containerization-build-template.yml

name: Build containerization template

permissions:
  contents: read

on: 
  workflow_call:
    inputs:
      release:
        type: boolean
        description: "Create a release"
        default: false
      version: 
        type: string
        description: Version of containerization 
        default: test

jobs:
  swift-version:
    name: Determine Swift version
    if: github.repository == 'apple/containerization'
    runs-on: ubuntu-24.04
    outputs:
      image: ${{ steps.version.outputs.image }}
    steps:
      - name: Checkout .swift-version
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6
        with:
          sparse-checkout: .swift-version
          sparse-checkout-cone-mode: false

      - name: Read Swift version
        id: version
        run: echo "image=swift:$(cat .swift-version)-noble" >> "$GITHUB_OUTPUT"

  # Build the guest initfs (vminitd/vmexec compiled static-musl, then packed
  # into initfs.ext4 + a rootfs tar) inside a GitHub-native Swift Linux
  # container (Docker-backed) — NOT via apple/container, which isn't available
  # on GitHub runners. The macOS job below consumes these as an artifact and
  # creates the vminit:latest image natively with cctl. The container job is
  # unprivileged, so build-initfs.sh uses its `mke2fs -d` fallback (no loop
  # mount / no CAP_SYS_ADMIN needed).
  buildGuest:
    name: Build guest initfs
    if: github.repository == 'apple/containerization'
    needs: swift-version
    timeout-minutes: 30
    runs-on: ubuntu-24.04
    container: ${{ needs.swift-version.outputs.image }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6
        with:
          fetch-depth: 0

      - name: Install system dependencies
        run: apt-get update && apt-get install -y curl make e2fsprogs libarchive-dev libbz2-dev liblzma-dev libssl-dev

      - name: Install Static Linux SDK
        run: make -C vminitd linux-sdk

      - name: Build vminitd (static musl, aarch64)
        # Force aarch64 even though this runner is x86_64: the macOS buildAndTest
        # job boots arm64 VZ VMs, so vminitd (PID 1) must be an aarch64 binary or
        # the guest fails to exec and the integration boot hangs. The Static Linux
        # SDK cross-targets both arches from any host (same mechanism dist-x86_64
        # uses in reverse).
        run: make -C vminitd MUSL_ARCH=aarch64 BUILD_CONFIGURATION=${{ inputs.release && 'release' || 'debug' }}

      - name: Build initfs.ext4
        run: ./scripts/build-initfs.sh --vminitd vminitd/bin/vminitd --vmexec vminitd/bin/vmexec --ext4 bin/initfs.ext4 --tar bin/init.rootfs.tar.gz

      - name: Upload guest initfs
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
        with:
          name: initfs
          path: |
            bin/initfs.ext4
            bin/init.rootfs.tar.gz
          if-no-files-found: error

  buildAndTest:
    name: Build and Test repo
    if: github.repository == 'apple/containerization'
    needs: buildGuest
    timeout-minutes: 60
    runs-on: [self-hosted, macos, tahoe, ARM64]
    permissions:
      contents: read
      packages: write
    env:
      DEVELOPER_DIR: "/Applications/Xcode_swift_6.3.app/Contents/Developer"

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6
        with:
          fetch-depth: 0

      - name: Check formatting
        run: | 
          ./scripts/install-hawkeye.sh
          make fmt
          git diff
          if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi

      - name: Check protobufs
        run: | 
          make protos
          if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi

      - name: Make containerization, examples, and docs
        run: |
          make clean containerization examples docs
          tar cfz _site.tgz _site
        env:
          BUILD_CONFIGURATION: ${{ inputs.release && 'release' || 'debug' }}

      - name: Download guest initfs
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7
        with:
          name: initfs
          path: bin

      - name: Make vminit image
        run: |
          make init-image
        env:
          BUILD_CONFIGURATION: ${{ inputs.release && 'release' || 'debug' }}

      - name: Test containerization
        run: | 
          make fetch-default-kernel
          make test integration
        env:
          REGISTRY_TOKEN: ${{ github.token }}
          REGISTRY_USERNAME: ${{ github.actor }}

      - name: Push vminitd image
        if: ${{ inputs.release }}
        env:
          REGISTRY_TOKEN: ${{ github.token }}
          REGISTRY_USERNAME: ${{ github.actor }}
          REGISTRY_HOST: ghcr.io
          VERSION: ${{ inputs.version }}
        run: |
          bin/cctl images tag vminit:latest "ghcr.io/apple/containerization/vminit:${VERSION}"
          bin/cctl images push "ghcr.io/apple/containerization/vminit:${VERSION}"

      - name: Create image tar 
        if: ${{ !inputs.release }}
        run: |
          bin/cctl images save vminit:latest -o vminit.tar

      - name: Save vminit artifact
        if: ${{ !inputs.release }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
        with:
          name: vminit
          path: vminit.tar

      - name: Save documentation artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
        with:
          name: api-docs
          path: "./_site.tgz"
          retention-days: 14

  uploadPages:
    # Separate upload step required because upload-pages-artifact needs
    # gtar which is not on the macOS runner.
    name: Upload artifact for GitHub Pages
    needs: buildAndTest
    timeout-minutes: 5
    runs-on: ubuntu-latest

    steps:
      - name: Setup Pages
        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5

      - name: Download a single artifact
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7
        with:
          name: api-docs

      - name: Add API docs to documentation
        run: |
          tar xfz _site.tgz

      - name: Upload Artifact
        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4
        with:
          path: "./_site"