.cirrus.yml

---

# Main collection of env. vars to set for all tasks and scripts.
env:
    ####
    #### Global variables used for all tasks
    ####
    # Name of the ultimate destination branch for this CI run, PR or post-merge.
    DEST_BRANCH: "master"
    GOPATH: "/var/tmp/go"
    GOSRC: "${GOPATH}/src/github.com/containers/buildah"
    # Overrides default location (/tmp/cirrus) for repo clone
    CIRRUS_WORKING_DIR: "${GOSRC}"
    # Shell used to execute all script commands
    CIRRUS_SHELL: "/bin/bash"
    # Automation script path relative to $CIRRUS_WORKING_DIR)
    SCRIPT_BASE: "./contrib/cirrus"
    # No need to go crazy, but grab enough to cover most PRs
    CIRRUS_CLONE_DEPTH: 50
    # Unless set by in_podman.sh, default to operating outside of a podman container
    IN_PODMAN: 'false'
    # Not cross-compiling by default
    CROSS_TARGET: ""

    ####
    #### Cache-image names to test with
    ####
    # GCE project where images live
    IMAGE_PROJECT: "libpod-218412"
    # See https://github.com/containers/podman/blob/master/contrib/cirrus/README.md#test_build_cache_images_task-task
    FEDORA_NAME: "fedora-32"
    PRIOR_FEDORA_NAME: "fedora-31"
    UBUNTU_NAME: "ubuntu-20"
    PRIOR_UBUNTU_NAME: "ubuntu-19"

    _BUILT_IMAGE_SUFFIX: "podman-6530021898584064"
    FEDORA_CACHE_IMAGE_NAME: "${FEDORA_NAME}-${_BUILT_IMAGE_SUFFIX}"
    PRIOR_FEDORA_CACHE_IMAGE_NAME: "${PRIOR_FEDORA_NAME}-${_BUILT_IMAGE_SUFFIX}"
    UBUNTU_CACHE_IMAGE_NAME: "${UBUNTU_NAME}-${_BUILT_IMAGE_SUFFIX}"
    PRIOR_UBUNTU_CACHE_IMAGE_NAME: "${PRIOR_UBUNTU_NAME}-${_BUILT_IMAGE_SUFFIX}"

    ####
    #### Command variables to help avoid duplication
    ####
    # Command to prefix every output line with a timestamp
    # (can't do inline awk script, Cirrus-CI or YAML mangles quoting)
    _TIMESTAMP: 'awk -f ${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/timestamp.awk'

gcp_credentials: ENCRYPTED[ae0bf7370f0b6e446bc61d0865a2c55d3e166b3fab9466eb0393e38e1c66a31ca4c71ddc7e0139d47d075c36dd6d3fd7]

# Default timeout for each task
timeout_in: 120m

# Default VM to use unless set or modified by task
gce_instance:
    image_project: "${IMAGE_PROJECT}"
    zone: "us-central1-c"  # Required by Cirrus for the time being
    cpu: 2
    memory: "4Gb"
    disk: 200  # Gigabytes, do not set less than 200 per obscure GCE docs re: I/O performance
    image_name: "${FEDORA_CACHE_IMAGE_NAME}"


# Update metadata on VM images referenced by this repository state
'cirrus-ci/only_prs/meta_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    container:
        image: "quay.io/libpod/imgts:latest"  # see contrib/imgts
        cpu: 1
        memory: 1

    env:
        # Space-separated list of images used by this repository state
        IMGNAMES: |-
            ${FEDORA_CACHE_IMAGE_NAME}
            ${PRIOR_FEDORA_CACHE_IMAGE_NAME}
            ${UBUNTU_CACHE_IMAGE_NAME}
            ${PRIOR_UBUNTU_CACHE_IMAGE_NAME}
        BUILDID: "${CIRRUS_BUILD_ID}"
        REPOREF: "${CIRRUS_CHANGE_IN_REPO}"
        GCPJSON: ENCRYPTED[d3614d6f5cc0e66be89d4252b3365fd84f14eee0259d4eb47e25fc0bc2842c7937f5ee8c882b7e547b4c5ec4b6733b14]
        GCPNAME: ENCRYPTED[8509e6a681b859479ce6aa275bd3c4ac82de5beec6df6057925afc4cd85b7ef2e879066ae8baaa2d453b82958e434578]
        GCPPROJECT: ENCRYPTED[cc09b62d0ec6746a3df685e663ad25d9d5af95ef5fd843c96f3d0ec9d7f065dc63216b9c685c9f43a776a1d403991494]
        CIRRUS_CLONE_DEPTH: 1  # source not used

    script: '/usr/local/bin/entrypoint.sh |& ${_TIMESTAMP}'


'cirrus-ci/only_prs/gate_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    timeout_in: 30m

    setup_script: '${SCRIPT_BASE}/setup.sh |& ${_TIMESTAMP}'
    build_script: '${SCRIPT_BASE}/build.sh |& ${_TIMESTAMP}'
    validate_test_script: '${SCRIPT_BASE}/test.sh validate |& ${_TIMESTAMP}'

    binary_artifacts:
        path: ./bin/*


'cirrus-ci/only_prs/unit_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    # not supported by bors-ng
    # allow_failures: $CI == $CI

    timeout_in: 45m

    setup_script: '${SCRIPT_BASE}/setup.sh |& ${_TIMESTAMP}'
    build_script: '${SCRIPT_BASE}/build.sh |& ${_TIMESTAMP}'
    unit_test_script: '${SCRIPT_BASE}/test.sh unit |& ${_TIMESTAMP}'

    binary_artifacts:
        path: ./bin/*


'cirrus-ci/only_prs/conformance_task':
    gce_instance:  # Only need to specify differences from defaults (above)
        image_name: "${UBUNTU_CACHE_IMAGE_NAME}"

