vm_test.yml

name: custom VM spawner 
on:
  workflow_call:
    inputs:
      ref:
        type: string
        default: ''
      go_version:
        required: true
        type: string
      runner:
        type: string
        default: '["base", "dind", "2204"]'
      runner-archs:
        type: string
        default: '["amd64"]'
      runner-arch-map:
        type: string
        default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]'
      runc_version:
        required: true
        type: string
      containerd_version:
        required: true
        type: string
      cni_version:
        required: true
        type: string
      nerdctl_version:
        required: true
        type: string
      crictl_version:
        required: true
        type: string
      firecracker_version:
        required: true
        type: string
      cloud_hypervisor_version:
        required: true
        type: string
      solo5_version:
        required: true
        type: string
    secrets:
      GIT_CLONE_PAT:
        required: false

  workflow_dispatch:

permissions:
  contents: read

jobs:
  prepare:
    name: VM test
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        arch: ${{ fromJSON(inputs.runner-archs) }}
        test: ["test_ctr","test_nerdctl","test_crictl","test_docker"]
        include:
          - arch: amd64
            runner: ubuntu-22.04
          - arch: arm64
            runner: ubuntu-22.04-arm

    steps:
    - name: Validate inputs (prevent command injection)
      shell: bash
      env:
        GO_VERSION: ${{ inputs.go_version }}
        RUNC_VERSION: ${{ inputs.runc_version }}
        CONTAINERD_VERSION: ${{ inputs.containerd_version }}
        CNI_VERSION: ${{ inputs.cni_version }}
        NERDCTL_VERSION: ${{ inputs.nerdctl_version }}
        CRICTL_VERSION: ${{ inputs.crictl_version }}
        FIRECRACKER_VERSION: ${{ inputs.firecracker_version }}
        CLOUD_HYPERVISOR_VERSION: ${{ inputs.cloud_hypervisor_version }}
        SOLO5_VERSION: ${{ inputs.solo5_version }}
      run: |
        SAFE_GO_VERSION="$GO_VERSION"
        SAFE_RUNC_VERSION="$RUNC_VERSION"
        SAFE_CONTAINERD_VERSION="$CONTAINERD_VERSION"
        SAFE_CNI_VERSION="$CNI_VERSION"
        SAFE_NERDCTL_VERSION="$NERDCTL_VERSION"
        SAFE_CRICTL_VERSION="$CRICTL_VERSION"
        SAFE_FIRECRACKER_VERSION="$FIRECRACKER_VERSION"
        SAFE_CLOUD_HYPERVISOR_VERSION="$CLOUD_HYPERVISOR_VERSION"
        SAFE_SOLO5_VERSION="$SOLO5_VERSION"

        for var in SAFE_GO_VERSION SAFE_RUNC_VERSION SAFE_CONTAINERD_VERSION SAFE_CNI_VERSION SAFE_NERDCTL_VERSION SAFE_CRICTL_VERSION SAFE_FIRECRACKER_VERSION SAFE_CLOUD_HYPERVISOR_VERSION SAFE_SOLO5_VERSION; do
          value="${!var}"
          if ! [[ "$value" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
            echo "Invalid format for $var: $value"
            exit 1
          fi
        done


    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
      with:
        egress-policy: audit

    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

    - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
      with:
        go-version: ${{ inputs.go_version }}
        cache: false

    - name: Install base dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y git wget build-essential libseccomp-dev pkg-config bc make qemu-system
        wget https://s3.nbfc.io/nbfc-assets/github/urunc/bin/virtiofsd
        sudo chmod +x virtiofsd
        sudo mv virtiofsd /usr/libexec/virtiofsd

    - name: Install runc
      env:
        RUNC_VERSION: ${{ inputs.runc_version }}
      run: |
        SAFE_RUNC="${RUNC_VERSION}"
        wget -q "https://github.com/opencontainers/runc/releases/download/v${SAFE_RUNC}/runc.$(dpkg --print-architecture)"
        sudo install -m 755 runc.$(dpkg --print-architecture) /usr/local/sbin/runc
        rm -f ./runc.$(dpkg --print-architecture)

    - name: Install containerd
      env:
        CONTAINERD_VERSION: ${{ inputs.containerd_version }}
      run: |
        SAFE_CONTAINERD="${CONTAINERD_VERSION}"
        wget -q "https://github.com/containerd/containerd/releases/download/v${SAFE_CONTAINERD}/containerd-${SAFE_CONTAINERD}-linux-$(dpkg --print-architecture).tar.gz"
        sudo tar Cxzvf /usr/local "containerd-${SAFE_CONTAINERD}-linux-$(dpkg --print-architecture).tar.gz"
        rm -f "containerd-${SAFE_CONTAINERD}-linux-$(dpkg --print-architecture).tar.gz"

