Refactor the CI workflows and scripts to make it clearer by Xynnn007 · Pull Request #1219 · confidential-containers/trustee

Xynnn007 · 2026-03-12T03:51:58Z

Our CI surface had grown organically and it was hard to tell which tests ran when, with some e2e paths even executing twice and docs-only changes still triggering heavy jobs. This change separates KBS e2e build from execution, unifies different flows under a single suite, and makes test workflows consistently skip documentation-only pull requests
so that failures are easier to reason about and CI capacity is spent only where it provides signal.

The same logic also applies for the image building process. See concrete commit message.

Copilot

Pull request overview

Refactors the repository CI configuration to reduce duplicated runs and make it clearer which suites execute when, while also unifying build/test entrypoints via a root Makefile and consolidating staged image build/publish workflows.

Changes:

Adds a root Makefile with aggregate targets for unit and e2e suites across KBS / AS / trustee-cli.
Consolidates Rust CI into a single workflow and reorganizes e2e workflows into clearer suites/templates.
Replaces multiple staged-image build/push workflows with reusable workflows + a composite action and a manifest-publish workflow.

Reviewed changes

Copilot reviewed 31 out of 32 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
Makefile	Introduces top-level test/build targets used by CI and local dev.
.github/workflows/workflow-call-publish-staged-manifests.yml	New reusable workflow to publish multi-arch manifests from per-arch tags.
.github/workflows/workflow-call-kbs-e2e.yml	Refactors KBS e2e reusable workflow to separate binary build from execution via artifacts.
.github/workflows/workflow-call-build-staged-images.yml	New reusable workflow to build staged images per component/arch.
.github/workflows/test-rust-ci.yml	New consolidated Rust CI workflow (KBS/AS/trustee-cli).
.github/workflows/test-link-check.yml	Adjusts triggers to skip markdown-only PRs.
.github/workflows/test-e2e-kbs.yml	New KBS e2e suite workflow (sample/vault/docker/azure).
.github/workflows/test-e2e-as.yml	New AS e2e workflow calling the unified Makefile target.
.github/workflows/test-actionlint.yml	Adjusts triggers to skip markdown-only PRs.
.github/workflows/security-codeql.yml	Adds CodeQL scanning workflow.
.github/workflows/release-clis-to-ghcr.yml	New workflow to publish CLI artifacts via ORAS.
.github/workflows/build-and-push-staged-images.yml	New workflow orchestrating staged image builds + manifest publishing.
.github/actions/build-single-image/action.yml	New composite action to build (optionally push) a single-arch staged image.
.github/workflows/trustee-cli-rust.yml	Removed in favor of consolidated Rust CI.
.github/workflows/kbs-rust.yml	Removed in favor of consolidated Rust CI.
.github/workflows/as-rust.yml	Removed in favor of consolidated Rust CI.
.github/workflows/as-e2e.yml	Removed/replaced by `test-e2e-as.yml`.
.github/workflows/kbs-e2e-vault.yml	Removed/replaced by `test-e2e-kbs.yml` suite job.
.github/workflows/kbs-e2e-sample.yml	Removed/replaced by `test-e2e-kbs.yml` suite jobs.
.github/workflows/kbs-e2e-azure-vtpm.yml	Removed/replaced by `test-e2e-kbs.yml` (manual dispatch jobs).
.github/workflows/kbs-docker-e2e.yml	Removed/replaced by `test-e2e-kbs.yml` docker job.
.github/workflows/kbs-docker-build.yml	Removed/replaced by staged image build workflow.
.github/workflows/as-docker-build.yml	Removed/replaced by staged image build workflow.
.github/workflows/push-trustee-cli-to-ghcr.yml	Removed/replaced by `release-clis-to-ghcr.yml`.
.github/workflows/push-kbs-image-to-ghcr.yml	Removed/replaced by staged image workflow + manifest publish.
.github/workflows/push-kbs-client-to-ghcr.yml	Removed/replaced by `release-clis-to-ghcr.yml`.
.github/workflows/push-kbs-client-image-to-ghcr.yml	Removed/replaced by staged image workflow + manifest publish.
.github/workflows/push-as-image-to-ghcr.yml	Removed/replaced by staged image workflow + manifest publish.
.github/workflows/build-trustee-cli.yml	Removed/replaced by staged image workflow patterns.
.github/workflows/build-kbs-image.yml	Removed/replaced by `workflow-call-build-staged-images.yml`.
.github/workflows/build-kbs-client-image.yml	Removed/replaced by `workflow-call-build-staged-images.yml`.
.github/workflows/build-as-image.yml	Removed/replaced by `workflow-call-build-staged-images.yml`.

