.cirrus.yml

---

# Main collection of env. vars to set for all tasks and scripts.
env:
    # Name of the ultimate destination branch for this CI run, PR or post-merge.
    DEST_BRANCH: "main"
    # Shell used to execute all script commands
    CIRRUS_SHELL: "/bin/bash"
    # No need to go crazy, but grab enough to cover most PRs
    CIRRUS_CLONE_DEPTH: 50
    # Version of packer to use when building images
    PACKER_VERSION: &PACKER_VERSION "1.8.3"
    # Registry/namespace prefix where container images live
    REGPFX: "quay.io/libpod"
    #IMG_SFX = <See IMG_SFX file and .cirrus.star script>
    #IMPORT_IMG_SFX = <See IMPORT_IMG_SFX file and .cirrus.star script>


gcp_credentials: ENCRYPTED[823fdbc2fee3c27fa054ba1e9cfca084829b5e71572f1703a28e0746b1a924ee5860193f931adce197d40bf89e7027fe]

timeout_in: 60m

validate_task:
    name: "Validate"
    alias: "validate"
    only_if: &is_pr $CIRRUS_PR != ''
    timeout_in: 5m
    container: &ci_container
        # Ref: https://cirrus-ci.org/guide/docker-builder-vm/#dockerfile-as-a-ci-environment
        dockerfile: "ci/Containerfile"
        docker_arguments:
            PACKER_VERSION: *PACKER_VERSION
    script:
        - "ci/shellcheck.sh"
        - "ci/validate.sh"


image_builder_task:
    name: "Image-builder image"
    alias: "image_builder"
    only_if: *is_pr
    skip: &ci_docs_tooling |
        $CIRRUS_CHANGE_TITLE =~ '.*CI:DOCS.*' ||
        $CIRRUS_CHANGE_TITLE =~ '.*CI:TOOLING.*'
    depends_on:
        - validate
    # Packer needs time to clean up partially created VM images
    auto_cancellation: $CI != "true"
    stateful: true
    timeout_in: 50m
    container:
        dockerfile: "image_builder/Containerfile"
        cpu: 2
        memory: "2G"
        docker_arguments:
            PACKER_VERSION: *PACKER_VERSION
    env:
      PACKER_BUILDS: 'image-builder'
      # Google Application Credentials (JSON) with access to create VM images
      GAC_JSON: ENCRYPTED[7fba7fb26ab568ae39f799ab58a476123206576b0135b3d1019117c6d682391370c801e149f29324ff4b50133012aed9]
      AWS_SHARED_CREDENTIALS_FILE: notused
    script: "ci/make.sh image_builder"
    manifest_artifacts:
        path: image_builder/manifest.json
        type: application/json


container_images_task: &container_images
    alias: "container_images"
    only_if: *is_pr
    skip: *ci_docs_tooling
    depends_on:
        - image_builder
    timeout_in: &cntr_timeout 40m
    gce_instance: &ibi_vm
        image_project: "libpod-218412"
        # Trust whatever was built most recently is functional
        image_family: "image-builder"
        zone: "us-central1-a"
        disk: 200  # Must be 200, negatively affects performance otherwise.
    matrix:
        - name: &name "Build ${TARGET_NAME} container"
          env:
            TARGET_NAME: 'fedora_podman'
            # Add a 'c' to the tag for consistency with VM Image names
            DEST_FQIN: &fqin '${REGPFX}/${TARGET_NAME}:c$IMG_SFX'
        - name: *name
          env:
            TARGET_NAME: 'prior-fedora_podman'
            DEST_FQIN: *fqin
        - name: *name
          env:
            TARGET_NAME: 'skopeo_cidev'
            DEST_FQIN: *fqin
        # Upgrading from stable -> SID fails for container-images
        # TODO: Re-enable once fixed
        # - name: *name
        #   env:
        #     TARGET_NAME: 'debian'
        #     DEST_FQIN: *fqin
    env: &image_env
        # For $REGPFX namespace, select FQINs only.
        REG_USERNAME: ENCRYPTED[df4efe530b9a6a731cfea19233e395a5206d24dfac25e84329de035393d191e94ead8c39b373a0391fa025cab15470f8]
        REG_PASSWORD: ENCRYPTED[255ec05057707c20237a6c7d15b213422779c534f74fe019b8ca565f635dba0e11035a034e533a6f39e146e7435d87b5]
    script: ci/make_container_images.sh;
    package_cache: &package_cache
        folder: "/var/tmp/automation_images_tmp/.cache/**"
        fingerprint_key: "${TARGET_NAME}-cache-version-1"


