ci: switch to kas-container (#846)

Doing the build with kas-container will satisfy our requirements as it
has most of the necessary tools. This container was created especially
to do yocto build and it already has a good community of users who use
it. Its development is quite active and has a significant group of
contributors.

This would also make things easier for our customers and end users as
they would only have to install docker or podman on their machines to
replicate what we do on our ci builds.


Inside the kas-container the directory tree is the following:

`/repo` is the meta-qcom layer
`/work` is the work directory with all the other layer, bitbake and also
the build dir:
```
/work
├── bitbake
├── build
├── meta-yocto
└── oe-core
```

When the KAS_WORK_DIR is not defined the `/repo` and `/work` have the
same content.

Author: quaresmajose

.github/workflows/build-yocto.yml

@@ -10,12 +10,19 @@ on:
 env:
   CACHE_DIR: /srv/gh-runners/quic-yocto
   KAS_REPO_REF_DIR: /srv/gh-runners/quic-yocto/kas-mirrors
+  KAS_CONTAINER: /srv/gh-runners/quic-yocto/kas-mirrors/kas-container
 
 jobs:
   kas-setup:
     if: github.repository == 'qualcomm-linux/meta-qcom'
     runs-on: [self-hosted, x86]
     steps:
+      - name: Update kas-container
+        run: |
+          LATEST=$(git ls-remote --tags --refs --sort="v:refname" https://github.com/siemens/kas | tail -n1 | sed 's/.*\///')
+          wget -qO ${KAS_CONTAINER} https://raw.githubusercontent.com/siemens/kas/refs/tags/$LATEST/kas-container
+          chmod +x ${KAS_CONTAINER}
+
       - name: Update kas mirrors
         run: |
           for r in $(find ${KAS_REPO_REF_DIR}/* -maxdepth 0 -type d); do
@@ -29,7 +36,7 @@ jobs:
 
       - name: Run kas lock
         run: |
-          kas dump --update --lock --inplace ci/base.yml
+          ${KAS_CONTAINER} dump --update --lock --inplace ci/base.yml
 
       - uses: actions/upload-artifact@v4
         with:
@@ -52,7 +59,7 @@ jobs:
 
       - name: Run yocto-check-layer
         run: |
-          ci/kas-shell-helper.sh ci/yocto-check-layer.sh
+          ci/kas-container-shell-helper.sh ci/yocto-check-layer.sh
 
   yocto-patchreview:
     needs: kas-setup
@@ -70,7 +77,7 @@ jobs:
 
       - name: Run Yocto patchreview
         run: |
-          ci/kas-shell-helper.sh ci/yocto-patchreview.sh
+          ci/kas-container-shell-helper.sh ci/yocto-patchreview.sh
 
   compile:
     needs: kas-setup
@@ -107,14 +114,14 @@ jobs:
           export SSTATE_DIR=${CACHE_DIR}/sstate-cache
           export KAS_WORK_DIR=$PWD/../kas
           mkdir $KAS_WORK_DIR
-          kas dump --resolve-env --resolve-local --resolve-refs \
+          ${KAS_CONTAINER} dump --resolve-env --resolve-local --resolve-refs \
               ci/mirror.yml:ci/${{ matrix.machine }}.yml > kas-build.yml
-          kas build ci/mirror.yml:ci/${{ matrix.machine }}.yml
-          ci/kas-shell-helper.sh ci/yocto-pybootchartgui.sh
+          ${KAS_CONTAINER} build ci/mirror.yml:ci/${{ matrix.machine }}.yml
+          ci/kas-container-shell-helper.sh ci/yocto-pybootchartgui.sh
           mv $KAS_WORK_DIR/build/buildchart.svg .
 
           if [ "${{ matrix.machine }}" = "qcom-armv8a" ]; then
-            kas build ci/mirror.yml:ci/${{ matrix.machine }}.yml:ci/initramfs-test.yml
+            ${KAS_CONTAINER} build ci/mirror.yml:ci/${{ matrix.machine }}.yml:ci/initramfs-test.yml
           fi
 
       - uses: actions/upload-artifact@v4

ci/kas-container-shell-helper.sh

@@ -0,0 +1,20 @@
+#!/bin/sh -e
+# Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+# SPDX-License-Identifier: MIT
+
+TOPDIR=$(realpath $(dirname $(readlink -f $0))/..)
+SCRIPT=$(realpath $1)
+
+if ! [ -f $SCRIPT ]; then
+    echo "The script path argument is missing, please run it with:"
+    echo " $0 /path/to/script"
+    exit 1
+fi
+
+# make it relative to the TOPDIR
+SCRIPT=${SCRIPT#$TOPDIR/}
+
+# on ci the kas-container is not on the default path
+KAS_CONTAINER=${KAS_CONTAINER:-$(which kas-container)}
+
+exec $KAS_CONTAINER shell $TOPDIR/ci/base.yml --command "/repo/$SCRIPT /repo /work"

ci/yocto-check-layer.sh

@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!/bin/bash -e
 # Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 # SPDX-License-Identifier: MIT
 
@@ -21,17 +21,23 @@ _is_dir(){
 _is_dir "$REPO_DIR"
 _is_dir "$WORK_DIR"
 
+# Creates a temporary build directory to run the yocto-check-layer
+# script to avoid a contaminated environment.
+BUILDDIR="$(mktemp -p $WORK_DIR -d -t build-yocto-check-layer-XXXX)"
+source $WORK_DIR/oe-core/oe-init-build-env $BUILDDIR
+git -c advice.detachedHead=false clone --quiet --shared $REPO_DIR meta-qcom
+
 # Yocto Project layer checking tool
-CMD="yocto-check-layer-wrapper"
+CMD="yocto-check-layer"
 # Layer to check
-CMD="$CMD $REPO_DIR"
+CMD="$CMD meta-qcom"
 # Disable auto layer discovery
 CMD="$CMD --no-auto"
 # Layers to process for dependencies
 CMD="$CMD --dependency $WORK_DIR/oe-core/meta"
 # Disable automatic testing of dependencies
 CMD="$CMD --no-auto-dependency"
 # Set machines to all machines defined in this BSP layer
-CMD="$CMD --machines $(echo $(find $REPO_DIR/conf/machine/ -maxdepth 1 -name *.conf -exec basename {} .conf \; ))"
+CMD="$CMD --machines $(echo $(find meta-qcom/conf/machine/ -maxdepth 1 -name *.conf -exec basename {} .conf \; ))"
 
 exec $CMD

ci/yocto-patchreview.sh

@@ -26,4 +26,4 @@ $WORK_DIR/oe-core/scripts/contrib/patchreview.py -v -b -j status.json $REPO_DIR
 
 # return an error if any malformed patch is found
 cat $WORK_DIR/build/status.json |
-    python -c "import json,sys;obj=json.load(sys.stdin); sys.exit(1) if 'malformed-sob' in obj[0] or 'malformed-upstream-status' in obj[0] else sys.exit(0)"
+    python3 -c "import json,sys;obj=json.load(sys.stdin); sys.exit(1) if 'malformed-sob' in obj[0] or 'malformed-upstream-status' in obj[0] else sys.exit(0)"