Skip to content

Commit e73abe2

Browse files
fidenciofidencio
committed
runtime: Add a CI specific dependency
Although not used yet, this will help us immensely to test development versions of Kata Containers, and catch issues on our integration as soon as possible. Let's add a new action to ensure we don't accidentaly add / push the CI specific dependency as part of the release. The action itself was heavily vibe coded using Cursor AI. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
1 parent c4335dd commit e73abe2

File tree

7 files changed

+192
-2
lines changed

7 files changed

+192
-2
lines changed

‎.github/workflows/chart-lock-check.yaml‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
name: Chart.lock Validation
2+
3+
on:
4+
pull_request:
5+
types:
6+
- edited
7+
- opened
8+
- reopened
9+
- synchronized
10+
11+
jobs:
12+
validate-chart-lock:
13+
name: Validate Chart.lock
14+
runs-on: ubuntu-22.04
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
with:
19+
fetch-depth: 0
20+
21+
- name: Check Chart.lock for 0.0.0-dev entries
22+
id: check
23+
run: |
24+
echo "🔍 Checking Chart.lock for 0.0.0-dev entries..."
25+
26+
if [ ! -f Chart.lock ]; then
27+
echo "ℹ️ No Chart.lock file found"
28+
echo "has_dev_version=false" >> $GITHUB_OUTPUT
29+
exit 0
30+
fi
31+
32+
# Check if Chart.lock contains 0.0.0-dev version
33+
if grep -q "version: 0.0.0-dev" Chart.lock; then
34+
echo "❌ Found 0.0.0-dev in Chart.lock"
35+
echo "has_dev_version=true" >> $GITHUB_OUTPUT
36+
37+
echo ""
38+
echo "Problematic entries:"
39+
grep -B2 -A2 "version: 0.0.0-dev" Chart.lock || true
40+
41+
echo ""
42+
echo "::error::Chart.lock contains 0.0.0-dev entries that must be removed"
43+
44+
else
45+
echo "✅ No 0.0.0-dev entries found in Chart.lock"
46+
echo "has_dev_version=false" >> $GITHUB_OUTPUT
47+
fi
48+
49+
- name: Add comment to PR
50+
if: steps.check.outputs.has_dev_version == 'true'
51+
run: |
52+
gh pr comment ${{ github.event.pull_request.number }} --body "## ❌ Chart.lock Contains 0.0.0-dev Entries
53+
54+
Found \`0.0.0-dev\` entries in \`Chart.lock\` that must be removed.
55+
56+
**Why this is a problem:**
57+
The \`kata-as-coco-runtime-for-ci\` dependency uses \`version: 0.0.0-dev\` which is:
58+
- Only for CI testing
59+
- Not a real release
60+
- Should never be committed to Chart.lock
61+
62+
**How to fix:**
63+
64+
Manually edit Chart.lock to remove the entire dependency block containing \`version: 0.0.0-dev\`:
65+
66+
\`\`\`yaml
67+
# Remove this entire block from Chart.lock:
68+
- name: kata-deploy
69+
repository: oci://ghcr.io/kata-containers/kata-deploy-charts
70+
version: 0.0.0-dev
71+
\`\`\`
72+
73+
Then commit and push:
74+
\`\`\`bash
75+
git add Chart.lock
76+
git commit -m \"fix: Remove 0.0.0-dev from Chart.lock\"
77+
git push
78+
\`\`\`
79+
80+
**Why not regenerate with helm dependency update?**
81+
Running \`helm dependency update\` would add the 0.0.0-dev entry back. This entry only exists for CI testing and should never be in Chart.lock.
82+
83+
**Prevention:**
84+
Chart.lock is managed by CI/CD workflows. Don't manually run \`helm dependency update\` - the prepare-release script handles updates correctly."
85+
env:
86+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
87+
88+
- name: Fail if 0.0.0-dev found
89+
if: steps.check.outputs.has_dev_version == 'true'
90+
run: |
91+
echo "::error::Chart.lock contains 0.0.0-dev entries that must be removed"
92+
exit 1
93+
94+
- name: Summary
95+
if: always()
96+
run: |
97+
if [ "${{ steps.check.outputs.has_dev_version }}" = "true" ]; then
98+
cat >> $GITHUB_STEP_SUMMARY << 'EOF'
99+
## ❌ Chart.lock Validation Failed
100+
101+
Found `0.0.0-dev` entries in Chart.lock that must be removed.
102+
103+
### Why this is a problem
104+
105+
The `kata-as-coco-runtime-for-ci` dependency uses `version: 0.0.0-dev` which is:
106+
- Only used for CI testing
107+
- Not a real release
108+
- Should never be committed to Chart.lock
109+
110+
### How to fix
111+
112+
Manually edit Chart.lock to remove the entire dependency block containing `version: 0.0.0-dev`:
113+
114+
```yaml
115+
# Remove this entire block:
116+
- name: kata-deploy
117+
repository: oci://ghcr.io/kata-containers/kata-deploy-charts
118+
version: 0.0.0-dev
119+
```
120+
121+
Then commit:
122+
```bash
123+
git add Chart.lock
124+
git commit -m "fix: Remove 0.0.0-dev from Chart.lock"
125+
git push
126+
```
127+
128+
### Why not regenerate?
129+
130+
**Don't run `helm dependency update`** - it will add 0.0.0-dev back.
131+
This entry only exists for CI testing.
132+
133+
### Prevention
134+
135+
- Chart.lock is managed by CI/CD workflows
136+
- The prepare-release script handles updates correctly
137+
- Don't manually run `helm dependency update`
138+
EOF
139+
else
140+
echo "## ✅ Chart.lock Validated" >> $GITHUB_STEP_SUMMARY
141+
echo "" >> $GITHUB_STEP_SUMMARY
142+
echo "No \`0.0.0-dev\` entries found in Chart.lock." >> $GITHUB_STEP_SUMMARY
143+
fi
144+