# Most other tooling images depend on this one, build it first so the others
# may build in parallel.
imgts_build_task:
    alias: imgts_build
    name: 'Build IMGTS image'
    only_if: *is_pr
    skip: &ci_docs $CIRRUS_CHANGE_TITLE =~ '.*CI:DOCS.*'
    depends_on:
        - image_builder
    timeout_in: *cntr_timeout
    gce_instance: *ibi_vm
    env: *image_env
    script: |
        export TARGET_NAME=imgts
        export DEST_FQIN="${REGPFX}/${TARGET_NAME}:c${IMG_SFX}";
        ci/make_container_images.sh;


tooling_images_task:
    alias: tooling_images
    name: 'Build Tooling image ${TARGET_NAME}'
    only_if: *is_pr
    skip: *ci_docs
    depends_on:
        - imgts_build
    timeout_in: *cntr_timeout
    gce_instance: *ibi_vm
    env: *image_env
    matrix:
      - env:
          TARGET_NAME: imgobsolete
      - env:
          TARGET_NAME: imgprune
      - env:
          TARGET_NAME: gcsupld
      - env:
          TARGET_NAME: get_ci_vm
      - env:
          TARGET_NAME: orphanvms
      - env:
          TARGET_NAME: ccia
    script: |
        export DEST_FQIN="${REGPFX}/${TARGET_NAME}:c${IMG_SFX}";
        ci/make_container_images.sh;

base_images_task:
    name: "Build VM Base-images"
    alias: "base_images"
    only_if: *is_pr
    skip: *ci_docs_tooling
    depends_on:
        - container_images
        - image_builder
    # Packer needs time to clean up partially created VM images
    auto_cancellation: $CI != "true"
    stateful: true
    timeout_in: 70m
    gce_instance: *ibi_vm
    matrix:
        - &base_image
          name: "${PACKER_BUILDS} Base Image"
          gce_instance: &nested_virt_vm
              <<: *ibi_vm
              # Nested-virt is required, need Intel Haswell or better CPU
              enable_nested_virtualization: true
              type: "n2-standard-16"
              scopes: ["cloud-platform"]
          env:
            PACKER_BUILDS: "fedora"
        - <<: *base_image
          gce_instance: *nested_virt_vm
          env:
            PACKER_BUILDS: "prior-fedora"
        - <<: *base_image
          env:
            PACKER_BUILDS: "fedora-aws"
        - <<: *base_image
          env:
            PACKER_BUILDS: "fedora-aws-arm64"
        - <<: *base_image
          env:
            PACKER_BUILDS: "debian"
    env:
      GAC_JSON: &gac_json ENCRYPTED[7fba7fb26ab568ae39f799ab58a476123206576b0135b3d1019117c6d682391370c801e149f29324ff4b50133012aed9]
      AWS_INI: &aws_ini ENCRYPTED[4cd69097cd29a9899e51acf3bbacceeb83cb5c907d272ca1e2a8ccd515b03f2368a0680870c0d120fc32bc578bb0a930]
      AWS_MAX_ATTEMPTS: 300
      AWS_TIMEOUT_SECONDS: 3000
    script: "ci/make.sh base_images"
    manifest_artifacts:
        path: base_images/manifest.json
        type: application/json