Comments suppressed due to low confidence (2)

.github/workflows/workflow-call-kbs-e2e.yml:112

make test-kbs-e2e invokes the root Makefile target, which currently depends on kbs-e2e-build (i.e., rebuilds binaries). At this point the job has only extracted Makefile + kbs/test from test.tar.gz, so the rebuild is likely to fail because kbs/test's bins target expects the full repo sources (Cargo workspace, kbs/ Makefile, etc.). Use a run-only target (e.g., make -C kbs/test install-dependencies && make -C kbs/test e2e-test) or introduce a separate root target that runs e2e without rebuilding and call that here.
.github/workflows/test-link-check.yml:8
This link-check workflow now skips PRs that only touch *.md. Since lychee is primarily validating links in documentation and repo text, this change can let broken links in markdown land without CI signal. Consider keeping link-check enabled for markdown-only changes even if heavier suites are skipped.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/build-and-push-staged-images.yml

.github/actions/build-single-image/action.yml

.github/workflows/workflow-call-build-staged-images.yml

Makefile

.github/actions/build-single-image/action.yml

.github/workflows/workflow-call-build-staged-images.yml

+  workflow_call:
+    inputs:
+      image_group:
+        description: "Which image set to build: kbs | as | kbs-client | all"


.github/workflows/test-rust-ci.yml

.github/workflows/test-e2e-kbs.yml

Our CI surface had grown organically and it was hard to tell which tests ran when, with some e2e paths even executing twice and docs-only changes still triggering heavy jobs. This change separates KBS e2e build from execution, unifies Azure and sample flows under a single suite, and makes test workflows consistently skip documentation-only pull requests so that failures are easier to reason about and CI capacity is spent only where it provides signal. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>

Previously each component maintained its own bespoke build-and-push workflow, which duplicated logic, obscured the overall release story, and made it harder to evolve the container layout in a coordinated way. By introducing reusable staged-image templates and a single matrix-driven pipeline for both core services and CLIs, we make GHCR publishing more predictable, easier to audit, and better aligned with how downstream consumers think about Trustee artifacts. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>

The repository carried a large set of narrowly scoped workflows that each targeted a single binary or service, which made the CI surface area noisy and hid the fact that we now have unified staged-image and CLI pipelines. Removing these legacy jobs reduces cognitive overhead for contributors and reviewers, and encourages future changes to be made through the shared, better-documented workflows instead of ad-hoc copies. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>

Actionlint complained because the single-image builder was authored as a composite action but stored under workflows and referenced by its YAML file path, which violates how GitHub expects local actions to be structured. Moving it into .github/actions with a conventional action.yml entrypoint and updating callers to use the directory path aligns with the official model so that linters and runners agree on how the staged-image pipeline is wired. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>

Copilot

Pull request overview

This PR restructures CI by consolidating Rust/unit suites under a single workflow, refactoring KBS/AS e2e workflows into clearer build/run paths, and unifying staged image build/publish logic to reduce duplication and avoid running heavy jobs on docs-only PRs.

Changes:

Introduces a root Makefile as the common entrypoint for unit and e2e test suites across components.
Replaces multiple component-specific workflows with consolidated Rust CI + e2e suite workflows (KBS + AS), and adds CodeQL scanning.
Refactors staged image build/push into reusable workflows and a composite action, with a separate manifest-publish workflow.

