instances: harden boot marker hydration and network self-heal #960
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test | |
| on: | |
| push: {} | |
| jobs: | |
| test: | |
| runs-on: [self-hosted, linux, x64, kvm] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| clean: false | |
| - name: Clean workspace (preserve binary caches) | |
| run: | | |
| git reset --hard HEAD | |
| git clean -ffdx \ | |
| -e lib/vmm/binaries/ \ | |
| -e lib/hypervisor/firecracker/binaries/ \ | |
| -e lib/ingress/binaries/ \ | |
| -e bin/ | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| # Not necessary to upload cache on self-hosted runner(s) | |
| # ~/go/pkg/mod and ~/.cache/go-build stay on disk between runs automatically. | |
| cache: false | |
| go-version: '1.25.4' | |
| - name: Install dependencies | |
| run: | | |
| set -xe | |
| has_libjpeg8=0 | |
| if sudo ldconfig -p | grep -q 'libjpeg\.so\.8'; then | |
| has_libjpeg8=1 | |
| fi | |
| if ! command -v mkfs.erofs &> /dev/null || \ | |
| ! command -v mkfs.ext4 &> /dev/null || \ | |
| ! command -v iptables &> /dev/null || \ | |
| [ "$has_libjpeg8" -eq 0 ]; then | |
| sudo apt-get update | |
| sudo apt-get install -y erofs-utils e2fsprogs iptables | |
| # Different runner images expose JPEG libs under different package names. | |
| if ! sudo ldconfig -p | grep -q 'libjpeg\.so\.8'; then | |
| sudo apt-get install -y libjpeg-turbo8 || sudo apt-get install -y libjpeg62-turbo | |
| fi | |
| # Some images only provide libjpeg.so.62. Provide a compatibility symlink | |
| # for qemu binaries linked against libjpeg.so.8. | |
| if ! sudo ldconfig -p | grep -q 'libjpeg\.so\.8'; then | |
| jpeg_lib="$(sudo ldconfig -p | awk '/libjpeg\.so/{print $NF; exit}')" | |
| if [ -n "$jpeg_lib" ]; then | |
| sudo ln -sf "$jpeg_lib" "$(dirname "$jpeg_lib")/libjpeg.so.8" | |
| sudo ldconfig | |
| fi | |
| fi | |
| fi | |
| go mod download | |
| - name: Verify Linux test toolchain | |
| run: | | |
| set -euo pipefail | |
| TEST_PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH" | |
| for bin in mkfs.erofs mkfs.ext4 iptables; do | |
| if ! sudo env "PATH=$TEST_PATH" bash -lc "command -v '$bin' >/dev/null"; then | |
| echo "missing required binary under sudo PATH: $bin" | |
| exit 1 | |
| fi | |
| sudo env "PATH=$TEST_PATH" bash -lc "command -v '$bin'" | |
| done | |
| if ! sudo ldconfig -p | grep -q 'libjpeg\.so\.8'; then | |
| echo "missing required runtime library: libjpeg.so.8" | |
| exit 1 | |
| fi | |
| # Avoids rate limits when running the tests | |
| # Tests includes pulling, then converting to disk images | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: Generate OpenAPI code | |
| run: make oapi-generate | |
| - name: Build | |
| run: make build | |
| - name: Prewarm test cache | |
| env: | |
| HYPEMAN_TEST_REGISTRY: 127.0.0.1:5001 | |
| run: | | |
| export HYPEMAN_TEST_PREWARM_DIR="$HOME/.cache/hypeman-ci/linux-amd64" | |
| go run ./cmd/test-prewarm | |
| - name: Check gofmt | |
| run: | | |
| set -euo pipefail | |
| go_files="$(git ls-files '*.go')" | |
| if [ -z "$go_files" ]; then | |
| exit 0 | |
| fi | |
| unformatted="$(echo "$go_files" | xargs gofmt -l)" | |
