Skip to content

ci: Build ROM release from versioned git ref (revive) #1907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 18 commits into
base: main
Choose a base branch
from
Open

ci: Build ROM release from versioned git ref (revive) #1907

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
a8417c5
ci: Build ROM release from versioned git ref
benjamindoron Jul 4, 2024
6859a34
ci: refacor build_release.sh
leongross Jan 24, 2025
fa3643d
ci: add re-usable github workflow to build rom and fw
leongross Jan 31, 2025
0fc9843
ci: integrate versioned-checkout to to fpga.yml and fw-test-emu.yml and
leongross Jan 31, 2025
1e3600c
ci: use composite workflow instead of action
leongross Feb 3, 2025
28e8444
ci: update workflow triggers
leongross Mar 21, 2025
992e601
ci: add versioned-checkout test workflow
leongross Mar 21, 2025
a6befd0
ci: debug artifact transfer
leongross Mar 21, 2025
bc244c7
ci: add artifacts-suffix for workflow artifact uniquenes
leongross Mar 21, 2025
e1b4d57
cleanup
leongross Mar 28, 2025
fde2582
ci: export RTL_VERSION and ITRNG to get picked up
leongross Mar 31, 2025
e6c4b43
hw: add file checks in fpga_configuration
leongross Mar 31, 2025
d848cf2
ci: check fi hw-version is set properly
leongross Mar 31, 2025
5a18c4c
ci: enable emulator versioned checkout
leongross Mar 31, 2025
95f5d63
swemu: wait for versioned checkout
leongross Apr 10, 2025
04ab844
ci: remove old firmware test paths
leongross Apr 17, 2025
82d74f7
ci: debug file sizes and install missing rust dependecies
leongross Apr 24, 2025
7a3fe84
Use Rust stable version 1.70 to match 'rust-toolchain.toml'
clundin25 May 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 64 additions & 31 deletions .github/workflows/fpga.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ name: FPGA Build
on:
push:
branches: ["main"]
pull_request:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should keep the PR check for FPGAs, is this change intentional?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No this was not intentional, I will revert this change.

workflow_call:
inputs:
artifact-suffix:
Expand All @@ -25,6 +24,12 @@ on:
rom-version:
default: "latest"
type: string
rom-ref:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think ultimately our goal is for the nightly release workflow to be runnable with specified ROM & FW refs. Would it make sense to try to factor out some of the steps in this file so it can be reused in the nightly one as well?

Not sure if that would improve things or just make the CI more confusing.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO only the nightly should do this, I think the load would be too high for PRs.

default: "main"
type: string
fw-ref:
default: "main"
type: string
workflow_call:
description: 'Set true for workflow_call'
default: true
Expand All @@ -42,7 +47,6 @@ on:
default: '["caliptra-fpga"]'
type: string


jobs:
check_cache:
runs-on: ubuntu-22.04
Expand Down Expand Up @@ -106,9 +110,21 @@ jobs:
path: /tmp/caliptra-fpga-kmod/
retention-days: 1

# this workflow uploads a file named caliptra-unified-<rom-ref>-<fw-ref>-<hw-version>-<artifact-suffix>
versioned-checkout-build:
uses: ./.github/workflows/versioned-checkout.yml
with:
rom-ref: "${{ inputs.rom-ref }}"
rom-logging: "${{ inputs.rom-logging }}"
fw-ref: "${{ inputs.fw-ref }}"
hw-version: "${{ inputs.hw-version }}"
workflow_call: "${{ inputs.workflow_call }}"
artifact-suffix: "${{ inputs.artifact-suffix }}"
Comment on lines +113 to +122
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible to isolate the FPGA jobs to the nightly run?