    - name: Set up containerd service
      env:
        CONTAINERD_VERSION: ${{ inputs.containerd_version }}
      run: |
        SAFE_CONTAINERD="$CONTAINERD_VERSION"
        wget -q "https://raw.githubusercontent.com/containerd/containerd/v${SAFE_CONTAINERD}/containerd.service"
        sudo rm -f /lib/systemd/system/containerd.service
        sudo mv containerd.service /lib/systemd/system/containerd.service
        sudo systemctl daemon-reload
        sudo systemctl enable --now containerd

    - name: Configure containerd
      run: |
        sudo mkdir -p /etc/containerd/
        sudo mv /etc/containerd/config.toml /etc/containerd/config.toml.bak || true
        sudo containerd config default | sudo tee /etc/containerd/config.toml
        sudo systemctl restart containerd

    - name: Setup devmapper
      run: |
        sudo mkdir -p /usr/local/bin/scripts
        sudo cp script/dm_create.sh /usr/local/bin/scripts/dm_create.sh
        sudo chmod 755 /usr/local/bin/scripts/dm_create.sh
        sudo /usr/local/bin/scripts/dm_create.sh
        sudo sed -i "/\[plugins\.'io\.containerd\.snapshotter\.v1\.devmapper'\]/,/^$/d" /etc/containerd/config.toml
        sudo tee -a /etc/containerd/config.toml > /dev/null <<'EOT'
        [plugins.'io.containerd.snapshotter.v1.devmapper']
          pool_name = "containerd-pool"
          root_path = "/var/lib/containerd/io.containerd.snapshotter.v1.devmapper"
          base_image_size = "10GB"
          fs_type = "ext2"
        EOT
        sudo tee -a /etc/containerd/config.toml > /dev/null <<EOT
        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.urunc]
            runtime_type = "io.containerd.urunc.v2"
            container_annotations = ["com.urunc.unikernel.*"]
            pod_annotations = ["com.urunc.unikernel.*"]
            snapshotter = "devmapper"
        EOT
        sudo systemctl restart containerd

    - name: Setup block-based mountpoint
      run: |
        mkdir /tmp/test_mountpoint
        dd if=/dev/zero of=/tmp/fake_block bs=1M count=200
        mkfs.ext2 /tmp/fake_block
        sudo mount /tmp/fake_block /tmp/test_mountpoint

    - name: Install CNI plugins
      env:
        CNI_VERSION: ${{ inputs.cni_version }}
      run: |
        SAFE_CNI="${CNI_VERSION}"
        wget -q "https://github.com/containernetworking/plugins/releases/download/v${SAFE_CNI}/cni-plugins-linux-$(dpkg --print-architecture)-v${SAFE_CNI}.tgz"
        sudo mkdir -p /opt/cni/bin
        sudo tar Cxzvf /opt/cni/bin "cni-plugins-linux-$(dpkg --print-architecture)-v${SAFE_CNI}.tgz"
        rm -f "cni-plugins-linux-$(dpkg --print-architecture)-v${SAFE_CNI}.tgz"

    - name: Install nerdctl
      env:
        NERDCTL_VERSION: ${{ inputs.nerdctl_version }}
      run: |
        SAFE_NERDCTL="${NERDCTL_VERSION}"
        wget -q "https://github.com/containerd/nerdctl/releases/download/v${SAFE_NERDCTL}/nerdctl-${SAFE_NERDCTL}-linux-$(dpkg --print-architecture).tar.gz"
        sudo tar Cxzvf /usr/local/bin "nerdctl-${SAFE_NERDCTL}-linux-$(dpkg --print-architecture).tar.gz"
        rm -f "nerdctl-${SAFE_NERDCTL}-linux-$(dpkg --print-architecture).tar.gz"

