kernel.yml

name: Kernel

# The guest kernel, for the same reason QEMU has its own workflow: compiling it is tens of
# minutes and the merge gate must not wait for it.
#
# It matters more than a build time, though: a changed kernel is every guest's next boot. It
# does not strand checkpoints - a resumed guest runs the kernel in its saved memory, and the
# fingerprint is the machine's contract, not this binary - but the job prints the checksum of
# what it produced, so a config change is something somebody looked at.

on:
# kernel/**, and versions.yaml when it moves the kernel or its toolchain; see the note in
# qemu.yml.
  push:
    branches: [main]
    paths:
      - kernel/**
      - versions.yaml
      - go.mod
      - .github/workflows/kernel.yml
  pull_request:
    paths:
      - kernel/**
      - versions.yaml
      - go.mod
      - .github/workflows/kernel.yml
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: kernel-${{ github.head_ref || github.ref_name }}
  # Never on main: a cancelled run there is a commit nobody proved.
  cancel-in-progress: ${{ github.ref_name != 'main' }}

jobs:
  # Whether this change can reach the kernel; see the note in qemu.yml.
  changed:
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 10
    outputs:
      build: ${{ steps.touches.outputs.build }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Does the change reach the kernel
        id: touches
        env:
          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          build=$(hack/touches "$BASE" debian debian-snapshot kernel moby-check-config -- \
            kernel go.mod .github/workflows/kernel.yml)
          echo "build=${build}" | tee -a "$GITHUB_OUTPUT"

  build:
    needs: changed
    if: needs.changed.outputs.build == 'true'
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 180
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # The Taskfile hands the build its pins with `go tool versions`.
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Task
        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0

      # One sticky disk per thing built, and no silent fallback; see the note in qemu.yml.
      - name: Setup Blacksmith Builder
        uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184 # v2.2.0
        with:
          cache-key: spin-machine/kernel
          nofallback: true

      # Without this, `--cache-to type=gha` below is a silent no-op: the tokens BuildKit
      # needs reach JavaScript actions and not `run:` steps. See the long note in qemu.yml.
      - name: Expose the Actions cache to buildx
        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0

      # Ends in `task kernel:verify`, which opens the ELF and checks the Xen PVH notes
      # survived the strip. Without them QEMU has no entry point into this kernel and the
      # failure is a VM that does not start, in whichever lane boots one next.
      - name: Build the kernel
        run: |
          CACHE_EXPORT=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} CACHE_BACKEND=gha task kernel:build KERNEL_NPROC=4

      # What it produced, on the run's summary: a pull request that changes the config, or
      # bumps the Debian toolchain the kernel is compiled with, changes every guest's next
      # boot, and the change that does it need not look like much. Checkpoints are not
      # affected: the kernel is not in the fingerprint (machine.Spec.Fingerprint).
      - name: What this kernel is
        run: |
          set -euo pipefail
          {
            echo "kernel sha256: $(sha256sum _output/kernel/vmlinux | cut -d' ' -f1)"
            echo "config sha256: $(sha256sum _output/kernel/kernel-config | cut -d' ' -f1)"
          } | tee -a "$GITHUB_STEP_SUMMARY"

      - name: Upload the kernel
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vmlinux-${{ github.sha }}
          path: |
            _output/kernel/vmlinux
            _output/kernel/kernel-config
          retention-days: 30
          if-no-files-found: error