I think running all of these tests on each PR will effectively DDOS the FPGA infra.


build_test_binaries:
runs-on: [e2-standard-8]
timeout-minutes: 60
needs: versioned-checkout-build

env:
# Change this to a new random value if you suspect the cache is corrupted
Expand All @@ -127,6 +143,12 @@ jobs:
path: /tmp/caliptra-fpga-sysroot.tar
key: sysroot-v9-${{ env.CACHE_BUSTER }}

- name: Extract Versioned ROM and FMC/RT
uses: actions/download-artifact@v4
with:
# defined in versioned-checkout.yml, files will be moved to /tmp/caliptra
name: caliptra-unified-${{ inputs.rom-ref }}-${{ inputs.fw-ref }}-${{ inputs.hw-version }}-${{ inputs.artifact-suffix }}

- name: Extract sysroot
if: "steps.restore_sysroot_cache.outputs.cache-hit"
run: |
Expand All @@ -137,7 +159,7 @@ jobs:
run: |
sudo apt-get update -qy && sudo apt-get -y install debootstrap binfmt-support qemu-user-static u-boot-tools

- name: build sysroot
- name: Build sysroot
# Note: This is the sysroot for the tiny debian installation we run on the FPGA;
# it is missing xilinx-provided kernel headers needed to build kernel modules
if: "!steps.restore_sysroot_cache.outputs.cache-hit"
Expand All @@ -146,7 +168,7 @@ jobs:
sudo debootstrap --include linux-libc-dev --arch arm64 --foreign bookworm /tmp/caliptra-fpga-sysroot
sudo chroot /tmp/caliptra-fpga-sysroot /debootstrap/debootstrap --second-stage

# Remove unnecesary files
# Remove unnecessary files
sudo find /tmp/caliptra-fpga-sysroot/ \( -type d -and ! -perm -o=r \) -prune -exec rm -rf {} \;
sudo find /tmp/caliptra-fpga-sysroot/ \( -type d -and ! -perm -o=x \) -prune -exec rm -rf {} \;
sudo find /tmp/caliptra-fpga-sysroot/ \( ! -perm -o=r \) -exec rm -f {} \;
Expand Down Expand Up @@ -179,9 +201,10 @@ jobs:
else
FEATURES=fpga_realtime,itrng
fi
if [[ "${{ inputs.workflow_call }}" && "${{ inputs.hw-version }}" != "latest" ]]; then
if [[ "${{ inputs.workflow_call }}" && -n "${{ inputs.hw-version }}" && "${{ inputs.hw-version }}" != "latest" ]]; then
FEATURES=$FEATURES,hw-${{ inputs.hw-version }}
fi

cargo nextest archive \
--features=${FEATURES} \
--release \
Expand All @@ -199,22 +222,13 @@ jobs:
path: /tmp/caliptra-test-binaries.sqsh
retention-days: 1

- name: Build test firmware
run: |
mkdir /tmp/caliptra-test-firmware

FEATURES=""
if [[ "${{ inputs.workflow_call }}" && "${{ inputs.hw-version }}" != "latest" ]]; then
FEATURES=hw-${{ inputs.hw-version }}
fi
cargo run --release -p caliptra-builder --features=${FEATURES} -- --all_elfs /tmp/caliptra-test-firmware

- name: 'Upload test firmware artifact'
uses: actions/upload-artifact@v4
with:
name: caliptra-test-firmware${{ inputs.artifact-suffix }}
path: /tmp/caliptra-test-firmware
retention-days: 1
# This is replaced by claiptra-unified-${{ inputs.rom-ref }}-${{ inputs.fw-ref }}-${{ inputs.hw-version }}-${{ inputs.artifact-suffix }}
# - name: 'Upload test firmware artifact'
# uses: actions/upload-artifact@v4
# with:
# name: caliptra-test-firmware${{ inputs.artifact-suffix }}
# path: /tmp/caliptra-test-firmware
# retention-days: 1

build_kernel_modules:
runs-on: ubuntu-22.04
Expand Down Expand Up @@ -290,6 +304,10 @@ jobs:
uses: actions/checkout@v3
with:
submodules: 'true'

- name: Pull dpe submodule
run: |
git submodule update --init dpe
Comment on lines 306 to +310
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
submodules: 'true'
- name: Pull dpe submodule
run: |
git submodule update --init dpe
submodules: 'recursive'

Looks like a few places could use this pattern to remove a step.


