chore: release 0.2.0 #214
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Native Linux E2E | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: e2e-linux-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # 讓所有 JS actions 在 Node 24 上跑（checkout/cache 的 Node 20 已棄用）。 | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| # 可重現 micro-VM appliance 使用的 Linux stable git tag。 | |
| # 可由 repository variable / workflow env 覆寫；script 會把實際 commit 寫入 BUILDINFO。 | |
| CHEFER_LINUX_REF: ${{ vars.CHEFER_LINUX_REF || 'v6.6.32' }} | |
| jobs: | |
| native-linux-e2e: | |
| name: docker save -> chefer build -> single-file run (${{ matrix.name }}) | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: linux-amd64 | |
| runner: ubuntu-latest | |
| - name: linux-arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # 用 runner 的 host 原生 gnu target 建置（免 musl C 交叉工具鏈）。 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Enable unprivileged user namespaces | |
| shell: bash | |
| run: | | |
| if [[ -e /proc/sys/kernel/unprivileged_userns_clone ]]; then | |
| sudo sysctl -w kernel.unprivileged_userns_clone=1 | |
| fi | |
| if [[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]]; then | |
| sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true | |
| fi | |
| - name: Install GUI E2E tools | |
| run: sudo apt-get update && sudo apt-get install -y xvfb x11-utils weston wayland-utils | |
| # passt 提供 pasta：網路隔離 E2E 的 bridge 情境（出網 NAT）需要它； | |
| # 缺少時 linux-e2e.sh 會跳過 bridge 斷言（internal 隔離仍會驗證）。 | |
| - name: Install pasta (passt) for bridge networking E2E | |
| run: sudo apt-get install -y passt | |
| # podman 讓 `source: dockerfile` 的 E2E 多測一條「非-docker、docker 相容 CLI」builder。 | |
| # linux-e2e.sh 偵測到 podman 就會以 CHEFER_DOCKERFILE_BUILDER=podman 再 build 一次。 | |
| - name: Install podman for non-docker Dockerfile builder E2E | |
| run: sudo apt-get install -y podman | |
| - name: Docker info | |
| run: docker info | |
| - name: Run native Linux E2E | |
| shell: bash | |
| env: | |
| CHEFER_E2E_GUI: "1" | |
| run: bash scripts/linux-e2e.sh | |
| overlay-rootfs-root-test: | |
| name: overlay rootfs == merge tree, as root (${{ matrix.name }}) | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: linux-amd64 | |
| runner: ubuntu-latest | |
| - name: linux-arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: overlay-root-${{ matrix.name }} | |
| # overlay_view_matches_merge 需要 real root（mknod whiteout char dev + mount overlay）， | |
| # 一般 `cargo test` 以非 root 跑會自動跳過。這裡先把 lib 測試二進位「只編不跑」， | |
| # 再以 sudo 單獨實跑這個測試 —— 驗證 overlay 合成的 rootfs 與既有合併路徑逐檔一致。 | |
| - name: Build guest-agent lib test binary | |
| shell: bash | |
| run: | | |
| cargo test -p guest-agent --lib --no-run --message-format=json \ | |
| | jq -r 'select(.reason == "compiler-artifact" and .profile.test == true and (.target.kind | index("lib"))) | .executable' \ | |
| | grep . > test-binaries.txt | |
| cat test-binaries.txt | |
| - name: Run overlay-vs-merge test as root | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| out="$(mktemp)" | |
| while IFS= read -r bin; do | |
| echo "== running overlay test in: $bin ==" | |
| # --exact + 完整測試路徑；--nocapture 讓跳過/差異/成功標記可見。 | |
| sudo "$bin" --exact --nocapture \ | |
| rootfs::linux_tests::overlay_view_matches_merge 2>&1 | tee -a "$out" | |
| done < test-binaries.txt | |
| # 防假陽性：root 下必須實跑（出現 OK 標記），且不得靜默跳過。 | |
| if grep -q "skip overlay_view_matches_merge" "$out"; then | |
| echo "::error::overlay test skipped under root — overlay unsupported on this runner; cannot claim verification" | |
| exit 1 | |
| fi | |
| if ! grep -q "overlay_view_matches_merge: OK" "$out"; then | |
| echo "::error::overlay test did not emit its success marker — it may not have run" | |
| exit 1 | |
| fi | |
| qemu-appliance-e2e: | |
| name: appliance QEMU E2E (${{ matrix.name }}) | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 180 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: linux-amd64 | |
| runner: ubuntu-latest | |
| guest_target: x86_64-unknown-linux-musl | |
| - name: linux-arm64 | |
| runner: ubuntu-24.04-arm | |
| guest_target: aarch64-unknown-linux-musl | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.guest_target }} | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: qemu-${{ matrix.name }} | |
| - name: Install QEMU and virtiofs tools | |
| shell: bash | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y qemu-system-x86 qemu-system-arm qemu-utils | |
| sudo apt-get install -y virtiofsd || true | |
| if ! command -v virtiofsd >/dev/null 2>&1 && [[ ! -x /usr/lib/qemu/virtiofsd ]]; then | |
| echo "::error::virtiofsd is required for QEMU appliance E2E" | |
| exit 1 | |
| fi | |
| # virtiofsd 以 `--sandbox namespace`（uid-map 的前提）需要非特權 user namespaces； | |
| # Ubuntu 24.04 預設以 apparmor 限制，這裡放行（與 native E2E job 一致）。 | |
| - name: Enable unprivileged user namespaces | |
| shell: bash | |
| run: | | |
| if [[ -e /proc/sys/kernel/unprivileged_userns_clone ]]; then | |
| sudo sysctl -w kernel.unprivileged_userns_clone=1 | |
| fi | |
| if [[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]]; then | |
| sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true | |
| fi | |
| - name: Docker info | |
| run: docker info | |
| # 把預編的 appliance（kernel + initramfs）放到 $HOME 下的穩定路徑，並快取之； | |
| # qemu-e2e.sh 認得 CHEFER_QEMU_APPLIANCE_DIR：存在就重用、不存在才以 | |
| # build-appliance.sh 重建（約 10 分鐘的 kernel build）。快取命中時整個 E2E 約 3 分鐘。 | |
| - name: Resolve appliance cache dir | |
| shell: bash | |
| run: echo "CHEFER_QEMU_APPLIANCE_DIR=$HOME/.cache/chefer-appliance" >> "$GITHUB_ENV" | |
| - name: Cache appliance (kernel + initramfs) | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.cache/chefer-appliance | |
| key: appliance-${{ matrix.name }}-${{ env.CHEFER_LINUX_REF }}-${{ hashFiles('scripts/build-appliance.sh', 'scripts/appliance/**') }} | |
| - name: Run QEMU appliance E2E | |
| shell: bash | |
| run: bash scripts/qemu-e2e.sh |