ToyOS/.github/workflows/guest.yml at main · ToyOSOrg/ToyOS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: guest

on:
  workflow_call:
    inputs:
      # Without it every guest is emulated: the only lane that decodes the paths
      # a KVM host's CPU never does.
      kvm:
        type: boolean
        required: true
      sysroot-key:
        type: string
        required: true
      sysroot-path:
        type: string
        required: true

jobs:
  suite:
    runs-on: ubuntu-24.04
    # A wedge guard, not a budget.
    timeout-minutes: 60
    # The digest is the instrument's one pin: a dated image names the snapshot
    # archive it was built from, and `deps` installs QEMU from that archive.
    # ToyOSOrg's copy of Docker Hub's `sid-20260918`, pulled with the run's
    # token, which its caller grants `packages: read`: Docker Hub's and ECR
    # Public's anonymous limits refused it, and the digest holds whichever
    # registry serves it. The node ships `crw-rw---- root:kvm` and root opens it.
    container:
      image: ghcr.io/toyosorg/debian@sha256:a2aa46262453eba3f464d8b1c7a8c31db85eb15af180ae34dd400615d7208547
      credentials:
        username: ${{ github.actor }}
        password: ${{ github.token }}
      options: ${{ inputs.kvm && '--device=/dev/kvm' || '' }}
    steps:
      # Before the checkout, which wants git. Three attempts, because the
      # archive is fixed and the network to it is not.
      - name: deps
        run: |
          snap=$(sed -n 's|^# \(http://snapshot\.debian\.org/archive/debian/[0-9]*T[0-9]*Z\)$|\1|p' \
                   /etc/apt/sources.list.d/debian.sources)
          test -n "$snap"
          echo "deb $snap sid main" > /etc/apt/sources.list
          rm /etc/apt/sources.list.d/debian.sources
          # `zstd`: what the sysroot's restore unpacks the toolchain job's entry with.
          for attempt in 1 2 3; do
            apt-get -o Acquire::Check-Valid-Until=false update -qq > /tmp/apt.log 2>&1 \
              && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq git curl ca-certificates \
                   zstd build-essential qemu-system-x86 ovmf-generic qemu-system-arm \
                   qemu-efi-aarch64 >> /tmp/apt.log 2>&1 \
              && break
            [ "$attempt" = 3 ] && { cat /tmp/apt.log; exit 1; }
            sleep 20
          done
          # `actions/checkout` sets this only in a config it discards.
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          curl --proto '=https' --tlsv1.2 -sSf -o "$RUNNER_TEMP/rustup-init.sh" https://sh.rustup.rs
          sh "$RUNNER_TEMP/rustup-init.sh" -y --profile minimal --default-toolchain stable
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ${{ inputs.sysroot-path }}
          key: ${{ inputs.sysroot-key }}
          fail-on-cache-miss: true

      - run: cargo run -- --ci guest

      # Every boot's 16550 log: what a guest that died early still leaves.
      - name: serial logs
        if: failure()
        continue-on-error: true
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          # One per lane: nightly calls this twice in one run.
          name: serial-${{ inputs.kvm && 'kvm' || 'tcg' }}
          path: target/red-run-serial/**/uart-*.log
          if-no-files-found: warn
          retention-days: 7