cache_images_task:
    name: "Build VM Cache-images"
    alias: "cache_images"
    only_if: *is_pr
    skip: *ci_docs_tooling
    depends_on:
        - image_builder
        - base_images
    # Packer needs time to clean up partially created VM images
    auto_cancellation: $CI != "true"
    stateful: true
    timeout_in: 90m
    container:
        dockerfile: "image_builder/Containerfile"
        cpu: 2
        memory: "2G"
        docker_arguments:
            PACKER_VERSION: *PACKER_VERSION
    matrix:
        - &cache_image
          name: "${PACKER_BUILDS} Cache Image"
          env:
            PACKER_BUILDS: "fedora"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "prior-fedora"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "rawhide"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "fedora-netavark"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "fedora-podman-py"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "fedora-aws"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "fedora-netavark-aws-arm64"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "fedora-podman-aws-arm64"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "build-push"
        - <<: *cache_image
          env:
            PACKER_BUILDS: "debian"
    env:
      GAC_JSON: *gac_json
      AWS_INI: *aws_ini
      AWS_MAX_ATTEMPTS: 300
      AWS_TIMEOUT_SECONDS: 3000
    script: "ci/make.sh cache_images"
    manifest_artifacts:
        path: cache_images/manifest.json
        type: application/json


# Builds Windows server VMs for CI
# Currently this produces a single Win 2022 Server Base image with WSL enabled
win_images_task:
    name: "Build VM Win-images"
    alias: "win_images"
    only_if: *is_pr
    skip: *ci_docs_tooling
    depends_on:
        - 'validate'
    # Packer needs time to clean up partially created VM images
    auto_cancellation: $CI != "true"
    stateful: true
    # Packer WinRM communicator is not reliable on container tasks
    gce_instance:
        <<: *ibi_vm
    env:
      PACKER_BUILDS: "win-server-wsl"
      GAC_JSON: *gac_json
      AWS_INI: *aws_ini
    script: "ci/make.sh win_images"
    manifest_artifacts:
        path: win_images/manifest.json
        type: application/json

# These targets are intended for humans, make sure they builds and function on a basic level
test_debug_task:
    name: "Test ${TARGET} make target"
    alias: test_debug
    only_if: *is_pr
    skip: *ci_docs
    depends_on:
        - validate
    gce_instance: *nested_virt_vm
    matrix:
        - env:
            TARGET: ci_debug
        - env:
            TARGET: image_builder_debug
    env:
        HOME: "/root"
        GAC_FILEPATH: "/dev/null"
        AWS_SHARED_CREDENTIALS_FILE: "/dev/null"
        DBG_TEST_CMD: "true"
    script: make ${TARGET}

# Test metadata addition to images (built or not) to ensure container functions
test_imgts_task: &imgts
    name: "Test image timestamp/metadata updates"
    alias: test_imgts
    only_if: *is_pr
    skip: *ci_docs
    depends_on: &imgts_deps
        - base_images
        - cache_images
        - imgts_build
    container:
        image: '${REGPFX}/imgts:c$IMG_SFX'
        cpu: 2
        memory: '2G'
    env: &imgts_env
        DRY_RUN: 1  # Don't actually touch images
        BUILDID: "$CIRRUS_BUILD_ID"
        REPOREF: "$CIRRUS_REPO_NAME"
        GCPJSON: "gobldygook"
        GCPNAME: "TestyMcTestface"
        GCPPROJECT: "Amazon-web-services"
        AWSINI: "Bill Gates"
        # This task is just a test, but were images actually built
        # the `imgts_task` below will re-use these names and actually
        # attempt to update them.
        IMGNAMES: |
            image-builder-${IMG_SFX}
            fedora-b${IMG_SFX}
            prior-fedora-b${IMG_SFX}
            debian-b${IMG_SFX}
            fedora-c${IMG_SFX}
            prior-fedora-c${IMG_SFX}
            fedora-netavark-c${IMG_SFX}
            fedora-podman-py-c${IMG_SFX}
            rawhide-c${IMG_SFX}
            debian-c${IMG_SFX}
            build-push-c${IMG_SFX}
        EC2IMGNAMES: |
            fedora-aws-i${IMPORT_IMG_SFX}
            fedora-aws-b${IMG_SFX}
            fedora-aws-c${IMG_SFX}
            fedora-aws-arm64-i${IMPORT_IMG_SFX}
            fedora-aws-arm64-b${IMG_SFX}
            fedora-podman-aws-arm64-c${IMG_SFX}
            fedora-netavark-aws-arm64-c${IMG_SFX}
    clone_script: &noop mkdir -p "${CIRRUS_WORKING_DIR}"  # source is not needed
    script: "/usr/local/bin/entrypoint.sh"


