buildx.yaml

# build images GH actions pipeline
#
# On every PR, we want to build images and tag them appropriately.
# As the images are build, we push commits to the PR that:
#  - update the dockerfile args with the new tags
#  - save the new tags under versions/
name: buildx-images
on:
  pull_request:

jobs:
  # initial configuration
  conf:
    runs-on: ubuntu-latest
    outputs:
      dry-run: ${{ steps.configure.outputs.dry-run }}
      run: ${{ steps.configure.outputs.run }}
      tag: ${{ steps.configure.outputs.tag }}
      kvers: ${{ steps.kvers.outputs.result }}
    steps:
      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        id: run-script
        name: run-script
        with:
          result-encoding: string
          script: |
            res = await github.rest.issues.listLabelsOnIssue({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            for (const l of res.data) {
              if (l.name == 'gha-builds/just-dont') {
                return 'n'
              }
            }
            return 'y'
      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        id: dry-run-script
        name: dry-run-script
        with:
          result-encoding: string
          script: |
            res = await github.rest.issues.listLabelsOnIssue({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            for (const l of res.data) {
              if (l.name == 'gha-builds/dry-run') {
                return 'y'
              }
            }
            return 'n'
      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        id: kvers
        name: kernel versions
        with:
          script: |
              var all_kernels = ['4.19', '5.4', '5.10', '5.15', '6.0', '6.3', 'bpf-next' ]
              var kernels = []
              const kernel_label_prefix = 'gha-builds/kernel/'
              res = await github.rest.issues.listLabelsOnIssue({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
              });
              for (const l of res.data) {
                  if (l.name.startsWith(kernel_label_prefix)) {
                      s = l.name.slice(kernel_label_prefix.length)
                      if (s.length > 0) {
                          kernels.push(s)
                      }
                  }
              }

              if (kernels.length == 0) {
                  kernels = all_kernels
              }
              return kernels
      - name: configure
        id: configure
        run: |
          echo "Kernels: ${{ steps.kvers.outputs.result }}"
          echo "dry-run=${{ steps.dry-run-script.outputs.result }}" | tee -a $GITHUB_OUTPUT
          echo "run=${{ steps.run-script.outputs.result }}" | tee -a $GITHUB_OUTPUT
          tag=$(date +%Y%m%d.%H%M%S)
          echo "tag=$tag" | tee -a $GITHUB_OUTPUT

  kernel-builder:
    needs: [conf]
    if: ${{ needs.conf.outputs.run == 'y' }}
    uses: ./.github/workflows/buildx-stage.yaml
    secrets: inherit
    with:
     name: kernel-builder
     build-file: dockerfiles/kernel-builder
     build-tag: quay.io/lvh-images/kernel-builder-ci:${{ needs.conf.outputs.tag }}
     check-files: dockerfiles/kernel-builder
     base-ref: ${{ github.base_ref }}
     dry-run: ${{ needs.conf.outputs.dry-run == 'y' }}
     patch-cmd: |
         echo ${{ needs.conf.outputs.tag }} > versions/kernel-builder
         perl -pi -e 's/^ARG KERNEL_BUILDER_TAG.*$/ARG KERNEL_BUILDER_TAG=${{ needs.conf.outputs.tag }}/' dockerfiles/*

  kernel-images:
    needs: [conf, kernel-builder]
    if: ${{ needs.conf.outputs.run == 'y' }}
    strategy:
      matrix:
        kernel: ${{ fromJSON(needs.conf.outputs.kvers) }}
    uses: ./.github/workflows/buildx-stage.yaml
    secrets: inherit
    with:
     name: kernel-image-${{ matrix.kernel }}
     build-file: dockerfiles/kernel-images
     build-tag: quay.io/lvh-images/kernel-images-ci:${{ matrix.kernel }}-${{ needs.conf.outputs.tag }}
     build-args: |
          "KERNEL_VER=${{ matrix.kernel }}"
     check-files: '.'
     base-ref: ${{ github.base_ref }}
     dry-run: ${{ needs.conf.outputs.dry-run == 'y' }}
     apply-patch: kernel-builder.patch
     patch-cmd: |
         mkdir -p versions/kernel-images
         echo ${{ needs.conf.outputs.tag}} > versions/kernel-images/${{ matrix.kernel }}

