOSRC/${CIRRUS_TASK_NAME}-${STATS_LOGFILE_SFX}'
    # Netavark/aardvark location/options when TEST_ENVIRON=host-netavark
    NETAVARK_URL: "https://api.cirrus-ci.com/v1/artifact/github/containers/netavark/success/binary.zip?branch=${NETAVARK_BRANCH}"
    NETAVARK_DEBUG: 0  # set non-zero to use the debug-mode binary
    AARDVARK_URL: "https://api.cirrus-ci.com/v1/artifact/github/containers/aardvark-dns/success/binary.zip?branch=${AARDVARK_BRANCH}"
    AARDVARK_DEBUG: 0  # set non-zero to use the debug-mode binary

    ####
    #### Cache-image names to test with (double-quotes around names are critical)
    ####
    FEDORA_NAME: "fedora-35"
    PRIOR_FEDORA_NAME: "fedora-34"
    UBUNTU_NAME: "ubuntu-2110"

    # Google-cloud VM Images
    IMAGE_SUFFIX: "c6261670816251904"
    FEDORA_CACHE_IMAGE_NAME: "fedora-${IMAGE_SUFFIX}"
    PRIOR_FEDORA_CACHE_IMAGE_NAME: "prior-fedora-${IMAGE_SUFFIX}"
    UBUNTU_CACHE_IMAGE_NAME: "ubuntu-${IMAGE_SUFFIX}"

    # Container FQIN's
    FEDORA_CONTAINER_FQIN: "quay.io/libpod/fedora_podman:${IMAGE_SUFFIX}"
    PRIOR_FEDORA_CONTAINER_FQIN: "quay.io/libpod/prior-fedora_podman:${IMAGE_SUFFIX}"
    UBUNTU_CONTAINER_FQIN: "quay.io/libpod/ubuntu_podman:${IMAGE_SUFFIX}"

    ####
    #### Control variables that determine what to run and how to run it.
    #### N/B: Required ALL of these are set for every single task.
    ####
    TEST_FLAVOR:             # int, sys, ext_svc, validate, automation, etc.
    TEST_ENVIRON: host       # 'host', 'host-netavark', or 'container'
    PODBIN_NAME: podman      # 'podman' or 'remote'
    PRIV_NAME: root          # 'root' or 'rootless'
    DISTRO_NV:               # any {PRIOR_,}{FEDORA,UBUNTU}_NAME value
    VM_IMAGE_NAME:           # One of the "Google-cloud VM Images" (above)
    CTR_FQIN:                # One of the "Container FQIN's" (above)


# Default timeout for each task
timeout_in: 60m


gcp_credentials: ENCRYPTED[a28959877b2c9c36f151781b0a05407218cda646c7d047fc556e42f55e097e897ab63ee78369dae141dcf0b46a9d0cdd]


# Attempt to prevent flakes by confirming all required external/3rd-party
# services are available and functional.
ext_svc_check_task:
    alias: 'ext_svc_check'  # int. ref. name - required for depends_on reference
    name: "Ext. services"  # Displayed Title - has no other significance
    skip: &tags "$CIRRUS_TAG != ''"  # Don't run on tags
    # Default/small container image to execute tasks with
    container: &smallcontainer
        image: ${CTR_FQIN}
        # Resources are limited across ALL currently executing tasks
        # ref: https://cirrus-ci.org/guide/linux/#linux-containers
        cpu: 2
        memory: 2
    env:
        TEST_FLAVOR: ext_svc
        CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
    # NOTE: The default way Cirrus-CI clones is *NOT* compatible with
    #       environment expectations in contrib/cirrus/lib.sh.  Specifically
    #       the 'origin' remote must be defined, and all remote branches/tags
    #       must be available for reference from CI scripts.
    clone_script: &full_clone |
          cd /
          rm -rf $CIRRUS_WORKING_DIR
          mkdir -p $CIRRUS_WORKING_DIR
          git clone --recursive --branch=$DEST_BRANCH https://x-access-token:${CIRRUS_REPO_CLONE_TOKEN}@github.com/${CIRRUS_REPO_FULL_NAME}.git $CIRRUS_WORKING_DIR
          cd $CIRRUS_WORKING_DIR
          git remote update origin
          if [[ -n "$CIRRUS_PR" ]]; then # running for a PR
              git fetch origin pull/$CIRRUS_PR/head:pull/$CIRRUS_PR
              git checkout pull/$CIRRUS_PR
          else
              git reset --hard $CIRRUS_CHANGE_IN_REPO
          fi
          make install.tools