‎Chart.lock‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@ dependencies:
22
- name: kata-deploy
33
repository: oci://ghcr.io/kata-containers/kata-deploy-charts
44
version: 3.21.0
5-
digest: sha256:b977d4d978dba0ba373655e26101006178d8e5a63fec3f7cf9a79529d8e59684
6-
generated: "2025-10-24T16:35:30.992306339+02:00"
5+
digest: sha256:65eb9c198f907fb4eb18a8b8679b3ec624c34008516ada467382463baab6a5c0
6+
generated: "2025-10-24T17:10:59.456732835+02:00"

‎Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,8 @@ dependencies:
1818
version: "3.21.0"
1919
repository: "oci://ghcr.io/kata-containers/kata-deploy-charts"
2020
condition: kata-as-coco-runtime.enabled
21+
- name: kata-deploy
22+
alias: kata-as-coco-runtime-for-ci
23+
version: "0.0.0-dev"
24+
repository: "oci://ghcr.io/kata-containers/kata-deploy-charts"
25+
condition: kata-as-coco-runtime-for-ci.enabled

‎values.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,16 @@ kata-as-coco-runtime:
6565
# - values/kata-aarch64.yaml for ARM64
6666
# - values/kata-remote.yaml for peer-pods
6767
<<: *x86_64_shims
68+
69+
# Optional: CI variant using upstream kata-containers-latest
70+
# Disabled by default. Uses same shims as CoCo runtime but different image.
71+
# Enable with: --set kata-as-coco-runtime-for-ci.enabled=true
72+
kata-as-coco-runtime-for-ci:
73+
enabled: false
74+
<<: *commonConfig
75+
76+
env:
77+
debug: "true"
78+
<<: *x86_64_shims
79+
_experimentalSetupSnapshotter: "nydus"
80+
_experimentalForceGuestPull: ""

‎values/kata-aarch64.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,13 @@ kata-as-coco-runtime:
2222
env:
2323
debug: "false"
2424
<<: *aarch64_shims
25+
26+
kata-as-coco-runtime-for-ci:
27+
<<: *commonConfig
28+
29+
env:
30+
debug: "true"
31+
<<: *aarch64_shims
32+
_experimentalSetupSnapshotter: "nydus"
33+
_experimentalForceGuestPull: ""
34+

‎values/kata-remote.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,12 @@ kata-as-coco-runtime:
2020
env:
2121
debug: "false"
2222
<<: *remote_shims
23+
24+
kata-as-coco-runtime-for-ci:
25+
<<: *commonConfig
26+
27+
env:
28+
debug: "true"
29+
<<: *remote_shims
30+
_experimentalSetupSnapshotter: "nydus"
31+
_experimentalForceGuestPull: ""

‎values/kata-s390x.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,12 @@ kata-as-coco-runtime:
2222
env:
2323
debug: "false"
2424
<<: *s390x_shims
25+
26+
kata-as-coco-runtime-for-ci:
27+
<<: *commonConfig
28+
29+
env:
30+
debug: "true"
31+
<<: *s390x_shims
32+
_experimentalSetupSnapshotter: "nydus"
33+
_experimentalForceGuestPull: ""

0 commit comments

Comments
 (0)