  root-builder:
    needs: [conf]
    if: ${{ needs.conf.outputs.run == 'y' }}
    uses: ./.github/workflows/buildx-stage.yaml
    secrets: inherit
    with:
     name: root-builder
     check-files: dockerfiles/root-builder
     build-file: dockerfiles/root-builder
     build-tag: quay.io/lvh-images/root-builder-ci:${{ needs.conf.outputs.tag }}
     base-ref: ${{ github.base_ref }}
     dry-run: ${{ needs.conf.outputs.dry-run == 'y' }}
     patch-cmd: |
        perl -pi -e 's/^ARG ROOT_BUILDER_TAG.*$/ARG ROOT_BUILDER_TAG=${{ needs.conf.outputs.tag }}/' dockerfiles/*
        echo ${{ needs.conf.outputs.tag }} > versions/root-builder

  root-images:
    needs: [conf, root-builder]
    if: ${{ needs.conf.outputs.run == 'y' }}
    uses: ./.github/workflows/buildx-stage.yaml
    secrets: inherit
    with:
     name: root-images
     check-files: dockerfiles/root-images _data/images.json _data/env.sh _data/bootstrap
     build-file: dockerfiles/root-images
     build-tag: quay.io/lvh-images/root-images-ci:${{ needs.conf.outputs.tag }}
     base-ref: ${{ github.base_ref }}
     dry-run: ${{ needs.conf.outputs.dry-run == 'y' }}
     apply-patch: root-builder.patch
     patch-cmd: |
        perl -pi -e 's/^ARG ROOT_IMAGES_TAG.*$/ARG ROOT_IMAGES_TAG=${{ needs.conf.outputs.tag }}/' dockerfiles/*
        echo ${{ needs.conf.outputs.tag }} > versions/root-images

  kind-images:
    if: ${{ needs.conf.outputs.run == 'y' }}
    needs: [conf, kernel-images, root-images]
    strategy:
      matrix:
        kernel: ${{ fromJSON(needs.conf.outputs.kvers) }}
    uses: ./.github/workflows/buildx-stage.yaml
    secrets: inherit
    with:
     name: kind-image-${{ matrix.kernel }}
     build-file: dockerfiles/kind-images
     build-tag: quay.io/lvh-images/kind-ci:${{ matrix.kernel }}-${{ needs.conf.outputs.tag }}
     build-args: |
          "KERNEL_VER=${{ matrix.kernel }}"
          "KERNEL_IMAGE_TAG=${{ matrix.kernel }}-${{ needs.conf.outputs.tag }}"
     check-files: '.'
     base-ref: ${{ github.base_ref }}
     dry-run: ${{ needs.conf.outputs.dry-run == 'y' }}
     apply-patch: root-images.patch
     apply-patch-2: kernel-image-${{ matrix.kernel }}.patch
     patch-cmd: |
         mkdir -p versions/kind
         echo ${{ needs.conf.outputs.tag}} > versions/kind/${{ matrix.kernel }}

  complexity-test-images:
    if: ${{ needs.conf.outputs.run == 'y' }}
    needs: [conf, kernel-images, root-images]
    strategy:
      matrix:
        kernel: ${{ fromJSON(needs.conf.outputs.kvers) }}
    uses: ./.github/workflows/buildx-stage.yaml
    secrets: inherit
    with:
     name: complexity-test-${{ matrix.kernel }}
     build-file: dockerfiles/complexity-test-images
     build-tag: quay.io/lvh-images/complexity-test-ci:${{ matrix.kernel }}-${{ needs.conf.outputs.tag }}
     build-args: |
          "KERNEL_VER=${{ matrix.kernel }}"
          "KERNEL_IMAGE_TAG=${{ matrix.kernel }}-${{ needs.conf.outputs.tag }}"
     check-files: '.'
     base-ref: ${{ github.base_ref }}
     dry-run: ${{ needs.conf.outputs.dry-run == 'y' }}
     apply-patch: root-images.patch
     apply-patch-2: kernel-image-${{ matrix.kernel }}.patch
     patch-cmd: |
         mkdir -p versions/complexity-test
         echo ${{ needs.conf.outputs.tag}} > versions/complexity-test/${{ matrix.kernel }}

  commit-changes:
    if: ${{ needs.conf.outputs.run == 'y' }}
    needs: [conf, root-images, complexity-test-images, kind-images]
    runs-on: ubuntu-latest
    outputs:
      sha: ${{ steps.push.outputs.sha }}
    steps:
      - name: checkout
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}
      - name: download all artifacts
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
           path: /tmp/artifacts
      - name: push new version
        id: push
        run: |
          git switch -c tmp
          git config user.name "GH action"
          git config user.email "ghabot@does.not.exist.cilium.org"
          find /tmp/artifacts -type f ! -size 0 | xargs git am
          git reset --soft ${{ github.event.pull_request.head.ref }}
          git status
          f=$(mktemp)
          echo "GHA: update tags" >> $f
          echo "" >> $f
          git commit -a -F $f --trailer "X-GHA-TAG: ${{ needs.conf.outputs.tag }}"
          git push --force origin HEAD:${{ github.event.pull_request.head.ref }}
          sha=$(git rev-parse HEAD)
          echo "sha=$sha" | tee -a $GITHUB_OUTPUT
      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        env:
          SHA: ${{ steps.push.outputs.sha }}
        with:
          script: |
            const { SHA } = process.env
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: `${ SHA }`,
              description: "Commit was generated",
              state: 'pending',
            })