    - name: Install crictl
      env:
        CRICTL_VERSION: ${{ inputs.crictl_version }}
      run: |
        SAFE_CRI="${CRICTL_VERSION}"
        wget "https://github.com/kubernetes-sigs/cri-tools/releases/download/${SAFE_CRI}/crictl-${SAFE_CRI}-linux-${{ matrix.arch }}.tar.gz"
        sudo tar zxvf "crictl-${SAFE_CRI}-linux-${{ matrix.arch }}.tar.gz" -C /usr/local/bin
        rm -f "crictl-${SAFE_CRI}-linux-${{ matrix.arch }}.tar.gz"
        sudo tee -a /etc/crictl.yaml > /dev/null <<'EOT'
        runtime-endpoint: unix:///run/containerd/containerd.sock
        image-endpoint: unix:///run/containerd/containerd.sock
        timeout: 20
        EOT

    - name: Install Firecracker
      env:
        FC_VERSION: ${{ inputs.firecracker_version }}
      run: |
        SAFE_FC="${FC_VERSION}"
        ARCH="$(uname -m)"
        release_url="https://github.com/firecracker-microvm/firecracker/releases"
        curl -L "${release_url}/download/${SAFE_FC}/firecracker-${SAFE_FC}-${ARCH}.tgz" | tar -xz
        sudo mv "release-${SAFE_FC}-${ARCH}/firecracker-${SAFE_FC}-${ARCH}" /usr/local/bin/firecracker
        rm -fr "release-${SAFE_FC}-${ARCH}"

    - name: Install Cloud Hypervisor
      env:
        CLOUD_HYPERVISOR_VERSION: ${{ inputs.cloud_hypervisor_version }}
      run: |
        SAFE_CLOUD_HYPERVISOR="${CLOUD_HYPERVISOR_VERSION}"
        curl -sL "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/${SAFE_CLOUD_HYPERVISOR}/cloud-hypervisor-static" -o cloud-hypervisor
        chmod +x cloud-hypervisor
        sudo mv cloud-hypervisor /usr/local/bin/cloud-hypervisor

    - name: Install solo5
      env:
        SOLO5_VERSION: ${{ inputs.solo5_version }}
      run: |
        SAFE_SOLO5="${SOLO5_VERSION}"
        git clone -b "${SAFE_SOLO5}" https://github.com/Solo5/solo5.git
        cd solo5
        ./configure.sh && make -j$(nproc)
        sudo cp tenders/hvt/solo5-hvt /usr/local/bin
        sudo cp tenders/spt/solo5-spt /usr/local/bin

    - name: Download urunc artifact
      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
      with:
        name: urunc_static_${{ matrix.arch }}-${{ github.run_id }}
        path: ./

    - name: Download containerd-shim-urunc-v2 artifact
      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
      with:
        name: containerd-shim-urunc-v2_static_${{ matrix.arch }}-${{ github.run_id }}
        path: ./

    - name: Install urunc
      id: install-urunc
      run: |
        chmod +x urunc_static_${{ matrix.arch }}
        chmod +x containerd-shim-urunc-v2_static_${{ matrix.arch }}
        sudo mv urunc_static_${{ matrix.arch }} /usr/local/bin/urunc
        sudo mv containerd-shim-urunc-v2_static_${{ matrix.arch }} /usr/local/bin/containerd-shim-urunc-v2
        urunc --version

    - name: Configure urunc with debug logging
      run: |
        sudo mkdir -p /etc/urunc
        sudo tee /etc/urunc/config.toml > /dev/null <<'EOF'
        [log]
        level = "debug"
        syslog = true
        EOF

    - name: Add runner user to KVM group
      if: ${{ matrix.arch == 'amd64' }}
      id: kvm-setup
      run: |
        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
        sudo udevadm control --reload-rules
        sudo udevadm trigger --name-match=kvm
        sudo usermod -a -G kvm $USER

    - name: Prepare urunc folder
      id: prepare
      if: ${{ !cancelled() }}
      run: |
        export GOROOT=$(go env GOROOT)
        export PATH="$GOROOT/bin:$PATH"
        go version
        go env GOROOT
        make prepare

    - name: Run ${{ matrix.test }}
      id: test
      if: ${{ !cancelled() }}
      run: |
        # Set up Go environment properly
        export GOROOT=$(go env GOROOT)
        export PATH="$GOROOT/bin:$PATH"
        go version
        go env GOROOT
        if [ "${{ matrix.arch }}" = "arm64" ]; then
          sudo -E env "PATH=$PATH" "GOROOT=$GOROOT" make ${{ matrix.test }}_Spt
        else
          sudo -E env "PATH=$PATH" "GOROOT=$GOROOT" make ${{ matrix.test }}
        fi

    - name: Dump urunc logs on failure
      if: failure()
      run: |
        echo "=== urunc debug logs ==="
        sudo journalctl --identifier=urunc --no-pager