Reviewed changes

Copilot reviewed 31 out of 32 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Makefile	Adds aggregated unit/e2e `make` targets used by workflows.
.github/workflows/workflow-call-publish-staged-manifests.yml	New reusable workflow to publish multi-arch manifests from per-arch tags.
.github/workflows/workflow-call-kbs-e2e.yml	Refactors KBS e2e into build-binaries + run stages with archived test artifacts.
.github/workflows/workflow-call-build-staged-images.yml	New reusable workflow to build staged images by group across arches.
.github/workflows/trustee-cli-rust.yml	Removes legacy Trustee CLI Rust CI workflow (superseded by consolidated Rust CI).
.github/workflows/test-rust-ci.yml	New consolidated Rust CI workflow for KBS/AS/Trustee CLI unit checks.
.github/workflows/test-link-check.yml	Updates link-check triggers to skip docs-only PRs.
.github/workflows/test-e2e-kbs.yml	New KBS e2e “suite” orchestrating sample, vault, docker-compose, and manual Azure runs.
.github/workflows/test-e2e-as.yml	New AS e2e workflow invoking root Makefile target.
.github/workflows/test-actionlint.yml	Adjusts Actionlint trigger to skip docs-only PRs.
.github/workflows/security-codeql.yml	Adds CodeQL scanning workflow for Rust.
.github/workflows/release-clis-to-ghcr.yml	New workflow to build/push CLI artifacts to GHCR via ORAS.
.github/workflows/push-trustee-cli-to-ghcr.yml	Removes legacy trustee-cli push workflow (replaced by new CLI release workflow).
.github/workflows/push-kbs-image-to-ghcr.yml	Removes legacy KBS image push workflow (replaced by staged images workflow + manifest publisher).
.github/workflows/push-kbs-client-to-ghcr.yml	Removes legacy kbs-client push workflow (replaced by new CLI release workflow).
.github/workflows/push-kbs-client-image-to-ghcr.yml	Removes legacy kbs-client-image push workflow (replaced by staged images workflow).
.github/workflows/push-as-image-to-ghcr.yml	Removes legacy AS/RVPS push workflow (replaced by staged images workflow + manifest publisher).
.github/workflows/kbs-rust.yml	Removes legacy KBS Rust CI workflow (superseded by consolidated Rust CI).
.github/workflows/kbs-e2e-vault.yml	Removes legacy KBS vault e2e workflow (covered by new KBS e2e suite).
.github/workflows/kbs-e2e-sample.yml	Removes legacy KBS sample e2e workflow (covered by new KBS e2e suite).
.github/workflows/kbs-e2e-azure-vtpm.yml	Removes legacy Azure vTPM KBS e2e workflow (covered by new KBS e2e suite).
.github/workflows/kbs-docker-e2e.yml	Removes legacy KBS docker-compose e2e workflow (covered by new KBS e2e suite).
.github/workflows/kbs-docker-build.yml	Removes legacy KBS docker build workflow (covered by staged images workflow).
.github/workflows/build-trustee-cli.yml	Removes legacy reusable build workflow (superseded by staged images composite action and/or CLI release workflow).
.github/workflows/build-kbs-image.yml	Removes legacy reusable KBS image build workflow (superseded by staged images workflow + composite action).
.github/workflows/build-kbs-client-image.yml	Removes legacy reusable KBS client image build workflow (superseded by staged images workflow + composite action).
.github/workflows/build-as-image.yml	Removes legacy reusable AS/RVPS image build workflow (superseded by staged images workflow + composite action).
.github/workflows/build-and-push-staged-images.yml	New top-level staged images workflow for PR build checks and push publishing.
.github/workflows/as-rust.yml	Removes legacy AS Rust CI workflow (superseded by consolidated Rust CI).
.github/workflows/as-e2e.yml	Removes legacy AS e2e workflow (replaced by new AS e2e workflow invoking root Makefile).
.github/workflows/as-docker-build.yml	Removes legacy AS docker build workflow (covered by staged images workflow).
.github/actions/build-single-image/action.yml	New composite action to build (and optionally push) a single-arch staged image.

