release ateom-microvm image #137
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Google LLC | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| name: pr-workflow | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Weekly run on the default branch keeps the micro-VM asset cache warm (GitHub | |
| # evicts caches idle for 7 days). The push-to-main run populates the cache that | |
| # PRs inherit; this refreshes it so PRs keep hitting it (no asset re-download). | |
| - cron: '37 4 * * 1' | |
| # Nothing here writes to the repository: the jobs check the tree out, build it, | |
| # and run it in a throwaway cluster. | |
| permissions: | |
| contents: read | |
| jobs: | |
| run-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | |
| - name: Setup Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| - run: go test -race -v ./... | |
| # Root-gated tests (overlay mounts, whiteout mknod, trusted.* xattrs, ...) | |
| # skip for the unprivileged runner user above; rerun the packages that | |
| # contain them (any test importing internal/roottest) under sudo. | |
| - name: root-gated tests | |
| run: hack/run-root-tests.sh -race -v | |
| - name: verify | |
| run: hack/verify-all.sh | |
| # One kind cluster exercises BOTH runtimes. Free x86-64 ubuntu-latest runners | |
| # expose /dev/kvm (with a udev rule), so create-kind-cluster.sh mounts it and the | |
| # micro-VM (kata + cloud-hypervisor) sandbox class works alongside gVisor. | |
| e2e-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | |
| - name: Setup Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Cache micro-VM assets | |
| id: microvm-assets | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | |
| with: | |
| # Assembling the assets (download kata-static + cloud-hypervisor + the | |
| # prebuilt virtiofsd — all downloads on amd64) is fully pinned by assemble.sh, | |
| # so key the cache on its hash. The push-to-main run populates the | |
| # default-branch cache PRs inherit; the weekly schedule refreshes it. | |
| # run-microvm-demo-kind.sh skips assembling when these are present. | |
| path: bin/microvm-assets/amd64 | |
| key: microvm-assets-amd64-${{ hashFiles('hack/microvm-assets/assemble.sh') }} | |
| - name: Enable KVM | |
| # Grant the runner access to /dev/kvm so create-kind-cluster.sh mounts it into | |
| # the node and labels it for the micro-VM sandbox class. | |
| run: | | |
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \ | |
| | sudo tee /etc/udev/rules.d/99-kvm4all.rules | |
| sudo udevadm control --reload-rules | |
| sudo udevadm trigger --name-match=kvm | |
| - name: Create cluster | |
| run: hack/create-kind-cluster.sh | |
| - name: Install Agent Substrate | |
| run: hack/install-ate-kind.sh --deploy-ate-system --ateapi-client-auth=cert --store-backend=postgres | |
| - name: Deploy micro-VM counter demo | |
| # Stages the (cached) assets into the cluster's rustfs and applies the | |
| # counter-microvm demo onto the control plane installed above. | |
| run: hack/run-microvm-demo-kind.sh --ateapi-client-auth=cert | |
| - name: Deploy gVisor counter demo | |
| run: hack/install-ate-kind.sh --deploy-demo-counter | |
| - name: Deploy egress demos | |
| # TestActorEgress in the networking suite builds its Actor from the egress | |
| # ActorTemplate for the class under test, so both fixtures have to exist | |
| # before their respective lane runs. | |
| run: | | |
| hack/install-ate-kind.sh --deploy-demo-egress | |
| hack/install-ate-kind.sh --deploy-demo-egress-microvm | |
| - name: Wait for micro-VM golden snapshot | |
| run: | | |
| kubectl --context kind-kind wait --for=condition=Ready \ | |
| actortemplate/counter-microvm -n ate-demo-counter-microvm --timeout=600s | |
| - name: Run E2E tests (gVisor) | |
| run: hack/run-e2e-kind.sh -v -args --no-color | |
| - name: Run E2E tests (micro-VM) | |
| # The same suites again, with every fixture repointed at its micro-VM | |
| # variant by the single E2E_SANDBOX_CLASS knob (see internal/e2e/sandbox.go). | |
| # Sequential with the gVisor lane above, not concurrent: a suite releases | |
| # its namespace — and with it its worker pods — as each test passes, so the | |
| # two runs do not contend for the one kind node. | |
| env: | |
| E2E_SANDBOX_CLASS: microvm | |
| run: hack/run-e2e-kind.sh -v -args --no-color | |
| - name: Dump diagnostics on failure | |
| if: failure() | |
| run: | | |
| kubectl --context kind-kind get actortemplate,workerpool,pods -A -o wide || true | |
| dump() { | |
| echo "=== logs: $1/$2 ===" | |
| kubectl --context kind-kind logs -n "$1" "$2" --all-containers --tail=300 2>/dev/null || true | |
| } | |
| for p in $(kubectl --context kind-kind get pods -n ate-system -o name 2>/dev/null); do | |
| dump ate-system "$p" | |
| done | |
| # Every worker pod in any namespace: the demo pools plus the e2e suites' | |
| # randomly-named per-test namespaces, which the suites keep on failure. | |
| # The failing actor runs in one of these, so this is where its ateom logs | |
| # (and, for a micro-VM worker, the guest console tail) live. | |
| kubectl --context kind-kind get pods -A -l ate.dev/worker-pool \ | |
| -o 'custom-columns=:.metadata.namespace,:.metadata.name' --no-headers 2>/dev/null \ | |
| | while read -r ns name; do dump "$ns" "$name"; done |