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    # don't fail the PR when we fail until #2480 is merged
    allow_failures: true

    timeout_in: 20m

    setup_script: '${SCRIPT_BASE}/setup.sh |& ${_TIMESTAMP}'
    conformance_test_script: '${SCRIPT_BASE}/test.sh conformance |& ${_TIMESTAMP}'


# This task runs `make vendor` followed by ./hack/tree_status.sh to check
# whether the git tree is clean.  The reasoning for that is to make sure
# that the vendor.conf, the code and the vendored packages in ./vendor are
# in sync at all times.
'cirrus-ci/only_prs/vendor_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    env:
        CIRRUS_WORKING_DIR: "/var/tmp/go/src/github.com/containers/buildah"
        GOPATH: "/var/tmp/go"
        GOSRC: "/var/tmp/go/src/github.com/containers/buildah"

    # Runs within Cirrus's "community cluster"
    container:
        image: docker.io/library/golang:1.13
        cpu: 1
        memory: 1

    timeout_in: 5m

    vendor_script:
        - 'make vendor'
        - './hack/tree_status.sh'


'cirrus-ci/only_prs/cross_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    depends_on:
        - 'cirrus-ci/only_prs/gate'
        - 'cirrus-ci/only_prs/vendor'

    env:
        matrix:
            CROSS_TARGET: cross

    setup_script: '${SCRIPT_BASE}/setup.sh |& ${_TIMESTAMP}'
    build_script: '${SCRIPT_BASE}/build.sh |& ${_TIMESTAMP}'

    binary_artifacts:
        path: ./bin/*


'cirrus-ci/required/testing_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    depends_on:
        - 'cirrus-ci/only_prs/gate'
        - 'cirrus-ci/only_prs/vendor'

    gce_instance:  # Only need to specify differences from defaults (above)
        matrix:  # Duplicate this task for each matrix product.
            image_name: "${FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
            image_name: "${UBUNTU_CACHE_IMAGE_NAME}"
            image_name: "${PRIOR_UBUNTU_CACHE_IMAGE_NAME}"

    # Separate scripts for separate outputs, makes debugging easier.
    setup_script: '${SCRIPT_BASE}/setup.sh |& ${_TIMESTAMP}'
    build_script: '${SCRIPT_BASE}/build.sh |& ${_TIMESTAMP}'
    integration_test_script: '${SCRIPT_BASE}/test.sh integration |& ${_TIMESTAMP}'

    binary_artifacts:
        path: ./bin/*

    always: &standardlogs
        audit_log_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh audit'
        df_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh df'
        journal_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh journal'
        podman_system_info_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh podman'
        buildah_version_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh buildah_version'
        buildah_info_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh buildah_info'
        package_versions_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh packages'


'cirrus-ci/required/in_podman_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    depends_on:
        - 'cirrus-ci/only_prs/gate'
        - 'cirrus-ci/only_prs/vendor'

    env:
        # This is key, it causes the scripts to re-execute themselves inside a container.
        IN_PODMAN: 'true'
        BUILDAH_ISOLATION: 'chroot'
        STORAGE_DRIVER: 'vfs'
        STORAGE_OPTIONS: ''

    # Separate scripts for separate outputs, makes debugging easier.
    setup_script: '${SCRIPT_BASE}/setup.sh |& ${_TIMESTAMP}'
    build_script: '${SCRIPT_BASE}/build.sh |& ${_TIMESTAMP}'
    integration_test_script: '${SCRIPT_BASE}/test.sh integration |& ${_TIMESTAMP}'

    binary_artifacts:
        path: ./bin/*

    always:
        <<: *standardlogs

# TODO: Bors-ng has trouble interpreting multiple status-checks as being required
#       when their names contain wild-cards (like `testing%`).  Until that issue
#       can be fixed, use a single "test" to represent pass/fail status of all
#       required checks.
'cirrus-ci/success_task':

    # see bors.toml
    skip: $CIRRUS_BRANCH =~ ".*\.tmp"

    depends_on:
        - "cirrus-ci/required/testing"
        - "cirrus-ci/required/in_podman"

    env:
        CIRRUS_WORKING_DIR: /tmp
        CIRRUS_CLONE_DEPTH: 1  # no code is being used by this task

    container:
        image: "quay.io/libpod/fedora-minimal:latest"
        cpu: 1
        memory: 1

    script: /bin/true

# Build the static binary
'cirrus-ci/only_prs/static_binary_task':
    depends_on:
        - "cirrus-ci/only_prs/gate"

    gce_instance:
        image_name: "${FEDORA_CACHE_IMAGE_NAME}"
        cpu: 8
        memory: 12
        disk: 200

    init_script: |
        set -ex
        setenforce 0
        growpart /dev/sda 1 || true
        resize2fs /dev/sda1 || true
        yum -y install podman

    nix_cache:
      folder: '.cache'
      fingerprint_script: |
        echo "nix-v1-$(sha1sum nix/nixpkgs.json | head -c 40)"

    build_script: |
        set -ex
        mkdir -p .cache
        mv .cache /nix
        if [[ -z $(ls -A /nix) ]]; then podman run --rm --privileged -ti -v /:/mnt nixos/nix cp -rfT /nix /mnt/nix; fi
        podman run --rm --privileged -ti -v /nix:/nix -v ${PWD}:${PWD} -w ${PWD} nixos/nix nix --print-build-logs --option cores 8 --option max-jobs 8 build --file nix/
        mv /nix .cache
        chown -Rf $(whoami) .cache

    binaries_artifacts:
        path: "result/bin/buildah"