    setup_script: &setup '$GOSRC/$SCRIPT_BASE/setup_environment.sh'
    main_script: &main '/usr/bin/time --verbose --output="$STATS_LOGFILE" $GOSRC/$SCRIPT_BASE/runner.sh'
    always: &runner_stats
        runner_stats_artifacts:
            path: ./*-${STATS_LOGFILE_SFX}
            type: text/plain


# Execute some quick checks to confirm this YAML file and all
# automation-related shell scripts are sane.
automation_task:
    alias: 'automation'
    name: "Check Automation"
    skip: &branches_and_tags "$CIRRUS_PR == '' || $CIRRUS_TAG != ''" # Don't run on branches/tags
    container: *smallcontainer
    env:
        TEST_FLAVOR: automation
        CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
        TEST_ENVIRON: container
    clone_script: *full_clone
    setup_script: *setup
    main_script: *main
    always: *runner_stats


# N/B: This task is critical.  It builds all binaries and release archives
# for the project, using all primary OS platforms and versions.  Assuming
# the builds are successful, a cache is stored of the entire `$GOPATH`
# contents.  For all subsequent tasks, the _BUILD_CACHE_HANDLE value
# is used as a key to reuse this cache, saving both time and money.
# The only exceptions are tasks which only run inside a container, they
# will not have access the cache and therefore must rely on cloning the
# repository.
build_task:
    alias: 'build'
    name: 'Build for $DISTRO_NV'
    gce_instance: &standardvm
        image_project: libpod-218412
        zone: "us-central1-a"
        cpu: 2
        memory: "4Gb"
        # Required to be 200gig, do not modify - has i/o performance impact
        # according to gcloud CLI tool warning messages.
        disk: 200
        image_name: "${VM_IMAGE_NAME}"  # from stdenvars
    matrix: &platform_axis
        # Ref: https://cirrus-ci.org/guide/writing-tasks/#matrix-modification
        - env: &stdenvars
              DISTRO_NV: ${FEDORA_NAME}
              # Not used here, is used in other tasks
              VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
              CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
              # ID for re-use of build output
              _BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
        #- env: &priorfedora_envvars
        #      DISTRO_NV: ${PRIOR_FEDORA_NAME}
        #      VM_IMAGE_NAME: ${PRIOR_FEDORA_CACHE_IMAGE_NAME}
        #      CTR_FQIN: ${PRIOR_FEDORA_CONTAINER_FQIN}
        #      _BUILD_CACHE_HANDLE: ${PRIOR_FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
        - env: &ubuntu_envvars
              DISTRO_NV: ${UBUNTU_NAME}
              VM_IMAGE_NAME: ${UBUNTU_CACHE_IMAGE_NAME}
              CTR_FQIN: ${UBUNTU_CONTAINER_FQIN}
              _BUILD_CACHE_HANDLE: ${UBUNTU_NAME}-build-${CIRRUS_BUILD_ID}
    env:
        TEST_FLAVOR: build
    # Ref: https://cirrus-ci.org/guide/writing-tasks/#cache-instruction
    gopath_cache:  &gopath_cache
        folder: *gopath  # Required hard-coded path, no variables.
        fingerprint_script: echo "$_BUILD_CACHE_HANDLE"
        # Cheat: Clone here when cache is empty, guaranteeing consistency.
        populate_script: *full_clone
    # A normal clone would invalidate useful cache
    clone_script: &noop mkdir -p $CIRRUS_WORKING_DIR
    setup_script: *setup
    main_script: *main
    always: &binary_artifacts
        <<: *runner_stats
        gosrc_artifacts:
            path: ./*  # Grab everything in top-level $GOSRC
            type: application/octet-stream
        binary_artifacts:
            path: ./bin/*
            type: application/octet-stream