# Actual metadata update to any built images
imgts_task:
    <<: *imgts
    name: "Update image timestamp/metadata"
    alias: imgts
    only_if: *is_pr
    skip: *ci_docs_tooling
    depends_on: *imgts_deps
    env:
        <<: *imgts_env
        DRY_RUN: 0
        # Not all $IMGNAMES may have been built, don't fail if some are missing
        # This should ONLY be set `0` on this repository!  There may be
        # zero or more no_FOO labels on the PR to block building certain images.
        REQUIRE_ALL: 0  # This should ONLY be set `0` on this repository!
        GCPJSON: ENCRYPTED[112c55192dba9a7edd1889a7e704aa1e6ae40730b97ad8ebcbae2bb5f4ff84c7e9ca5b955baaf1f69e7b9e5c5a14a4d3]
        GCPNAME: ENCRYPTED[93cad237544dbbd663874e6896cd9c50a708e87d2cd40724c8b6c18237f4e2d40fd5e3c4a1fdbf7dafac3ceadf69a1c1]
        GCPPROJECT: 'libpod-218412'
        AWSINI: ENCRYPTED[406795b7eee55fcedde37e0b4d7a5070f447f7dc9d8d6c4a1eec0d2592aa94b019b45b730ba1a2acb1a1ef0040561e2b]


test_imgobsolete_task: &lifecycle_test
    name: "Test obsolete image detection"
    alias: test_imgobsolete
    only_if: *is_pr
    skip: *ci_docs
    depends_on:
        - tooling_images
        - imgts
    container:
        image: '${REGPFX}/imgobsolete:c$IMG_SFX'
        cpu: 2
        memory: '2G'
    env: &lifecycle_env
        GCPJSON: ENCRYPTED[a0482ce379d4fa3ea84b3fd6199cce75294262a65250c08ec9a5c454cbba06b7b55c8cdb43bbab2f6a81f3419096200e]
        GCPNAME: ENCRYPTED[57b2c60b8168a2dc6f281a31a051ffab069b3c05bd495f38c0d5178fdcfb9ac7e1295460d8c4beb979c88d88061fa463]
        GCPPROJECT: 'libpod-218412'
        AWSINI: ENCRYPTED[0215d4bb3572d35351ddcffeee5f4103ee1baa07ef0de95a7cd92dae27c4a655dd7116f8f710c8e1820c704b6a7e9179]
        DRY_RUN: 1
    clone_script: *noop
    script:  /usr/local/bin/entrypoint.sh


# Note: The production check using this container is defined in
# .github/workflows/orphan_vms.yml because it sends e-mail.
test_orphanvms_task:
    <<: *lifecycle_test
    name: "Test orphan VMs detection"
    alias: test_orphanvms
    container:
        image: '$REGPFX/orphanvms:c$IMG_SFX'
        cpu: 2
        memory: '2G'
    env:
        GCPJSON: ENCRYPTED[da5e70861e477e5b7e499381b90c4dfd915c91bd535e56564626565415258e42748dbf3031daf0e508647715b649aff7]
        GCPNAME: ENCRYPTED[cfb1c7fc976ab83c8d9b32ca3fbcdf4c5bd7b11dd43ff2b8ad91685bed846e8a5502ba857a35f8128a9fba22a85384aa]
        GCPPROJECT: 'libpod-218412'
        GCPPROJECTS: 'libpod-218412' # value for testing, otherwise see gcpprojects.txt
        AWSINI: ENCRYPTED[1ab89ff7bc1515dc964efe7ef6e094e01164ba8dd2e11c9a01259c6af3b3968ab841dbe473fe4ab5b573f2f5fa3653e8]
        DRY_RUN: 1
        EVERYTHING: 1  # Alter age-limit from 3-days -> 3 seconds for a test-run.
    script: /usr/local/bin/entrypoint.sh


test_imgprune_task:
    <<: *lifecycle_test
    name: "Test obsolete image removal"
    alias: test_imgprune
    depends_on:
        - tooling_images
        - imgts
    container:
        image: '$REGPFX/imgprune:c$IMG_SFX'