| if [ -n "$unformatted" ]; then | |
| echo "The following files are not gofmt-formatted:" | |
| echo "$unformatted" | |
| exit 1 | |
| fi | |
| - name: Run tests | |
| env: | |
| GO_TEST_TIMEOUT: 600s | |
| # Docker auth for tests running as root (sudo) | |
| DOCKER_CONFIG: /home/debianuser/.docker | |
| # TLS/ACME testing (optional - tests will skip if not configured) | |
| ACME_EMAIL: ${{ secrets.ACME_EMAIL }} | |
| ACME_DNS_PROVIDER: "cloudflare" | |
| ACME_CA: "https://acme-staging-v02.api.letsencrypt.org/directory" | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| TLS_TEST_DOMAIN: "test.hypeman-development.com" | |
| TLS_ALLOWED_DOMAINS: '*.hypeman-development.com' | |
| HYPEMAN_TEST_PREWARM_STRICT: "1" | |
| HYPEMAN_TEST_REGISTRY: 127.0.0.1:5001 | |
| run: | | |
| export HYPEMAN_TEST_PREWARM_DIR="$HOME/.cache/hypeman-ci/linux-amd64" | |
| make test TEST_TIMEOUT=20m | |
| test-darwin: | |
| runs-on: [self-hosted, macos, arm64] | |
| concurrency: | |
| group: macos-ci-test-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| DATA_DIR: /tmp/hypeman-ci-${{ github.run_id }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25.4' | |
| cache: false | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: Install dependencies | |
| run: | | |
| brew list e2fsprogs &>/dev/null || brew install e2fsprogs | |
| brew list erofs-utils &>/dev/null || brew install erofs-utils | |
| go mod download | |
| - name: Create run-scoped data directory | |
| run: mkdir -p "$DATA_DIR" | |
| - name: Generate OpenAPI code | |
| run: make oapi-generate | |
| - name: Build | |
| run: make build | |
| - name: Prewarm test cache | |
| env: | |
| HYPEMAN_TEST_REGISTRY: 127.0.0.1:5001 | |
| run: | | |
| export HYPEMAN_TEST_PREWARM_DIR="$HOME/.cache/hypeman-ci/darwin-arm64" | |
| go run ./cmd/test-prewarm | |
| - name: Check gofmt | |
| run: | | |
| set -euo pipefail | |
| go_files="$(git ls-files '*.go')" | |
| if [ -z "$go_files" ]; then | |
| exit 0 | |
| fi | |
| unformatted="$(echo "$go_files" | xargs gofmt -l)" | |
| if [ -n "$unformatted" ]; then | |
| echo "The following files are not gofmt-formatted:" | |
| echo "$unformatted" | |
| exit 1 | |
| fi | |
| - name: Run tests | |
| env: | |
| GO_TEST_TIMEOUT: 600s | |
| DEFAULT_HYPERVISOR: vz | |
| JWT_SECRET: ci-test-secret | |
| HYPEMAN_TEST_PREWARM_STRICT: "1" | |
| HYPEMAN_TEST_REGISTRY: 127.0.0.1:5001 | |
| run: | | |
| export HYPEMAN_TEST_PREWARM_DIR="$HOME/.cache/hypeman-ci/darwin-arm64" | |
| make test | |
| - name: Cleanup | |
| if: always() | |
| run: | | |
| pkill -f "vz-shim.*$DATA_DIR" || true | |
| rm -rf "$DATA_DIR" | |
| make clean | |
| e2e-install: | |
| runs-on: [self-hosted, macos, arm64] | |
| needs: test-darwin | |
| concurrency: | |
| group: macos-ci-e2e-${{ github.ref }} | |
| cancel-in-progress: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25.4' | |
| cache: false | |
| - name: Install dependencies | |
| run: brew list caddy &>/dev/null || brew install caddy | |
| - name: Run E2E install test | |
| run: bash scripts/e2e-install-test.sh | |
| - name: Cleanup on failure | |
| if: failure() | |
| run: bash scripts/uninstall.sh || true |