Merge pull request containerd#4159 from apostasie/ci-2025-04-ci-cleanup-b1

AkihiroSuda · web-flow · commit a84b0d7cc4a9 · 2025-04-26T10:39:09.000+09:00
[CI]: cleanup, breakout 1: `./hack`
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -45,8 +45,8 @@ jobs:
         run: |
           # If canary is specified, get the latest available golang pre-release instead of the major version
           if [ "${{ matrix.canary }}" != "" ]; then
-            . ./hack/build-integration-canary.sh
-            canary::golang::latest
+            . ./hack/provisioning/version/fetch.sh
+            printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
           fi
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
@@ -68,8 +68,8 @@ jobs:
           ctd_v="$("${args[@]}" https://api.github.com/repos/containerd/containerd/tags | jq -rc .[0].name)"
           echo "CONTAINERD_VERSION=${ctd_v:1}" >> "$GITHUB_ENV"
 
-          . ./hack/build-integration-canary.sh
-          canary::golang::latest
+          . ./hack/provisioning/version/fetch.sh
+          printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -82,7 +82,7 @@ jobs:
       - name: "Set up containerd"
         env:
           ctrdVersion: ${{ env.CONTAINERD_VERSION }}
-        run: powershell hack/configure-windows-ci.ps1
+        run: powershell hack/provisioning/windows/containerd.ps1
       - name: "Run integration tests"
         run: ./hack/test-integration.sh -test.only-flaky=false
       - name: "Run integration tests (flaky)"
diff --git a/.github/workflows/test-kube.yml b/.github/workflows/test-kube.yml
@@ -23,5 +23,5 @@ jobs:
       - name: "Run Kubernetes integration tests"
         # See https://github.com/containerd/nerdctl/blob/main/docs/testing/README.md#about-parallelization
         run: |
-          ./hack/build-integration-kubernetes.sh
+          ./hack/provisioning/kube/kind.sh
           sudo ./_output/nerdctl exec nerdctl-test-control-plane bash -c -- 'export TMPDIR="$HOME"/tmp; mkdir -p "$TMPDIR"; cd /nerdctl-source; /usr/local/go/bin/go test -p 1 ./cmd/nerdctl/... -test.only-kubernetes'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -369,7 +369,7 @@ jobs:
       - name: "Set up containerd"
         env:
           ctrdVersion: 1.7.27
-        run: powershell hack/configure-windows-ci.ps1
+        run: powershell hack/provisioning/windows/containerd.ps1
       - name: "Run integration tests"
         run: ./hack/test-integration.sh -test.only-flaky=false
       - name: "Run integration tests (flaky)"
diff --git a/.github/workflows/tigron.yml b/.github/workflows/tigron.yml
@@ -37,10 +37,9 @@ jobs:
           fetch-depth: 100
       - name: "Set GO env"
         run: |
-          # If canary is specified, get the latest available golang pre-release instead of the major version
           if [ "${{ matrix.canary }}" != "" ]; then
-            . ./hack/build-integration-canary.sh
-            canary::golang::latest
+            . ./hack/provisioning/version/fetch.sh
+            printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
           fi
       - name: "Install go"
         uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
diff --git a/hack/build-integration-canary.sh b/hack/build-integration-canary.sh
@@ -323,27 +323,3 @@ canary::golang::hublatest(){
 
   printf "%s" "$available_version"
 }
-
-canary::golang::latest(){
-  # Enable extended globbing features to use advanced pattern matching
-  shopt -s extglob
-
-  # Get latest golang version and split it in components
-  norm=()
-  while read -r line; do
-    line_trimmed="${line//+([[:space:]])/}"
-    norm+=("$line_trimmed")
-  done < \
-    <(sed -E 's/^go([0-9]+)[.]([0-9]+)([.]([0-9]+))?(([a-z]+)([0-9]+))?/\1.\2\n\4\n\6\n\7/i' \
-      <(curl -fsSL "https://go.dev/dl/?mode=json&include=all" | jq -rc .[0].version) \
-    )
-
-  # Serialize version, making sure we have a patch version, and separate possible rcX into .rc-X
-  [ "${norm[1]}" != "" ] || norm[1]="0"
-  norm[1]=".${norm[1]}"
-  [ "${norm[2]}" == "" ] || norm[2]="-${norm[2]}"
-  [ "${norm[3]}" == "" ] || norm[3]=".${norm[3]}"
-  # Save it
-  IFS=
-  echo "GO_VERSION=${norm[*]}" >> "$GITHUB_ENV"
-}
diff --git a/hack/provisioning/README.md b/hack/provisioning/README.md
@@ -0,0 +1,15 @@
+# Dependencies provisioning for integration testing
+
+This folder provides a set of scripts useful (for the CI) to configure hosts for
+the purpose of testing.
+
+While this is agnostic and would (probably) work outside the context of GitHub Actions,
+this is not the right way for people to install a functioning stack.
+Use provided installation scripts instead (see user documentation).
+
+## Contents
+
+- `/version` allows retrieving latest (or experimental) versions of certain products (golang, containerd, etc)
+- `/linux` allows updating in-place containerd, cni (future: buildkit)
+- `/windows` allows install WinCNI, containerd
+- `/kube` allows spinning-up a Kind cluster
diff --git a/hack/provisioning/kube/kind.sh b/hack/provisioning/kube/kind.sh
@@ -14,16 +14,19 @@
 #   See the License for the specific language governing permissions and
 #   limitations under the License.
 