# Confirm the result of building on at least one platform appears sane.
# This confirms the binaries can be executed, checks --help vs docs, and
# other essential post-build validation checks.
validate_task:
    name: "Validate $DISTRO_NV Build"
    alias: validate
    # This task is primarily intended to catch human-errors early on, in a
    # PR.  Skip it for branch-push, branch-create, and tag-push to improve
    # automation reliability/speed in those contexts.  Any missed errors due
    # to nonsequential PR merging practices, will be caught on a future PR,
    # build or test task failures.
    skip: *branches_and_tags
    depends_on:
        - ext_svc_check
        - automation
        - build
    # golangci-lint is a very, very hungry beast.
    gce_instance: &bigvm
        <<: *standardvm
        cpu: 8
        memory: "16Gb"
    env:
        <<: *stdenvars
        TEST_FLAVOR: validate
    gopath_cache: &ro_gopath_cache
        <<: *gopath_cache
        reupload_on_changes: false
    clone_script: *noop
    setup_script: *setup
    main_script: *main
    always: *runner_stats


# Exercise the "libpod" API with a small set of common
# operations to ensure they are functional.
bindings_task:
    name: "Test Bindings"
    alias: bindings
    # Don't run for [CI:DOCS] or [CI:BUILD]
    only_if: &not_build $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*' && $CIRRUS_CHANGE_TITLE !=~ '.*CI:BUILD.*'
    skip: *branches_and_tags
    depends_on:
        - build
    gce_instance: *standardvm
    env:
        <<: *stdenvars
        TEST_FLAVOR: bindings
    gopath_cache: *ro_gopath_cache
    clone_script: *noop  # Comes from cache
    setup_script: *setup
    main_script: *main
    always: &logs_artifacts
        <<: *runner_stats
        # Required for `contrib/cirrus/logformatter` to work properly
        html_artifacts:
            path: ./*.html
            type: text/html
        package_versions_script: '$SCRIPT_BASE/logcollector.sh packages'
        df_script: '$SCRIPT_BASE/logcollector.sh df'
        audit_log_script: '$SCRIPT_BASE/logcollector.sh audit'
        journal_script: '$SCRIPT_BASE/logcollector.sh journal'
        podman_system_info_script: '$SCRIPT_BASE/logcollector.sh podman'
        time_script: '$SCRIPT_BASE/logcollector.sh time'


# Build the "libpod" API documentation `swagger.yaml` and
# publish it to google-cloud-storage (GCS).
swagger_task:
    name: "Test Swagger"
    alias: swagger
    depends_on:
        - build
    gce_instance: *standardvm
    env:
        <<: *stdenvars
        TEST_FLAVOR: swagger
        # TODO: Due to podman 3.0 activity (including new images), avoid
        # disturbing the status-quo just to incorporate this one new
        # container image.  Uncomment line below when CI activities normalize.
        #CTR_FQIN: 'quay.io/libpod/gcsupld:${IMAGE_SUFFIX}'
        CTR_FQIN: 'quay.io/libpod/gcsupld:c4813063494828032'
        GCPJSON: ENCRYPTED[927dc01e755eaddb4242b0845cf86c9098d1e3dffac38c70aefb1487fd8b4fe6dd6ae627b3bffafaba70e2c63172664e]
        GCPNAME: ENCRYPTED[c145e9c16b6fb88d476944a454bf4c1ccc84bb4ecaca73bdd28bdacef0dfa7959ebc8171a27b2e4064d66093b2cdba49]
        GCPPROJECT: 'libpod-218412'
    gopath_cache: *ro_gopath_cache
    clone_script: *noop  # Comes from cache
    setup_script: *setup
    main_script: *main
    always: *binary_artifacts


