chore(deps): prepare SDK 0.1.6rc2 for openYuanRong 0.10.2rc4 (#61) #247
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| sdk-unit-tests: | |
| name: Python SDK unit tests (${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: | |
| - "3.10" | |
| - "3.11" | |
| - "3.12" | |
| - "3.13" | |
| - "3.14" | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| cache-dependency-path: sdk/python/pyproject.toml | |
| - name: Install SDK dependencies | |
| run: | | |
| python -m pip install -e './sdk/python[all]' | |
| - name: Run unit tests | |
| run: | | |
| make sdk-test | |
| sdk-quality: | |
| name: Python SDK lint and type checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.10" | |
| cache: pip | |
| cache-dependency-path: sdk/python/pyproject.toml | |
| - name: Install SDK development dependencies | |
| run: | | |
| python -m pip install -e './sdk/python[dev]' | |
| - name: Run SDK quality checks | |
| run: | | |
| make sdk-check | |
| deployment-script-syntax: | |
| name: Deployment script syntax | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.10" | |
| - name: Check deployment script syntax | |
| run: | | |
| make deploy-script-check | |
| standalone-e2e: | |
| name: Standalone E2E | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize build submodules | |
| run: | | |
| git submodule update --init src/sandboxd | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| cache-dependency-path: sdk/python/pyproject.toml | |
| - name: Install SDK dependencies | |
| run: | | |
| python -m pip install -e './sdk/python[all]' | |
| - name: Prepare host kernel modules | |
| run: | | |
| sudo modprobe tun | |
| sudo modprobe loop | |
| sudo modprobe erofs | |
| sudo modprobe br_netfilter | |
| test -c /dev/net/tun | |
| sudo sysctl -w net.bridge.bridge-nf-call-iptables=1 | |
| - name: Build all-in-one image | |
| run: | | |
| AKERNEL_ENABLE_KATA=false \ | |
| make build \ | |
| IMAGE_REPOSITORY=akernel-ci/all-in-one \ | |
| IMAGE_TAG="${GITHUB_SHA}" \ | |
| RUNTIME_PROFILE=rrt | |
| - name: Verify systemd container identity in the image | |
| run: | | |
| docker image inspect "akernel-ci/all-in-one:${GITHUB_SHA}" \ | |
| --format '{{json .Config.Env}}' | \ | |
| python -c 'import json, sys; assert "container=oci" in json.load(sys.stdin)' | |
| - name: Start standalone AKernel | |
| run: | | |
| IMAGE="akernel-ci/all-in-one:${GITHUB_SHA}" \ | |
| AKERNEL_NAT_BACKEND=iptables \ | |
| ./deploy/standalone/start.sh | |
| - name: Verify PID 1 detects its container | |
| run: | | |
| docker exec akernel-node bash -euo pipefail -c ' | |
| tr "\0" "\n" < /proc/1/environ | grep -x "container=oci" | |
| test "$(cat /run/systemd/container)" = oci | |
| systemd-detect-virt --container | |
| ' | |
| - name: Run SDK end-to-end examples | |
| run: | | |
| gateway_ip="$(docker inspect \ | |
| --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' \ | |
| akernel-traefik)" | |
| test -n "${gateway_ip}" | |
| token="$(cat deploy/standalone/data/token)" | |
| export AKERNEL_TOKEN="${token}" | |
| export AKERNEL_SERVER_ADDRESS="${gateway_ip}" | |
| export PYTHONPATH="${GITHUB_WORKSPACE}/sdk/python" | |
| examples=( | |
| basic_usage.py | |
| command_stdin.py | |
| custom_image.py | |
| dockerfile_launch.py | |
| named_sandbox.py | |
| network_policy.py | |
| port_forwarding.py | |
| pty.py | |
| reverse_tunnel.py | |
| storage_sandbox.py | |
| ) | |
| for example in "${examples[@]}"; do | |
| echo "=== Running ${example} ===" | |
| timeout 120s python "sdk/python/examples/${example}" | |
| done | |
| - name: Run runsc checkpoint reload E2E | |
| run: | | |
| gateway_ip="$(docker inspect \ | |
| --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' \ | |
| akernel-traefik)" | |
| test -n "${gateway_ip}" | |
| token="$(cat deploy/standalone/data/token)" | |
| export AKERNEL_TOKEN="${token}" | |
| export AKERNEL_SERVER_ADDRESS="${gateway_ip}" | |
| export AKERNEL_RUN_INTEGRATION=1 | |
| export PYTHONPATH="${GITHUB_WORKSPACE}/sdk/python" | |
| AKERNEL_TEST_RUNTIME=runsc timeout 600s python \ | |
| sdk/python/tests/integration/test_sandbox.py \ | |
| SandboxReloadIntegrationTest -v | |
| - name: Show standalone diagnostics | |
| if: failure() | |
| run: | | |
| docker ps -a | |
| for container in akernel-node akernel-traefik; do | |
| if docker container inspect "${container}" >/dev/null 2>&1; then | |
| echo "=== ${container}: docker logs ===" | |
| docker logs --tail 500 "${container}" 2>&1 || true | |
| fi | |
| done | |
| if docker container inspect akernel-node >/dev/null 2>&1; then | |
| echo "=== akernel-node: service journal ===" | |
| docker exec akernel-node journalctl --no-pager -n 500 \ | |
| -u sandboxd.service -u yuanrong.service || true | |
| docker exec akernel-node bash -c ' | |
| shopt -s nullglob | |
| for logfile in \ | |
| /home/akernel/logs/sandboxd/sandboxd*.log \ | |
| /home/yuanrong/logs/*function_master*.log \ | |
| /home/yuanrong/logs/*function_proxy*.log \ | |
| /home/yuanrong/logs/*function_agent*.log \ | |
| /home/akernel/sandboxd/image_manager/daemons/*/daemon.log; do | |
| echo "=== ${logfile} ===" | |
| tail -n 300 "${logfile}" | |
| done | |
| ' || true | |
| fi | |
| - name: Stop standalone AKernel | |
| if: always() | |
| run: | | |
| if [[ -x ./deploy/standalone/stop.sh ]]; then | |
| ./deploy/standalone/stop.sh | |
| else | |
| docker rm -f akernel-traefik akernel-node >/dev/null 2>&1 || true | |
| fi |