-# shellcheck disable=SC2034,SC2015
 set -o errexit -o errtrace -o functrace -o nounset -o pipefail
 root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
 readonly root
 # shellcheck source=/dev/null
-. "$root/scripts/lib.sh"
+. "$root/../../scripts/lib.sh"
 
 GO_VERSION=1.24
 KIND_VERSION=v0.27.0
-CNI_PLUGINS_VERSION=v1.6.2
+CNI_PLUGINS_VERSION=v1.7.1
+# shellcheck disable=SC2034
+CNI_PLUGINS_SHA_AMD64=1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
+# shellcheck disable=SC2034
+CNI_PLUGINS_SHA_ARM64=119fcb508d1ac2149e49a550752f9cd64d023a1d70e189b59c476e4d2bf7c497
 
 [ "$(uname -m)" == "aarch64" ] && GOARCH=arm64 || GOARCH=amd64
 
@@ -55,19 +58,6 @@ install::kubectl(){
   host::install "$temp"/kubectl
 }
 
-install::cni(){
-  local version="$1"
-  local temp
-  temp="$(fs::mktemp "install")"
-
-  http::get "$temp"/cni.tgz "https://github.com/containernetworking/plugins/releases/download/$version/cni-plugins-${GOOS:-linux}-${GOARCH:-amd64}-$version.tgz"
-  sudo mkdir -p /opt/cni/bin
-  sudo tar xzf "$temp"/cni.tgz -C /opt/cni/bin
-  mkdir -p ~/opt/cni/bin
-  tar xzf "$temp"/cni.tgz -C ~/opt/cni/bin
-  rm "$temp"/cni.tgz
-}
-
 exec::kind(){
   local args=()
   [ ! "$_rootful" ] || args=(sudo env PATH="$PATH" KIND_EXPERIMENTAL_PROVIDER="$KIND_EXPERIMENTAL_PROVIDER")
@@ -92,16 +82,20 @@ main(){
   configure::rootful "${ROOTFUL:-}"
 
   log::info "Installing host dependencies if necessary"
+  host::require make go
   host::require kind 2>/dev/null || install::kind "$KIND_VERSION"
   host::require kubectl 2>/dev/null || install::kubectl
 
   # Build nerdctl to use for kind
-  make binaries
+  make -f "$root/../../../Makefile" binaries
   PATH=$(pwd)/_output:"$PATH"
   export PATH
 
   # Add CNI plugins
-  install::cni "$CNI_PLUGINS_VERSION"
+  local sha
+  sha="CNI_PLUGINS_SHA_$(tr "[:lower:]" "[:upper:]" <<<"$GOARCH")"
+  # shellcheck source=/dev/null
+  "$root"/../linux/cni.sh "$CNI_PLUGINS_VERSION" "$GOARCH" "${!sha}"
 
   # Hack to get go into kind control plane
   exec::nerdctl rm -f go-kind 2>/dev/null || true
@@ -113,7 +107,7 @@ main(){
   log::info "Creating new cluster"
   export KIND_EXPERIMENTAL_PROVIDER=nerdctl
   exec::kind delete cluster --name nerdctl-test 2>/dev/null || true
-  exec::kind create cluster --name nerdctl-test --config=./hack/kind.yaml
+  exec::kind create cluster --name nerdctl-test --config="$root"/kind.yaml
 }
 