# Check that all included go modules from other sources match
# what is expected in `vendor/modules.txt` vs `go.mod`.  Also
# make sure that the generated bindings in pkg/bindings/...
# are in sync with the code.
consistency_task:
    name: "Test Code Consistency"
    alias: consistency
    skip: *tags
    depends_on:
        - build
    container: *smallcontainer
    env:
        <<: *stdenvars
        TEST_FLAVOR: consistency
        TEST_ENVIRON: container
        CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
    clone_script: *full_clone  # build-cache not available to container tasks
    setup_script: *setup
    main_script: *main
    always: *runner_stats


# There are several other important variations of podman which
# must always build successfully.  Most of them are handled in
# this task, though a few need dedicated tasks which follow.
alt_build_task:
    name: "$ALT_NAME"
    alias: alt_build
    # Don't run for [CI:DOCS]; DO run for [CI:BUILD]
    only_if: &not_docs $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'
    depends_on:
        - build
    env:
        <<: *stdenvars
        TEST_FLAVOR: "altbuild"
    gce_instance: *standardvm
    matrix:
      - env:
            ALT_NAME: 'Build Each Commit'
      - env:
            ALT_NAME: 'Windows Cross'
      - env:
            ALT_NAME: 'Build Without CGO'
      - env:
            ALT_NAME: 'Test build RPM'
      - env:
            ALT_NAME: 'Alt Arch. Cross'
    gopath_cache: *ro_gopath_cache
    clone_script: *noop  # Comes from cache
    setup_script: *setup
    main_script: *main
    always: *binary_artifacts


# Confirm building the remote client, natively on a Mac OS-X VM.
osx_alt_build_task:
    name: "OSX Cross"
    alias: osx_alt_build
    only_if: *not_docs
    depends_on:
        - build
    env:
        <<: *stdenvars
        # OSX platform variation prevents this being included in alt_build_task
        TEST_FLAVOR: "altbuild"
        ALT_NAME: 'OSX Cross'
    osx_instance:
        image: 'big-sur-base'
    setup_script:
        - brew install go
        - brew install go-md2man
        - go version
    build_amd64_script:
        - make podman-remote-release-darwin_amd64.zip
    build_arm64_script:
        - make podman-remote-release-darwin_arm64.zip GOARCH=arm64
    always: *binary_artifacts


# Verify podman is compatible with the docker python-module.
docker-py_test_task:
    name: Docker-py Compat.
    alias: docker-py_test
    skip: *tags
    only_if: *not_build
    depends_on:
        - build
    gce_instance: *standardvm
    env:
        <<: *stdenvars
        TEST_FLAVOR: docker-py
        TEST_ENVIRON: container
    gopath_cache: *ro_gopath_cache
    clone_script: *noop  # Comes from cache
    setup_script: *setup
    main_script: *main
    always: *runner_stats


# Does exactly what it says, execute the podman unit-tests on all primary
# platforms and release versions.
unit_test_task:
    name: "Unit tests on $DISTRO_NV"
    alias: unit_test
    skip: *tags
    only_if: *not_build
    depends_on:
        - validate
    matrix:
        - env: *stdenvars
        #- env: *priorfedora_envvars
        - env: *ubuntu_envvars
        # Special-case: Rootless on latest Fedora (standard) VM
        - name: "Rootless unit on $DISTRO_NV"
          env:
              <<: *stdenvars
              PRIV_NAME: rootless
    gce_instance: *standardvm
    env:
        TEST_FLAVOR: unit
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *logs_artifacts


apiv2_test_task:
    name: "APIv2 test on $DISTRO_NV"
    alias: apiv2_test
    only_if: *not_build
    skip: *tags
    depends_on:
        - validate
    gce_instance: *standardvm
    # Test is normally pretty quick, about 10-minutes.  If it hangs,
    # don't make developers wait the full 1-hour timeout.
    timeout_in: 20m
    env:
        <<: *stdenvars
        TEST_FLAVOR: apiv2
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *logs_artifacts


