---
# We use Cirrus for RHEL clones because Cirrus can directly run them
# without depending on nested virtualization.

# NOTE Cirrus execution environments lack a terminal, needed for
# some integration tests. So we use `ssh -tt` command to fake a terminal.

task:
  timeout_in: 30m

  env:
    HOME: /root
    CIRRUS_WORKING_DIR: /home/runc
    GO_VER_PREFIX: "1.25."
    BATS_VERSION: "v1.12.0"
    LIBPATHRS_VERSION: "0.2.4"
    RPMS: gcc git-core iptables jq glibc-static libseccomp-devel make criu fuse-sshfs container-selinux policycoreutils cargo lld wget
    # yamllint disable rule:key-duplicates
    matrix:
      - DISTRO: almalinux-8
        IMAGE_PROJECT: almalinux-cloud
      - DISTRO: almalinux-9
        IMAGE_PROJECT: almalinux-cloud
      - DISTRO: centos-stream-10
        IMAGE_PROJECT: centos-cloud

  name: ci / $DISTRO

  compute_engine_instance:
    image_project: $IMAGE_PROJECT
    image: family/$DISTRO
    platform: linux
    cpu: 4
    memory: 8G

  install_dependencies_script: |
    case $DISTRO in
    *-8)
      dnf config-manager --set-enabled powertools # for glibc-static
      ;;
    *-9|*-10)
      dnf config-manager --set-enabled crb # for glibc-static
      dnf -y install epel-release # for fuse-sshfs
      # Delegate all cgroup v2 controllers to rootless user via --systemd-cgroup.
      # The default (since systemd v252) is "pids memory cpu".
      mkdir -p /etc/systemd/system/user@.service.d
      printf "[Service]\nDelegate=yes\n" > /etc/systemd/system/user@.service.d/delegate.conf
      systemctl daemon-reload
      ;;
    esac
    # Work around dnf mirror failures by retrying a few times.
    for i in $(seq 0 2); do
      sleep $i
      dnf install -y --setopt=install_weak_deps=False --setopt=tsflags=nodocs $RPMS && break
    done
    [ $? -eq 0 ] # fail if dnf failed

    case $DISTRO in
    *-8)
      # Use newer criu (with https://github.com/checkpoint-restore/criu/pull/2545).
      # Alas we have to disable container-tools for that.
      dnf -y module disable container-tools
      dnf -y copr enable adrian/criu-el8
      dnf -y install criu
    esac

    # Install libpathrs.
    /home/runc/script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr

    # Install Go.
    URL_PREFIX="https://go.dev/dl/"
    # Find out the latest minor release URL.
    filename=$(curl -fsSL "${URL_PREFIX}?mode=json&include=all" | jq -r --arg Ver "go$GO_VER_PREFIX" '. | map(select(.version | contains($Ver))) | first | .files[] | select(.os == "linux" and .arch == "amd64" and .kind == "archive") | .filename')
    curl -fsSL "$URL_PREFIX$filename" | tar Cxz /usr/local
    # install bats
    cd /tmp
    git clone https://github.com/bats-core/bats-core
    cd bats-core
    git checkout $BATS_VERSION
    ./install.sh /usr/local
    cd -
    # Setup rootless tests.
    /home/runc/script/setup_rootless.sh
    # set PATH
    echo 'export PATH=/usr/local/go/bin:/usr/local/bin:$PATH' >> /root/.bashrc
    # Setup ssh localhost for terminal emulation (script -e did not work)
    ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N ""
    cat /root/.ssh/id_ed25519.pub >> /root/.ssh/authorized_keys
    chmod 400 /root/.ssh/authorized_keys
    ssh-keyscan localhost >> /root/.ssh/known_hosts
    echo -e "Host localhost\n\tStrictHostKeyChecking no\t\nIdentityFile /root/.ssh/id_ed25519\n" >> /root/.ssh/config
    sed -e "s,PermitRootLogin.*,PermitRootLogin prohibit-password,g" -i /etc/ssh/sshd_config
    systemctl restart sshd
  host_info_script: |
    uname -a
    # -----
    /usr/local/go/bin/go version
    # -----
    systemctl --version
    # -----
    cat /etc/os-release
    # -----
    df -T
    # -----
    sestatus
    # -----
    cat /proc/cpuinfo
  check_config_script: |
    /home/runc/script/check-config.sh
  unit_tests_script: |
    ssh -tt localhost "make -C /home/runc localunittest"
  integration_systemd_script: |
    ssh -tt localhost "make -C /home/runc localintegration RUNC_USE_SYSTEMD=yes"
  integration_fs_script: |
    ssh -tt localhost "make -C /home/runc localintegration"
  integration_systemd_rootless_script: |
    case $DISTRO in
      *-8)
        echo "SKIP: integration_systemd_rootless_script requires cgroup v2"
        ;;
      *)
        ssh -tt localhost "make -C /home/runc localrootlessintegration RUNC_USE_SYSTEMD=yes"
    esac
  integration_fs_rootless_script: |
    ssh -tt localhost "make -C /home/runc localrootlessintegration"