Comments suppressed due to low confidence (2)

.github/workflows/workflow-call-kbs-e2e.yml:112

make test-kbs-e2e will invoke the top-level test-kbs-e2e target, which currently pulls in the build step (kbs-e2e-build) and re-runs install-dev-dependencies during the test job. This reintroduces the duplicated/expensive setup the refactor is trying to avoid and can break when only the archived kbs/test artifacts are present. Prefer calling a run-only target here (or invoking make -C kbs/test e2e-test) and keep build/setup exclusively in build-binaries.
.github/workflows/test-link-check.yml:8
This workflow skips on PRs that only change *.md, but the job runs lychee against the repo (including Markdown). With paths-ignore: '**/*.md', Markdown-only doc changes won’t get link validation, which is typically when link checking is most valuable. Consider removing this ignore (or narrowing it to truly non-doc changes) so doc link regressions are still caught.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/test-e2e-kbs.yml

+            ~/.cargo/registry/cache/
+            target/
+          key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}
+


.github/workflows/workflow-call-build-staged-images.yml

+    secrets:
+      GHCR_TOKEN:
+        description: 'GitHub token for GHCR'
+        required: false
+


Makefile

+kbs-e2e-build:
+	$(MAKE) -C kbs/test install-dev-dependencies
+	$(MAKE) -C kbs/test bins TEST_FEATURES="$(TEST_FEATURES)"
+
+test-kbs-e2e: kbs-e2e-build


Makefile

+	openssl genpkey -algorithm ed25519 > kbs/config/private.key
+	openssl pkey -in kbs/config/private.key -pubout -out kbs/config/public.pub
+	docker compose build --build-arg BUILDPLATFORM="$${BUILD_PLATFORM:-linux/amd64}" --build-arg ARCH="$${TARGET_ARCH:-x86_64}" --build-arg VERIFIER="$${VERIFIER:-all-verifier}"
+	docker compose up -d
+	cd target/release && \


.github/workflows/test-e2e-kbs.yml

+            ~/.cargo/registry/cache/
+            target/
+          key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}
+


Xynnn007 force-pushed the combine-ci branch 6 times, most recently from db0a478 to 700d245 Compare March 12, 2026 06:10

Xynnn007 marked this pull request as ready for review March 12, 2026 07:27

Xynnn007 requested a review from a team as a code owner March 12, 2026 07:27

Xynnn007 added github_actions Pull requests that update GitHub Actions code test_e2e Authorize TEE e2e test run labels Mar 12, 2026

Xynnn007 force-pushed the combine-ci branch from 700d245 to 40bd9db Compare March 13, 2026 06:29

Xynnn007 requested a review from Copilot March 13, 2026 06:52

Copilot started reviewing on behalf of Xynnn007 March 13, 2026 06:52 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

Xynnn007 marked this pull request as draft March 13, 2026 07:45

Xynnn007 force-pushed the combine-ci branch from 40bd9db to 3f3e315 Compare March 13, 2026 09:25

Xynnn007 added 3 commits March 13, 2026 17:26

Xynnn007 force-pushed the combine-ci branch from 3f3e315 to a7f28a9 Compare March 13, 2026 09:26

Xynnn007 requested a review from Copilot March 13, 2026 09:26

Copilot started reviewing on behalf of Xynnn007 March 13, 2026 09:26 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refactor the CI workflows and scripts to make it clearer#1219

Refactor the CI workflows and scripts to make it clearer#1219
Xynnn007 wants to merge 4 commits intoconfidential-containers:mainfrom
Xynnn007:combine-ci

Xynnn007 commented Mar 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Xynnn007 commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Xynnn007 commented Mar 12, 2026 •

edited

Loading