 main "$@"
diff --git a/hack/provisioning/kube/kind.yaml b/hack/provisioning/kube/kind.yaml
diff --git a/hack/provisioning/linux/cni.sh b/hack/provisioning/linux/cni.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
+readonly root
+# shellcheck source=/dev/null
+. "$root/../../scripts/lib.sh"
+
+provision::cni::uninstall(){
+  [ "$(id -u)" == 0 ] || {
+    log::error "You need to be root"
+    return 1
+  }
+
+  rm -Rf /opt/cni/bin
+}
+
+# provision::containerd::cni will retrieve a specific version of cni plugins and extract it in place on the host
+provision::cni(){
+  local version="$1"
+  local arch="$2"
+  local bin_sha="$3"
+
+  cd "$(fs::mktemp "cni-install")"
+
+  http::get::secure \
+    cni.tgz \
+    https://github.com/containernetworking/plugins/releases/download/"$version"/cni-plugins-linux-"$arch"-"$version".tgz \
+    "$bin_sha"
+
+  sudo mkdir -p /opt/cni/bin
+  sudo tar -C /opt/cni/bin -xzf cni.tgz
+
+  cd - >/dev/null
+}
+
+provision::cni "$1" "$2" "$3"
diff --git a/hack/provisioning/linux/containerd.sh b/hack/provisioning/linux/containerd.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
+readonly root
+# shellcheck source=/dev/null
+. "$root/../../scripts/lib.sh"
+
+# provision::containerd::uninstall will ensure deb containerd are purged
+provision::containerd::uninstall(){
+  [ "$(id -u)" == 0 ] || {
+    log::error "You need to be root"
+    return 1
+  }
+
+  # Purge deb package
+  apt-get -q purge containerd* 2>/dev/null || true
+  # Remove conf
+  rm -f /etc/containerd/containerd.toml
+  # Remove manually installed containerd if leftover
+  systemctl stop containerd 2>/dev/null
+  rm -f /lib/systemd/system/containerd.service
+  systemctl daemon-reload 2>/dev/null || true
+  ! command -v containerd || rm -f "$(which containerd)"
+}
+
+# provision::containerd::rootful will retrieve a specific version of containerd and install it on the host.
+provision::containerd::rootful(){
+  local version="$1"
+  local arch="$2"
+  local bin_sha="$3"
+  local service_sha="$4"
+
+  # Be tolerant with passed versions - with or without leading "v"
+  [ "${version:0:1}" != "v" ] || version="${version:1}"
+
+  cd "$(fs::mktemp "containerd-install")"
+
+  # Get the binary and install it
+  http::get::secure \
+    containerd.tar.gz \
+    https://github.com/containerd/containerd/releases/download/v"$version"/containerd-"$version"-linux-"$arch".tar.gz \
+    "$bin_sha"
+
+  sudo tar::expand /usr/local containerd.tar.gz
+
+  # Get the systemd unit
+  http::get::secure \
+    containerd.service \
+    https://raw.githubusercontent.com/containerd/containerd/refs/tags/v"$version"/containerd.service \
+    "$service_sha"
+
+  sudo cp containerd.service /lib/systemd/system/containerd.service
+
+  # Start it
+  sudo systemctl daemon-reload
+  sudo systemctl start containerd
+
+  cd - >/dev/null || true
+}
+
+provision::containerd::rootful "$1" "$2" "$3" "$4"
diff --git a/hack/provisioning/version/fetch.sh b/hack/provisioning/version/fetch.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+
+# go::canary::for::go-setup retrieves the latest unstable golang version and format it for use by
+# https://github.com/actions/setup-go
+# Note that if the latest unstable is an old RC for the current stable, we print the empty string.
+go::canary::for::go-setup(){
+  local all_versions
+  local stable_major_minor
+  local canary_major_minor
+  local canary_full_version
+
+  # Get all golang versions
+  all_versions="$(curl -fsSL --proto '=https' --tlsv1.2 "https://go.dev/dl/?mode=json&include=all")"
+
+  # Get the latest stable release major.minor for comparison
+  read -r stable_major_minor < \
+    <(sed -E 's/^go([0-9]+[.][0-9]+).*/\1/i' \
+      <(jq -rc 'map(select(.stable==true)).[0].version' <<<"$all_versions") \
+    )
+
+  # Get the latest unstable release major.minor, and full version (formatted for use by go-setup)
+  read -r canary_major_minor canary_full_version < \
+    <(sed -E 's/^go([0-9]+)[.]([0-9]+)(([a-z]+)([0-9]+))?/\1.\2 \1.\2.0-\4.\5/i' \
+      <(jq -rc 'map(select(.stable==false)).[0].version' <<<"$all_versions") \
+    )
+
+  # If the latest RC is for the same major.minor as the latest stable one, then there is no canary, return empty string
+  [ "$canary_major_minor" != "$stable_major_minor" ] || return 0
+
+  # Otherwise, print the full version
+  printf "%s" "$canary_full_version"
+}
+
+# github::project::latest retrieves the latest tag from a github project
+github::project::latest(){
+  local project="$1"
+  local args
+
+  # Get latest
+  args=(curl -fsSL --proto '=https' --tlsv1.2 -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28")
+  [ "${GITHUB_TOKEN:-}" == "" ] && {
+    >&2 printf "GITHUB_TOKEN is not set - you might face rate limitations with the Github API\n"
+  } || args+=(-H "Authorization: Bearer $GITHUB_TOKEN")
+
+  "${args[@]}" https://api.github.com/repos/"$project"/tags | jq -rc .[0].name
+}
diff --git a/hack/provisioning/windows/cni.sh b/hack/provisioning/windows/cni.sh
diff --git a/hack/provisioning/windows/containerd.ps1 b/hack/provisioning/windows/containerd.ps1
diff --git a/hack/scripts/lib.sh b/hack/scripts/lib.sh