compose_test_task:
    name: "$TEST_FLAVOR test on $DISTRO_NV ($PRIV_NAME)"
    alias: compose_test
    only_if: *not_build
    skip: *tags
    depends_on:
        - validate
    gce_instance: *standardvm
    env:
        <<: *stdenvars
    matrix:
      - env:
            TEST_FLAVOR: compose
            PRIV_NAME: root
      - env:
            TEST_FLAVOR: compose
            PRIV_NAME: rootless
      - env:
            TEST_FLAVOR: compose_v2
            PRIV_NAME: root
      - env:
            TEST_FLAVOR: compose_v2
            PRIV_NAME: rootless
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *logs_artifacts


# Execute the podman integration tests on all primary platforms and release
# versions, as root, without involving the podman-remote client.
local_integration_test_task: &local_integration_test_task
    # Integration-test task name convention:
    # <int.|sys.> <podman|remote> <Distro NV> <root|rootless>
    name: &std_name_fmt "$TEST_FLAVOR $PODBIN_NAME $DISTRO_NV $PRIV_NAME $TEST_ENVIRON"
    alias: local_integration_test
    only_if: *not_build
    skip: *branches_and_tags
    depends_on:
        - unit_test
    matrix: *platform_axis
    gce_instance: *standardvm
    timeout_in: 90m
    env:
        TEST_FLAVOR: int
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: &int_logs_artifacts
        <<: *logs_artifacts
        ginkgo_node_logs_artifacts:
            path: ./test/e2e/ginkgo-node-*.log
            type: text/plain


# Nearly identical to `local_integration_test` except all operations
# are performed through the podman-remote client vs a podman "server"
# running on the same host.
remote_integration_test_task:
    <<: *local_integration_test_task
    alias: remote_integration_test
    env:
        TEST_FLAVOR: int
        PODBIN_NAME: remote


# Run the complete set of integration tests from inside a container.
# This verifies all/most operations function with "podman-in-podman".
container_integration_test_task:
    name: *std_name_fmt
    alias: container_integration_test
    only_if: *not_build
    skip: *branches_and_tags
    depends_on:
        - unit_test
    matrix: &fedora_vm_axis
        - env:
              DISTRO_NV: ${FEDORA_NAME}
              _BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
              VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
              CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
        #- env:
        #      DISTRO_NV: ${PRIOR_FEDORA_NAME}
        #      _BUILD_CACHE_HANDLE: ${PRIOR_FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
        #      VM_IMAGE_NAME: ${PRIOR_FEDORA_CACHE_IMAGE_NAME}
        #      CTR_FQIN: ${PRIOR_FEDORA_CONTAINER_FQIN}
    gce_instance: *standardvm
    timeout_in: 90m
    env:
        TEST_FLAVOR: int
        TEST_ENVIRON: container
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *int_logs_artifacts


# Execute most integration tests as a regular (non-root) user.
rootless_integration_test_task:
    name: *std_name_fmt
    alias: rootless_integration_test
    only_if: *not_build
    skip: *branches_and_tags
    depends_on:
        - unit_test
    matrix: *platform_axis
    gce_instance: *standardvm
    timeout_in: 90m
    env:
        TEST_FLAVOR: int
        PRIV_NAME: rootless
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *int_logs_artifacts


# Run various scenarios using upstream netavark/aardvark-dns binaries
netavark_task:
    name: "Netavark $TEST_FLAVOR $PODBIN_NAME $PRIV_NAME"
    alias: netavark
    only_if: *not_build
    skip: *branches_and_tags
    depends_on:
        - unit_test
    gce_instance: *standardvm
    matrix:
        - env: &nenv
            DISTRO_NV: ${FEDORA_NAME}
            _BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
            VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
            CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
            TEST_FLAVOR: int
            TEST_ENVIRON: host-netavark
        - env:
            <<: *nenv
            TEST_FLAVOR: int
            PRIV_NAME: rootless
        - env:
            <<: *nenv
            TEST_FLAVOR: sys
        - env:
            <<: *nenv
            TEST_FLAVOR: sys
            PRIV_NAME: rootless
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *int_logs_artifacts


