-
Notifications
You must be signed in to change notification settings - Fork 21
Best effort attempt to clean /mnt partition before the builds #97
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from all commits
Commits
Show all changes
11 commits
Select commit
Hold shift + click to select a range
6fc3cca
Add Debian conversion and installation scripts
ggiguash 08c0716
Add rpm-deb target to Makefile
ggiguash 487238e
Create src/rpm folder for consistency
ggiguash 51d6f9f
Update documentation
ggiguash 412231f
Create a new Ubuntu GitHub action
ggiguash dd3f145
Add tmate-debug action
ggiguash cc43289
Address CodeRabbitAI review comments
ggiguash 5358f2c
Use ubuntu-24.04 images for runners
ggiguash 95405cf
Disable CNI plugin configuration files to allow Kindnet override
ggiguash 0124201
Ubuntu version precisions
ggiguash f98d019
Best effort attempt to clean /mnt partition
ggiguash File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| name: build-deb-packages | ||
| description: Reusable action to build MicroShift Debian packages | ||
|
|
||
| inputs: | ||
| ushift-branch: | ||
| description: MicroShift branch from https://github.com/openshift/microshift/branches | ||
| required: true | ||
| type: string | ||
| okd-version-tag: | ||
| description: OKD version tag from https://quay.io/repository/okd/scos-release?tab=tags | ||
| required: true | ||
| type: string | ||
|
|
||
| runs: | ||
| using: "composite" | ||
| steps: | ||
| - name: Detect the CPU architecture | ||
| id: detect-cpu-arch | ||
| uses: ./.github/actions/arch | ||
|
|
||
| - name: Collect debug information before the build | ||
| if: always() | ||
| uses: ./.github/actions/debug-info | ||
|
|
||
| - name: Prepare the build and run environment | ||
| uses: ./.github/actions/prebuild | ||
|
|
||
| - name: Build MicroShift RPMs | ||
| shell: bash | ||
| run: | | ||
| # See https://github.com/microshift-io/microshift/blob/main/docs/build.md | ||
| # for more information about the build process. | ||
|
|
||
| # Run the RPM build process. | ||
| cd ${GITHUB_WORKSPACE}/ | ||
| make rpm \ | ||
| USHIFT_BRANCH=${{ inputs.ushift-branch }} \ | ||
| OKD_VERSION_TAG=${{ inputs.okd-version-tag }} \ | ||
| RPM_OUTDIR=/mnt/rpms | ||
|
|
||
| - name: Convert the MicroShift RPMs to Debian packages | ||
| shell: bash | ||
| run: | | ||
| make rpm-deb RPM_OUTDIR=/mnt/rpms | ||
|
|
||
| - name: Install the MicroShift Debian packages | ||
| shell: bash | ||
| run: | | ||
| sudo ./src/deb/install.sh /mnt/rpms/deb | ||
|
|
||
| - name: Start the MicroShift service | ||
| shell: bash | ||
| run: | | ||
| make _topolvm_create | ||
| sudo systemctl start --no-block microshift.service | ||
|
|
||
| - name: Run a test to verify that MicroShift is functioning properly | ||
| shell: bash | ||
| run: | | ||
| echo "Waiting 5m for the MicroShift service to be ready" | ||
| for _ in $(seq 60); do | ||
| if sudo systemctl -q is-active microshift.service ; then | ||
| printf "\nOK\n" | ||
| break | ||
| fi | ||
| echo -n "." && sleep 5 | ||
| done | ||
| if ! sudo systemctl -q is-active microshift.service ; then | ||
| printf "\nFAILED\n" && exit 1 | ||
| fi | ||
|
|
||
| # Storage deployments and daemonsets are last to become ready, so it is | ||
| # a good indicator of the MicroShift service being healthy | ||
| echo "Waiting 15m for the MicroShift service to be healthy" | ||
| if ! sudo microshift healthcheck -v=2 --timeout="900s" --custom \ | ||
| '{"topolvm-system":{"deployments": ["topolvm-controller"], "daemonsets": ["topolvm-node"]}}'; then | ||
| echo "ERROR: Failed to verify that the MicroShift service is healthy" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Uncomment this to enable tmate-debug on failure | ||