  print_image_kernels:
    needs: [conf, commit-changes]
    if: ${{ needs.conf.outputs.run == 'y' && needs.commit-changes.result == 'success' &&  needs.conf.outputs.dry-run != 'y' }}
    runs-on: ubuntu-latest
    steps:
      - name: Install LVH cli
        shell: bash
        run: |
          cid=$(docker create quay.io/lvh-images/lvh:latest)
          docker cp $cid:/usr/bin/lvh /tmp/lvh
          docker rm $cid
          chmod +x /tmp/lvh
          sudo mv /tmp/lvh /bin/lvh

      - name: Install dependencies
        run: |
           deps="expect cpu-checker qemu-system-x86"
           n=0
           until [ "$n" -ge 5 ]; do
             success=1
             sudo apt update && \
             sudo apt-get clean && \
             sudo apt-get -y --no-install-recommends install ${deps} && \
             break || success=0
             n=$((n+1))
             sleep 1
           done
           [ $success -eq 1 ] || exit 42

      - name: checkout
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
        with:
          ref: ${{ needs.commit-changes.outputs.sha }}

      - name: versions
        id: versions
        working-directory: ./versions/kind
        run: |
          echo "| Image | kernel version |" > /tmp/image-log
          echo "| --- | --- |" >> /tmp/image-log
          sudo mkdir /_images; sudo chmod 777 /_images
          for f in $(find . -type f ); do
            v=$(basename $f)
            tag=$(cat $f)
            image="quay.io/lvh-images/kind-ci:$v-$tag"
            echo docker run -v /_images:/mnt/images $image cp /data/images/kind_$v.qcow2.zst /mnt/images
            docker run -v /_images:/mnt/images $image cp /data/images/kind_$v.qcow2.zst /mnt/images
            zstd -d /_images/kind_$v.qcow2.zst -o /_images/kind_$v.qcow2
            expect -c "
                      set timeout 60
                      spawn lvh run  --image /_images/kind_$v.qcow2
                      expect -re \"Linux version .*\n\" { exit }
            " | tee /tmp/expect.log
            linux_ver=$(cat /tmp/expect.log | sed -ne 's/^.*Linux version \([^ ]\+\).*$/\1/p')
            echo "| ${image} | ${linux_ver} |" | tee -a /tmp/image-log
            rm /_images/*
          done
          echo 'IMAGE_LOG<<EOF' >> $GITHUB_ENV
          cat /tmp/image-log >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV

      - name: comment
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        if: ${{ github.event.pull_request.number != '' }}
        with:
          script: |
             const { IMAGE_LOG } = process.env
             github.rest.issues.createComment({
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: `👋\nHere are the kernel versions for the images:\n${IMAGE_LOG}\n`
             })

  finalize:
    needs: [conf, commit-changes, print_image_kernels]
    runs-on: ubuntu-latest
    if: ${{ always() }}
    steps:
      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        if: ${{ needs.commit-changes.result == 'success' &&  needs.conf.outputs.dry-run != 'y' }}
        env:
          SHA: ${{ needs.commit-changes.outputs.sha }}
        with:
          script: |
            const { SHA } = process.env
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: `${ SHA }`,
              description: "Images were generated and tags were updated",
              state: 'success',
            })
      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        if: ${{ needs.commit-changes.result == 'success' && needs.conf.outputs.dry-run == 'y' }}
        env:
          SHA: ${{ needs.commit-changes.outputs.sha }}
        with:
          script: |
            const { SHA } = process.env
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: `${ SHA }`,
              description: "Everything went OK, but this was a dry-run. Failing final check.",
              state: 'failure',
            })
      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        if: ${{ needs.commit-changes.result != 'success' && needs.commit-changes.outputs.sha != '' }}
        env:
          SHA: ${{ needs.commit-changes.outputs.sha }}
        with:
          script: |
            const { SHA } = process.env
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: `${ SHA }`,
              description: "Something went wrong and commit was not successful. Failing final check.",
              state: 'failure',
            })