- name: Mount FPGA tools
run: |
Expand All @@ -302,14 +320,14 @@ jobs:
cd hw/fpga
mkdir caliptra_build
if [ "${{ inputs.fpga-itrng }}" == "false" ]; then
ITRNG=FALSE
export ITRNG=FALSE
else
ITRNG=TRUE
export ITRNG=TRUE
fi
if [ "${{ inputs.workflow_call }}" ]; then
RTL_VERSION="${{ inputs.hw-version }}"
export RTL_VERSION="${{ inputs.hw-version }}"
else
RTL_VERSION="latest"
export RTL_VERSION="latest"
fi
/fpga-tools/Xilinx/Vivado/2022.2/bin/vivado -mode batch -source fpga_configuration.tcl -tclargs BUILD=TRUE ITRNG=${ITRNG} RTL_VERSION=${RTL_VERSION}
if [ ! -f caliptra_build/caliptra_fpga.bin ]; then
Expand Down Expand Up @@ -381,11 +399,11 @@ jobs:
name: caliptra-test-binaries${{ inputs.artifact-suffix }}
path: /tmp/caliptra-test-binaries.sqsh

- name: 'Download Test Firmware Artifact'
uses: actions/download-artifact@v4
with:
name: caliptra-test-firmware${{ inputs.artifact-suffix }}
path: /tmp/caliptra-test-firmware
# - name: 'Download Test Firmware Artifact'
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove commented code from PR

# uses: actions/download-artifact@v4
# with:
# name: caliptra-test-firmware${{ inputs.artifact-suffix }}
# path: /tmp/caliptra-test-firmware

- name: Mount binaries
run: |
Expand Down Expand Up @@ -425,12 +443,27 @@ jobs:
- name: Set clock rate
run: |
sudo bash -c 'echo 20000000 > /sys/bus/platform/drivers/xilinx_fclk/fclk0/set_rate'

- name: Extract Versioned ROM and FMC/RT
uses: actions/download-artifact@v4
with:
# defined in versioned-checkout.yml, files will be moved to /tmp/caliptra
name: caliptra-unified-${{ inputs.rom-ref }}-${{ inputs.fw-ref }}-${{ inputs.hw-version }}-${{ inputs.artifact-suffix }}
path: /tmp/caliptra-unified

- name: Debug List Downloads
run: |
ls -laR /tmp/caliptra-*

- name: Execute tests
run: |
export RUST_TEST_THREADS=1
CALIPTRA_ARTIFACTS_PATH=caliptra-unified-${{ inputs.rom-ref }}-${{ inputs.fw-ref }}-${{ inputs.hw-version }}-${{ inputs.artifact-suffix }}
TEST_BIN=/tmp/caliptra-test-binaries
VARS="CPTRA_UIO_NUM=4 CALIPTRA_PREBUILT_FW_DIR=/tmp/caliptra-test-firmware CALIPTRA_IMAGE_NO_GIT_REVISION=1"
VARS="CPTRA_UIO_NUM=4 "
VARS+="CALIPTRA_PREBUILT_FW_DIR=/tmp/caliptra-unified/ "
VARS+="CALIPTRA_PREBUILT_ROM_BIN=/tmp/caliptra-unified/caliptra-rom.bin "
VARS+="CALIPTRA_IMAGE_NO_GIT_REVISION=1 "

if [ "${{ inputs.rom-logging }}" == "true" ] || [ -z "${{ inputs.rom-logging }}" ]; then
VARS+=" CPTRA_ROM_TYPE=ROM_WITH_UART"
Expand Down
42 changes: 37 additions & 5 deletions .github/workflows/fw-test-emu.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,31 @@ on:
extra-features:
default:
type: string
rom-ref:
default: "main"
type: string
rom-logging:
default: true
type: boolean
rom-version:
default: "latest"
type: string
fw-ref:
default: "main"
type: string

jobs:
versioned-checkout-build:
uses: ./.github/workflows/versioned-checkout.yml
with:
rom-ref: "${{ inputs.rom-ref }}"
rom-logging: "${{ inputs.rom-logging }}"
fw-ref: "${{ inputs.fw-ref }}"
artifact-suffix: "${{ inputs.artifact-suffix }}"

build_and_test:
runs-on: ubuntu-22.04
needs: versioned-checkout-build

env:
NEXTEST_VERSION: 0.9.63
Expand Down Expand Up @@ -47,19 +62,36 @@ jobs:

- name: Checkout repo
uses: actions/checkout@v3
with:
submodules: 'true'

- name: Pull dpe submodule
run: |
git submodule update --init dpe

- name: Build firmware
run: |
mkdir /tmp/caliptra-test-firmware
cargo run -p caliptra-builder -- --all_elfs /tmp/caliptra-test-firmware
- name: Extract Versioned ROM and FMC/RT
uses: actions/download-artifact@v4
with:
# defined in versioned-checkout.yml, files will be moved to /tmp/caliptra
# there is no hw version definition here because we are running in the emulator, so assume latest
name: caliptra-unified-${{ inputs.rom-ref }}-${{ inputs.fw-ref }}-latest-${{ inputs.artifact-suffix }}
path: /tmp/caliptra-unified

- name: Update rustup
run: |
rustup toolchain install 1.70-x86_64-unknown-linux-gnu
rustup target add riscv32imc-unknown-none-elf --toolchain 1.70-x86_64-unknown-linux-gnu
rustup component add rust-src --toolchain 1.70-x86_64-unknown-linux-gnu
rustup component add --toolchain 1.70-x86_64-unknown-linux-gnu rustfmt
rustup component add --toolchain 1.70-x86_64-unknown-linux-gnu clippy
rustup default 1.70-x86_64-unknown-linux-gnu

- name: Run tests
run: |
export CALIPTRA_PREBUILT_FW_DIR=/tmp/caliptra-test-firmware
export CALIPTRA_PREBUILT_FW_DIR=/tmp/caliptra-unified/
export CALIPTRA_PREBUILT_ROM_BIN=/tmp/caliptra-unified/caliptra-rom.bin
export RUST_BACKTRACE=full

if [ "${{ inputs.rom-version }}" != "latest" ]; then
export CPTRA_CI_ROM_VERSION="${{ inputs.rom-version }}"
fi
Expand Down
14 changes: 14 additions & 0 deletions .github/workflows/nightly-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,17 @@ name: Nightly Release

on:
workflow_dispatch:
inupts:
hw-version:
default: "latest"
type: string
rom-ref:
default: "main"
type: string
firmware-version:
default: "main"
type: string

schedule:
# 2:11 AM PST tuesday-saturday
- cron: '11 10 * * 2-6'
Expand Down Expand Up @@ -385,6 +396,9 @@ jobs:

- name: Generate release zip
run: |
# argc == 1: <release_name>
# argc == 3: <release_name> <rom_ref> <firmware_ref>

Comment on lines +399 to +401
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: This comment is vague. Is it describing the args to build_release.sh?

./ci-tools/release/build_release.sh ${{ needs.find-latest-release.outputs.new_release_tag }}
mv ./release/release.zip ./release/caliptra_${{ needs.find-latest-release.outputs.new_release_tag }}.zip

Expand Down
54 changes: 54 additions & 0 deletions .github/workflows/test-versioned-checkout.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
name: Test Versioned Workflow

on:
workflow_dispatch:
inputs:
hw-version:
default: "latest"
type: string
rom-ref:
default: "main"
type: string
fw-ref:
default: "main"
type: string
artifact-suffix:
default: "test"
type: string
pull_request:
inputs:
hw-version:
default: "latest"
type: string
rom-ref:
default: "main"
type: string
fw-ref:
default: "main"
type: string
artifact-suffix:
default: "test"
type: string
branches:
- main

jobs:
test-versioned-checkout:
uses: ./.github/workflows/versioned-checkout.yml
with:
rom-ref: "main"
rom-logging: false
fw-ref: "main"
hw-version: "latest"
workflow_call: true
artifact-suffix: "test"

get-artifacts:
runs-on: ubuntu-22.04
needs: test-versioned-checkout
steps:
- name: Download caliptra-unified artifact
uses: actions/download-artifact@v4
with:
name: caliptra-unified-main-main-latest-test
path: /tmp/caliptra-unified
Loading
Loading