# Always run subsequent to integration tests.  While parallelism is lost
# with runtime, debugging system-test failures can be more challenging
# for some golang developers.  Otherwise the following tasks run across
# the same matrix as the integration-tests (above).
local_system_test_task: &local_system_test_task
    name: *std_name_fmt
    alias: local_system_test
    skip: *tags
    only_if: *not_build
    depends_on:
      - local_integration_test
    matrix: *platform_axis
    gce_instance: *standardvm
    env:
        TEST_FLAVOR: sys
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *logs_artifacts


remote_system_test_task:
    <<: *local_system_test_task
    alias: remote_system_test
    depends_on:
      - remote_integration_test
    env:
        TEST_FLAVOR: sys
        PODBIN_NAME: remote


rootless_remote_system_test_task:
    <<: *local_system_test_task
    alias: rootless_remote_system_test
    depends_on:
      - remote_integration_test
    matrix:
      # Minimal sanity testing: only the latest Fedora
      - env:
          DISTRO_NV: ${FEDORA_NAME}
          # Not used here, is used in other tasks
          VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
          CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
          # ID for re-use of build output
          _BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
    gce_instance: *standardvm
    env:
        TEST_FLAVOR: sys
        PODBIN_NAME: remote
        PRIV_NAME: rootless


buildah_bud_test_task:
    name: *std_name_fmt
    alias: buildah_bud_test
    skip: *tags
    only_if: *not_build
    depends_on:
      - local_integration_test
    env:
        TEST_FLAVOR: bud
        DISTRO_NV: ${FEDORA_NAME}
        # Not used here, is used in other tasks
        VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
        CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
        # ID for re-use of build output
        _BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
    matrix:
        - env:
            PODBIN_NAME: podman
        - env:
            PODBIN_NAME: remote
    gce_instance: *standardvm
    timeout_in: 45m
    clone_script: *noop
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *int_logs_artifacts


rootless_system_test_task:
    name: *std_name_fmt
    alias: rootless_system_test
    skip: *tags
    only_if: *not_build
    depends_on:
      - rootless_integration_test
    matrix: *platform_axis
    gce_instance: *standardvm
    env:
        TEST_FLAVOR: sys
        PRIV_NAME: rootless
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *logs_artifacts


rootless_gitlab_test_task:
    name: *std_name_fmt
    alias: rootless_gitlab_test
    skip: *tags
    only_if: *not_build
    # Community-maintained downstream test may fail unexpectedly.
    # Ref. repository: https://gitlab.com/gitlab-org/gitlab-runner
    # If necessary, uncomment the next line and file issue(s) with details.
    # allow_failures: $CI == $CI
    depends_on:
      - rootless_integration_test
    gce_instance: *standardvm
    env:
        <<: *ubuntu_envvars
        TEST_FLAVOR: 'gitlab'
        PRIV_NAME: rootless
    clone_script: *noop  # Comes from cache
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always:
        <<: *logs_artifacts
        junit_artifacts:
            path: gitlab-runner-podman.xml
            type: text/xml
            format: junit


upgrade_test_task:
    name: "Upgrade test: from $PODMAN_UPGRADE_FROM"
    alias: upgrade_test
    skip: *tags
    only_if: *not_build
    depends_on:
      - local_system_test
    matrix:
        - env:
              PODMAN_UPGRADE_FROM: v2.1.1
        - env:
              PODMAN_UPGRADE_FROM: v3.1.2
        - env:
              PODMAN_UPGRADE_FROM: v3.4.4
    gce_instance: *standardvm
    env:
        TEST_FLAVOR: upgrade_test
        DISTRO_NV: ${FEDORA_NAME}
        VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
        # ID for re-use of build output
        _BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
    clone_script: *noop
    gopath_cache: *ro_gopath_cache
    setup_script: *setup
    main_script: *main
    always: *logs_artifacts