| # - name: Pause and open tmate debug session | ||
| # if: failure() | ||
| # uses: ./.github/actions/tmate-debug | ||
|
|
||
| - name: Collect debug information after the build | ||
| if: always() | ||
| uses: ./.github/actions/debug-info | ||
|
|
||
| - name: Collect sos report for MicroShift | ||
| if: failure() | ||
| shell: bash | ||
| run: | | ||
| # Change the default profiles and plugins to adapt to the Debian environment | ||
| # Profiles: | ||
| # - Remove microshift | ||
| # - Add storage | ||
| # Plugins: | ||
| # - Remove firewalld, rpmostree, rpm | ||
| # - Add ufw, apt | ||
| sudo microshift-sos-report \ | ||
| --profiles network,security,storage \ | ||
| --plugins container_log,crio,logs,ufw,apt \ | ||
| --tmp-dir /mnt/tmp | ||
| sudo chmod 644 /mnt/tmp/sosreport-* | ||
|
|
||
| - name: Upload sos report to the GitHub Actions artifact | ||
| if: failure() | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: sosreport-microshift-okd-${{ github.job }}-${{ steps.detect-cpu-arch.outputs.arch }}-${{ github.run_id }} | ||
| path: /mnt/tmp/sosreport-* | ||
| compression-level: 0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| name: prebuild-environment-setup | ||
| description: Reusable action to configure the build environment for MicroShift | ||
|
|
||
| runs: | ||
| using: "composite" | ||
| steps: | ||
| - name: Prepare the build and run environment | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| set -x | ||
|
|
||
| # Attempt to clean up any pre-existing files on the /mnt partition to | ||
| # conserve disk space. Note that this is a best-effort approach and | ||
| # not all files may be removed (e.g. swapfile, lost+found, etc.). | ||
| sudo rm -rvf /mnt/* || true | ||
|
|
||
| # Create the necessary directories on the /mnt partition | ||
| sudo mkdir -p /mnt/tmp /mnt/rpms /mnt/release | ||
| sudo chmod 1777 /mnt/tmp | ||
|
|
||
| # Install the pre-requisites for the build and run environment | ||
| sudo apt-get update -y -q | ||
| sudo apt-get install -y -q make lvm2 podman jq curl alien | ||
|
|
||
| # Redirect the container build directories to /mnt/ to avoid running out of disk space. | ||
| sudo mv /var/tmp /var/tmp.orig | ||
| sudo mv /var/lib/containers /mnt/containers | ||
| sudo ln -s /mnt/tmp /var/tmp | ||
| sudo ln -s /mnt/containers /var/lib/containers |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # | ||
| # Copy the following code to an action or a workflow to open a tmate debug | ||
| # session on failure. | ||
| # Change the if condition to 'always()' to open the session unconditionally. | ||
| # | ||
| # - name: Pause and open tmate debug session | ||
| # if: failure() | ||
| # uses: ./.github/actions/tmate-debug | ||
| # | ||
| name: tmate-debug | ||
| description: Reusable action to open a tmate debug session | ||
|
|
||
| runs: | ||
| using: "composite" | ||
| steps: | ||
| - name: Pause and open tmate debug session | ||
| uses: mxschmitt/action-tmate@v3 | ||
| with: | ||
| limit-access-to-actor: false | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Security risk: Unrestricted access to debug sessions.
Setting
limit-access-to-actor: falseallows anyone to connect to the tmate debug session, not just the PR author or repository collaborators. This poses a security risk in public repositories as unauthorized users could:Apply this diff to restrict access to the PR actor only:
- name: Pause and open tmate debug session uses: mxschmitt/action-tmate@v3 with: - limit-access-to-actor: false + limit-access-to-actor: true📝 Committable suggestion
🤖 Prompt for AI Agents