test_gcsupld_task:
    name: "Test uploading to GCS"
    alias: test_gcsupld
    only_if: *is_pr
    skip: *ci_docs
    depends_on:
        - tooling_images
        - imgts
    container:
        image: '$REGPFX/gcsupld:c$IMG_SFX'
        cpu: 2
        memory: '2G'
    env:
        GCPJSON: ENCRYPTED[e7883347ea7357958d5ee025913d9204fdd2ed566994dd512af4c25523bf7284738586f8aa17aff1b8e920a6de56a6e9]
        GCPNAME: ENCRYPTED[77a24c0e75505c8eced8ed4ac9030a6d8c4b1e0987616c80f54d6b58ab0837dcef0f80e26a47fffdb0816d2b92100c78]
        GCPPROJECT: 'libpod-218412'
    test_script: "gcsupld/test.sh"


test_get_ci_vm_task:
    name: "Test get_ci_vm entrypoint"
    alias: test_get_ci_vm
    only_if: *is_pr
    skip: *ci_docs
    depends_on:
        - tooling_images
        - imgts
    container:
        image: '$REGPFX/get_ci_vm:c$IMG_SFX'
        cpu: 2
        memory: '2G'
    env:
        TESTING_ENTRYPOINT: true
    test_script: "get_ci_vm/test.sh"


test_ccia_task:
    name: "Test ccia entrypoint"
    alias: test_ccia
    only_if: *is_pr
    skip: *ci_docs
    depends_on:
        - tooling_images
    container:
        image: '$REGPFX/ccia:c$IMG_SFX'
        cpu: 2
        memory: '2G'
    test_script: ./ccia/test.sh


test_build-push_task:
    name: "Test build-push VM functions"
    alias: test_build-push
    only_if: |
        $CIRRUS_PR != '' &&
        $CIRRUS_PR_LABELS !=~ ".*no_build-push.*"
    skip: *ci_docs_tooling
    depends_on:
        - cache_images
    gce_instance:
        image_project: "libpod-218412"
        image_name: build-push-c${IMG_SFX}
        zone: "us-central1-a"
        disk: 200
        # More muscle to emulate multi-arch
        type: "n2-standard-4"
    script: |
        mkdir /tmp/context
        echo -e "FROM scratch\nENV foo=bar\n" > /tmp/context/Containerfile
        source /etc/automation_environment
        A_DEBUG=1 build-push.sh --nopush --arches=amd64,arm64,s390x,ppc64le example.com/foo/bar /tmp/context


tag_latest_images_task:
    alias: tag_latest_images
    name: "Tag latest built container images."
    only_if: |
        $CIRRUS_CRON == '' &&
        $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH
    skip: *ci_docs
    gce_instance: *ibi_vm
    env: *image_env
    script: ci/tag_latest.sh


# N/B: "latest" image produced after PR-merge (branch-push)
cron_imgobsolete_task: &lifecycle_cron
    name: "Periodicly mark old images obsolete"
    alias: cron_imgobsolete
    only_if: $CIRRUS_CRON == 'lifecycle'
    container:
        image: '$REGPFX/imgobsolete:latest'
        cpu: 2
        memory: '2G'
    env:
        <<: *lifecycle_env
        DRY_RUN: 0
    script:  /usr/local/bin/entrypoint.sh;


cron_imgprune_task:
    <<: *lifecycle_cron
    name: "Periodicly delete obsolete images"
    alias: cron_imgprune
    depends_on:
        - cron_imgobsolete
    container:
        image: '$REGPFX/imgprune:latest'


success_task:
    name: &success_name success
    alias: *success_name
    depends_on:
        - validate
        - image_builder
        - container_images
        - tooling_images
        - base_images
        - cache_images
        - win_images
        - test_debug
        - test_imgts
        - imgts
        - test_imgobsolete
        - test_orphanvms
        - cron_imgobsolete
        - test_imgprune
        - cron_imgprune
        - test_gcsupld
        - test_get_ci_vm
        - test_ccia
        - test_build-push
    container:
        <<: *ci_container
    clone_script: *noop
    script: /bin/true