runc/.github/workflows/test.yml

name: ci
on:
  push:
    tags:
      - v*
    branches:
      - master
  pull_request:

jobs:
  test:
    runs-on: ubuntu-20.04
    strategy:
      fail-fast: false
      matrix:
        go-version: [1.14.x, 1.15.x]
        rootless: ["rootless", ""]

    steps:

    - name: checkout
      uses: actions/checkout@v2

    - name: install deps
      run: |
        # skopeo repo
        echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_10/ /' | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
        wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_10/Release.key -O- | sudo apt-key add -
        # criu repo
        sudo add-apt-repository -y ppa:criu/ppa
        # apt-add-repository runs apt update so we don't have to
        sudo apt -q install libseccomp-dev criu skopeo

    - name: install go ${{ matrix.go-version }}
      uses: actions/setup-go@v2
      with:
        go-version: ${{ matrix.go-version }}

    - name: build
      run: sudo -E PATH="$PATH" make all

    - name: install umoci
      run: |
        mkdir ~/bin
        echo "PATH=$HOME/bin:$PATH" >> $GITHUB_ENV
        curl -o ~/bin/umoci -fsSL https://github.com/opencontainers/umoci/releases/download/v0.4.6/umoci.amd64
        chmod +x ~/bin/umoci

    - name: install bats
      uses: mig4/setup-bats@v1
      with:
        bats-version: 1.2.1

    - name: get images for libcontainer/integration unit test
      # no rootless unit tests
      if: matrix.rootless != 'rootless'
      run: |
        sudo mkdir /busybox /debian
        . tests/integration/multi-arch.bash
        curl -fsSL `get_busybox` | sudo tar xfJC - /busybox

    - name: unit test
      if: matrix.rootless != 'rootless'
      run: sudo -E PATH="$PATH" script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm make localunittest'

    - name: add rootless user
      if: matrix.rootless == 'rootless'
      run: |
        sudo useradd -u2000 -m -d/home/rootless -s/bin/bash rootless
        # Allow root to execute `ssh rootless@localhost` in tests/rootless.sh
        ssh-keygen -t ecdsa -N "" -f $HOME/rootless.key
        sudo mkdir -m 0700 -p /home/rootless/.ssh
        sudo cp $HOME/rootless.key.pub /home/rootless/.ssh/authorized_keys
        sudo chown -R rootless.rootless /home/rootless

    - name: integration test (fs driver)
      run: sudo -E PATH="$PATH" script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm make local${{ matrix.rootless }}integration'

    - name: integration test (systemd driver)
      # can't use systemd driver with cgroupv1
      if: matrix.rootless != 'rootless'
      run: sudo -E PATH="$PATH" script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm make RUNC_USE_SYSTEMD=yes local${{ matrix.rootless }}integration'


  # cgroup v2 unified hierarchy + very recent kernel (openat2)
  fedora:
    # nested virtualization is only available on macOS hosts
    runs-on: macos-10.15
    timeout-minutes: 60
    # only run it if others have passed
    needs: [test]
    steps:
      - uses: actions/checkout@v2
      - name: prepare vagrant
        run: |
          ln -sf Vagrantfile.fedora33 Vagrantfile
          vagrant up
          vagrant ssh-config >> ~/.ssh/config

      - name: system info
        run: ssh default 'sh -exc "uname -a && systemctl --version && df -T"'

      - name: unit tests
        run: ssh default 'cd /vagrant && sudo make localunittest'

      # The integration tests require tty which GH actions lack;
      # wrap those in "script" to emulate tty.
      - name: cgroupv2 with systemd
        run: ssh default "script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm sudo make -C /vagrant localintegration RUNC_USE_SYSTEMD=yes'"

      - name: cgroupv2 with fs2
        run: ssh default "script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm sudo make -C /vagrant localintegration'"

      - name: cgroupv2 with systemd (rootless)
        run: ssh default "script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm sudo make -C /vagrant localrootlessintegration RUNC_USE_SYSTEMD=yes'"

      - name: cgroupv2 with fs2 (rootless)
        run: ssh default "script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm sudo make -C /vagrant localrootlessintegration'"


  # kernel 3.10 (frankenized), systemd 219
  centos7:
    # nested virtualization is only available on macOS hosts
    runs-on: macos-10.15
    timeout-minutes: 60
    # only run it if others have passed
    needs: [test]
    steps:
      - uses: actions/checkout@v2
      - name: prepare vagrant
        run: |
          ln -sf Vagrantfile.centos7 Vagrantfile
          vagrant up
          vagrant ssh-config >> ~/.ssh/config

      - name: system info
        run: ssh default 'rpm -q centos-release kernel systemd'

      - name: unit tests
        run: ssh default 'sudo -i make -C /vagrant localunittest'

      - name: integration tests (fs cgroup driver)
        run: ssh default "script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm sudo -i make -C /vagrant localintegration'"

      - name: integration tests (systemd cgroup driver)
        run: ssh default "script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm sudo -i make -C /vagrant localintegration RUNC_USE_SYSTEMD=1'"

      - name: rootless integration
      # FIXME: rootless is skipped because of EPERM on writing cgroup.procs
        if: false
        run: ssh default "script -e -c /bin/bash -c 'stty rows 40 cols 80; TERM=xterm sudo -i make -C /vagrant localrootlessintegration'"