image_build_task:
    name: "Build multi-arch $CTXDIR"
    alias: image_build
    # Some of these container images take > 1h to build, limit
    # this task to a specific Cirrus-Cron entry with this name.
    only_if: $CIRRUS_CRON == 'multiarch'
    depends_on:
        - ext_svc_check
    timeout_in: 120m  # emulation is sssllllooooowwww
    gce_instance:
        <<: *standardvm
        image_name: build-push-${IMAGE_SUFFIX}
        # More muscle required for parallel multi-arch build
        type: "n2-standard-4"
    env:
        PODMAN_USERNAME: ENCRYPTED[b9f0f2550029dd2196e086d9dd6c2d1fec7e328630b15990d9bb610f9fcccb5baab8b64a8c3e72b0c1d0f5917cf65aa1]
        PODMAN_PASSWORD: ENCRYPTED[e3444f6072853f0c8db7f964ead5e2204116af485469fa0de367f26b9316b460fd842a9882f552b9e9a83bbaf650d8b4]
        CONTAINERS_USERNAME: ENCRYPTED[54a372d5f22f424173c114c6fb25c3214956cad323d5b285c7393a71041884ce96471d0ff733774e5dab9fa5a3c8795c]
        CONTAINERS_PASSWORD: ENCRYPTED[4ecc3fb534935095a99fb1f2e320ac6bc87f3e7e186746e41cbcc4b5f5379a014b9fc8cc90e1f3d5abdbaf31580a4ab9]
    matrix:
        - env:
            CTXDIR: contrib/podmanimage/upstream
        - env:
            CTXDIR: contrib/podmanimage/testing
        - env:
            CTXDIR: contrib/podmanimage/stable
        - env:
            CTXDIR: contrib/hello
    script:
        - set -a; source /etc/automation_environment; set +a
        - main.sh $CIRRUS_REPO_CLONE_URL $CTXDIR


# This task is critical.  It updates the "last-used by" timestamp stored
# in metadata for all VM images.  This mechanism functions in tandem with
# an out-of-band pruning operation to remove disused VM images.
meta_task:
    name: "VM img. keepalive"
    alias: meta
    container:
        cpu: 2
        memory: 2
        image: quay.io/libpod/imgts:$IMAGE_SUFFIX
    env:
        # Space-separated list of images used by this repository state
        IMGNAMES: >-
            ${FEDORA_CACHE_IMAGE_NAME}
            ${PRIOR_FEDORA_CACHE_IMAGE_NAME}
            ${UBUNTU_CACHE_IMAGE_NAME}
            build-push-${IMAGE_SUFFIX}
        BUILDID: "${CIRRUS_BUILD_ID}"
        REPOREF: "${CIRRUS_REPO_NAME}"
        GCPJSON: ENCRYPTED[3a198350077849c8df14b723c0f4c9fece9ebe6408d35982e7adf2105a33f8e0e166ed3ed614875a0887e1af2b8775f4]
        GCPNAME: ENCRYPTED[2f9738ef295a706f66a13891b40e8eaa92a89e0e87faf8bed66c41eca72bf76cfd190a6f2d0e8444c631fdf15ed32ef6]
        GCPPROJECT: libpod-218412
    clone_script: *noop
    script: /usr/local/bin/entrypoint.sh


# Status aggregator for all tests.  This task simply ensures a defined
# set of tasks all passed, and allows confirming that based on the status
# of this task.
success_task:
    name: "Total Success"
    alias: success
    # N/B: ALL tasks must be listed here, minus their '_task' suffix.
    depends_on:
        - ext_svc_check
        - automation
        - build
        - validate
        - bindings
        - swagger
        - consistency
        - alt_build
        - osx_alt_build
        - docker-py_test
        - unit_test
        - apiv2_test
        - compose_test
        - local_integration_test
        - remote_integration_test
        - container_integration_test
        - rootless_integration_test
        - netavark
        - local_system_test
        - remote_system_test
        - rootless_system_test
        - rootless_remote_system_test
        - rootless_gitlab_test
        - upgrade_test
        - buildah_bud_test
        - image_build
        - meta
    container: *smallcontainer
    env:
        CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
        TEST_ENVIRON: container
    clone_script: *noop
    script: *noop


