kata-containers/.github/workflows/static-checks.yaml

on:
  pull_request:
    types:
      - opened
      - edited
      - reopened
      - synchronize

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

name: Static checks
jobs:
  check-kernel-config-version:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Ensure the kernel config version has been updated
        run: |
          kernel_dir="tools/packaging/kernel/"
          kernel_version_file="${kernel_dir}kata_config_version"
          modified_files=$(git diff --name-only origin/$GITHUB_BASE_REF..HEAD)
          if git diff --name-only origin/$GITHUB_BASE_REF..HEAD "${kernel_dir}" | grep "${kernel_dir}"; then
            echo "Kernel directory has changed, checking if $kernel_version_file has been updated"
            if echo "$modified_files" | grep -v "README.md" | grep "${kernel_dir}" >>"/dev/null"; then
              echo "$modified_files" | grep "$kernel_version_file" >>/dev/null || ( echo "Please bump version in $kernel_version_file" && exit 1)
            else
              echo "Readme file changed, no need for kernel config version update."
            fi
            echo "Check passed"
          fi

  check-vendor:
    runs-on: ubuntu-20.04
    strategy:
      fail-fast: false
      matrix:
        component:
          - agent
          - dragonball
          - runtime
          - runtime-rs
          - agent-ctl
          - kata-ctl
          - log-parser-rs
          - runk
          - trace-forwarder
        include:
          - component: agent
            component-path: src/agent
          - component: dragonball
            component-path: src/dragonball
          - component: runtime
            component-path: src/runtime
          - component: runtime-rs
            component-path: src/runtime-rs
          - component: agent-ctl
            component-path: src/tools/agent-ctl
          - component: kata-ctl
            component-path: src/tools/kata-ctl
          - component: log-parser-rs
            component-path: src/tools/log-parser-rs
          - component: runk
            component-path: src/tools/runk
          - component: trace-forwarder
            component-path: src/tools/trace-forwarder
    steps:
      - name: Checkout the code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install yq
        run: |
          ./ci/install_yq.sh
        env:
          INSTALL_IN_GOPATH: false
      - name: Install golang
        if: ${{ matrix.component == 'runtime' }}
        run: |
          ./tests/install_go.sh -f -p
          echo "/usr/local/go/bin" >> $GITHUB_PATH
      - name: Install rust
        if: ${{ matrix.component != 'runtime' }}
        run: |
          ./tests/install_rust.sh
          echo "${HOME}/.cargo/bin" >> $GITHUB_PATH
      - name: Check ${{ matrix.component }} vendored code
        run: |
          cd ${{ matrix.component-path }}
          make vendor
        env:
          RUST_BACKTRACE: "1"

  static-checks:
    runs-on: garm-ubuntu-2004
    strategy:
      # We can set this to true whenever we're 100% sure that
      # the all the tests are not flaky, otherwise we'll fail
      # all the tests due to a single flaky instance.
      fail-fast: false
      matrix:
        cmd:
          - "make static-checks"
          - "make check"
          - "make test"
          - "sudo -E PATH=\"$PATH\" make test"
    env:
      RUST_BACKTRACE: "1"
      target_branch: ${{ github.base_ref }}
      GOPATH: ${{ github.workspace }}
    steps:
    - name: Free disk space
      run: |
        sudo rm -rf /usr/share/dotnet
        sudo rm -rf "$AGENT_TOOLSDIRECTORY"
    - name: Checkout code
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
        path: ./src/github.com/${{ github.repository }}
    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y --no-install-recommends build-essential haveged
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.3
    - name: Set PATH
      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
      run: |
        echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
    - name: Setup
      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
      run: |
        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/setup.sh
    - name: Installing rust
      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
      run: |
        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/install_rust.sh
        PATH=$PATH:"$HOME/.cargo/bin"
        rustup target add x86_64-unknown-linux-musl
        rustup component add rustfmt clippy
    - name: Setup seccomp
      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
      run: |
        libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
        gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
        echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
        echo "LIBSECCOMP_LINK_TYPE=static" >> $GITHUB_ENV
        echo "LIBSECCOMP_LIB_PATH=${libseccomp_install_dir}/lib" >> $GITHUB_ENV
    - name: Run check
      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
      run: |
        export PATH=$PATH:"$HOME/.cargo/bin"
        export XDG_RUNTIME_DIR=$(mktemp -d /tmp/kata-tests-$USER.XXX | tee >(xargs chmod 0700))
        cd ${GOPATH}/src/github.com/${{ github.repository }} && ${{ matrix.cmd }}