|
1 | 1 | # Reusable: cross-compile cadence_executor_runner for one Cadence Xtensa core. |
2 | 2 | # |
3 | | -# A native job (not linux_job_v2) because the GitHub OIDC token must be minted on |
4 | | -# the runner host: the ACTIONS_ID_TOKEN_REQUEST_* vars do not cross into |
5 | | -# linux_job_v2's docker exec. So the role is assumed on the host, then the build |
6 | | -# runs inside the CI image via docker run with the creds passed in. Binding the |
| 3 | +# A native job rather than linux_job_v3, because the build has to assume the |
| 4 | +# Cadence artifacts role rather than the role/arc that linux_job_v3 assumes for |
| 5 | +# itself, and only a native job can run configure-aws-credentials. Binding the |
7 | 6 | # environment also gives the OIDC token the environment claim. The licensed |
8 | 7 | # toolchain + core configs are fetched at runtime from an auth-gated store; |
9 | 8 | # role/region/store come from CI variables and are not committed. |
|
23 | 22 | default: "" |
24 | 23 |
|
25 | 24 | jobs: |
| 25 | + # The runner pod pulls the container before any step runs, so the image has to |
| 26 | + # be a fully qualified reference resolved by a job this one depends on. |
| 27 | + docker-image: |
| 28 | + name: Resolve CI docker image |
| 29 | + uses: ./.github/workflows/_docker-image.yml |
| 30 | + |
26 | 31 | build: |
27 | 32 | name: ${{ inputs.backend }} |
28 | | - runs-on: linux.2xlarge |
| 33 | + needs: docker-image |
| 34 | + runs-on: mt-l-x86iavx512-8-64 |
| 35 | + container: |
| 36 | + image: 308535385114.dkr.ecr.us-east-1.amazonaws.com/executorch/ci-image:executorch-ubuntu-22.04-clang12-${{ needs.docker-image.outputs.ci-docker-hash }} |
29 | 37 | environment: cadence |
30 | 38 | permissions: |
31 | 39 | id-token: write |
32 | 40 | contents: read |
33 | 41 | steps: |
| 42 | + - name: Clean workspace |
| 43 | + shell: bash |
| 44 | + run: | |
| 45 | + set -eux |
| 46 | + rm -rf "${GITHUB_WORKSPACE}" |
| 47 | + mkdir -p "${GITHUB_WORKSPACE}" |
| 48 | +
|
34 | 49 | - name: Checkout executorch |
35 | 50 | uses: actions/checkout@v4 |
36 | 51 | with: |
37 | 52 | submodules: recursive |
38 | 53 | ref: ${{ inputs.ref }} |
39 | 54 |
|
40 | | - - name: Calculate docker image |
41 | | - id: calculate-docker-image |
42 | | - uses: pytorch/test-infra/.github/actions/calculate-docker-image@main |
43 | | - with: |
44 | | - docker-image-name: ci-image:executorch-ubuntu-22.04-clang12 |
45 | | - |
46 | | - - name: Pull docker image |
47 | | - run: docker pull "${{ steps.calculate-docker-image.outputs.docker-image }}" |
48 | | - |
49 | | - - name: Assume Cadence artifacts role (host OIDC) |
| 55 | + - name: Assume Cadence artifacts role |
50 | 56 | uses: aws-actions/configure-aws-credentials@v4 |
51 | 57 | with: |
52 | 58 | role-to-assume: ${{ vars.CADENCE_CI_AWS_ROLE }} |
53 | 59 | aws-region: ${{ vars.CADENCE_CI_AWS_REGION }} |
54 | 60 |
|
55 | 61 | - name: Cross-compile cadence_executor_runner |
56 | 62 | env: |
57 | | - DOCKER_IMAGE: ${{ steps.calculate-docker-image.outputs.docker-image }} |
58 | 63 | BACKEND: ${{ inputs.backend }} |
59 | 64 | XTENSA_S3_BUCKET: ${{ vars.CADENCE_CI_S3_BUCKET }} |
60 | 65 | shell: bash |
61 | 66 | run: | |
62 | | - set -eux |
63 | | - # OIDC/role assumption already happened on the host above; pass the |
64 | | - # resulting AWS creds and the store/backend into the CI image, where |
65 | | - # the toolchain download + cross-compile run. |
66 | | - docker run --rm \ |
67 | | - -e BACKEND -e XTENSA_S3_BUCKET \ |
68 | | - -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN \ |
69 | | - -e AWS_DEFAULT_REGION -e AWS_REGION \ |
70 | | - -v "${GITHUB_WORKSPACE}:/work/executorch" -w /work/executorch \ |
71 | | - "${DOCKER_IMAGE}" \ |
72 | | - bash -c ' |
73 | | - set -exo pipefail |
74 | | - eval "$(/opt/conda/bin/conda shell.bash hook)" |
75 | | - conda activate "$(conda env list --json | jq -r ".envs | .[-1]")" |
76 | | - ./install_requirements.sh > /dev/null |
77 | | - pip install --quiet awscli |
78 | | - # hifi4/fusion_g3 optimized kernels need the foss-xtensa nnlib |
79 | | - # sources, which are not vendored in executorch; the cadence |
80 | | - # installer clones them. vision has no nnlib dependency. |
81 | | - if [ "${BACKEND}" != "vision" ]; then |
82 | | - backends/cadence/install_requirements.sh |
83 | | - fi |
84 | | - source .ci/scripts/setup-xtensa-tools.sh "${BACKEND}" |
85 | | - .ci/scripts/build-cadence-xtensa.sh --no-run |
86 | | - chmod -R a+rX cmake-out |
87 | | - ' |
| 67 | + set -exo pipefail |
| 68 | + eval "$(/opt/conda/bin/conda shell.bash hook)" |
| 69 | + conda activate "$(conda env list --json | jq -r ".envs | .[-1]")" |
| 70 | + ./install_requirements.sh > /dev/null |
| 71 | + pip install --quiet awscli |
| 72 | + # hifi4/fusion_g3 optimized kernels need the foss-xtensa nnlib |
| 73 | + # sources, which are not vendored in executorch; the cadence |
| 74 | + # installer clones them. vision has no nnlib dependency. |
| 75 | + if [ "${BACKEND}" != "vision" ]; then |
| 76 | + backends/cadence/install_requirements.sh |
| 77 | + fi |
| 78 | + source .ci/scripts/setup-xtensa-tools.sh "${BACKEND}" |
| 79 | + .ci/scripts/build-cadence-xtensa.sh --no-run |
| 80 | + chmod -R a+rX cmake-out |
88 | 81 |
|
89 | 82 | - name: Upload runner |
90 | 83 | uses: actions/upload-artifact@v4 |
|
0 commit comments