artifacts_task:
    name: "Artifacts"
    alias: artifacts
    only_if: *not_docs
    depends_on:
        - success
    # This task is a secondary/convenience for downstream consumers, don't
    # block development progress if there is a failure in a PR, only break
    # when running on branches or tags.
    allow_failures: $CIRRUS_PR != ''
    container: *smallcontainer
    env:
        CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
        TEST_ENVIRON: container
        CURL: "curl --fail --location -O https://api.cirrus-ci.com/v1/artifact/build/${CIRRUS_BUILD_ID}"
    # In order to keep the download URL and Cirrus-CI artifact.zip contents
    # simple, nothing should exist in $CIRRUS_WORKING_DIR except for artifacts.
    clone_script: *noop
    script:
        # Assume the latest Fedora release build is most useful
        - $CURL/Build%20for%20$FEDORA_NAME/binary/bin/podman
        - $CURL/Build%20for%20$FEDORA_NAME/binary/bin/podman-remote
        - $CURL/Build%20for%20$FEDORA_NAME/binary/bin/rootlessport
        - chmod +x podman* rootlessport
        # Architecture in filename & can't use wildcards in a URL
        - mkdir -p /tmp/alt
        - cd /tmp/alt
        - $CURL/Alt%20Arch.%20Cross/gosrc.zip
        - unzip gosrc.zip
        - cd $CIRRUS_WORKING_DIR
        - mv /tmp/alt/*.tar.gz ./
        # Windows MSI filename has version number
        - mkdir -p /tmp/win
        - cd /tmp/win
        - $CURL/Windows%20Cross/gosrc.zip
        - unzip gosrc.zip
        - cd $CIRRUS_WORKING_DIR
        - mv /tmp/win/podman-remote*.zip /tmp/win/*.msi ./
        # OSX
        - $CURL/OSX%20Cross/gosrc/podman-remote-release-darwin_amd64.zip
        - $CURL/OSX%20Cross/gosrc/podman-remote-release-darwin_arm64.zip
    # Always show contents to assist in debugging
    always:
        contents_script: ls -1 $CIRRUS_WORKING_DIR
    # Produce downloadable files and an automatic zip-file accessible
    # by a consistent URL, based on contents of $CIRRUS_WORKING_DIR
    # Ref: https://cirrus-ci.org/guide/writing-tasks/#latest-build-artifacts
    binary_artifacts:
        path: ./*
        type: application/octet-stream


# When a new tag is pushed, confirm that the code and commits
# meet criteria for an official release.
release_task:
    name: "Verify Release"
    alias: release
    only_if: *tags
    depends_on:
        - success
    gce_instance: *standardvm
    env:
        <<: *stdenvars
        TEST_FLAVOR: release
    gopath_cache: *ro_gopath_cache
    clone_script: *noop  # Comes from cache
    setup_script: *setup
    main_script: *main
    always: *binary_artifacts


# When preparing to release a new version, this task may be manually
# activated at the PR stage to verify the build is proper for a potential
# podman release.
#
# Note: This cannot use a YAML alias on 'release_task' as of this
# comment, it is incompatible with 'trigger_type: manual'
release_test_task:
    name: "Optional Release Test"
    alias: release_test
    # Release-PRs always include "release" or "Bump" in the title
    only_if: $CIRRUS_CHANGE_TITLE =~ '.*((release)|(bump)).*'
    # Allow running manually only as part of release-related builds
    # see RELEASE_PROCESS.md
    trigger_type: manual
    depends_on:
        - success
    gce_instance: *standardvm
    env:
        <<: *stdenvars
        TEST_FLAVOR: release
    gopath_cache: *ro_gopath_cache
    clone_script: *noop  # Comes from cache
    setup_script: *setup
    main_script: *main
    always: *binary_artifacts