ci: migrate Rust + KVM sandbox lanes to self-hosted GCP KVM runner#576
Open
suchapalaver wants to merge 1 commit into
Open
ci: migrate Rust + KVM sandbox lanes to self-hosted GCP KVM runner#576suchapalaver wants to merge 1 commit into
suchapalaver wants to merge 1 commit into
Conversation
Move the rust-ci.yml jobs (changes, doctor, nextest, sandbox-adapter,
sandbox-adapter-image, sandbox-adapter-image-handoff) and the
sandbox-e2e-kvm.yml jobs from arc-runner-set / kvm-enabled to a
self-hosted GCP KVM runner (kvm-gcp) that auto-stops when idle.
Add a reusable start-kvm-runner.yml that wakes the GCE instance via
Workload Identity Federation before dependent jobs run. Every kvm-gcp
job gates on it transitively (start-runner -> changes -> rest). The
start step is idempotent (describes status first) and serialised by a
concurrency group so two runs don't race the gcloud start API.
The wake path only waits for runner re-registration when it actually
cold-booted the box, so warm runs don't burn the 60s sleep, and the
sleep operand stays valid on the workflow_dispatch path.
Install libdbus-1-dev (fnox -> keyring -> dbus-secret-service) and
libcap-ng-dev (microsandbox) explicitly in every Rust-build apt step.
The previous arc-runner-set / kvm-enabled images carried these; the
bare GCE box does not, and a repo-scoped target/ cache had been masking
the gap. Without them libdbus-sys' build script aborts ("dbus-1.pc
needs to be installed") on a cold cache.
claude-md-sync.yml and k8s-pilot-validation.yml still use
arc-runner-set, so that runner-set is intentionally retained.
on.push.branches stays [main]: the pull_request trigger already
exercises the full suite on kvm-gcp for this PR, so the runner is
validated without leaving main's push CI dead after merge.
suchapalaver
force-pushed
the
ci/gcp-kvm-runner
branch
from
e8ff3cb to
8b7469b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates the Rust CI and KVM sandbox-E2E lanes from
arc-runner-set/kvm-enabledto a self-hosted GCP KVM runner (kvm-gcp) that auto-stops when idle, plus a reusablestart-kvm-runner.ymlthat wakes the GCE instance via Workload Identity Federation before dependent jobs run.Supersedes #560 — same migration, rebased onto current
mainwith the review findings resolved.What changed
rust-ci.yml—changes,doctor,nextest,sandbox-adapter,sandbox-adapter-image,sandbox-adapter-image-handoffmove toruns-on: kvm-gcp. A newstart-runnerjob (reusable workflow) gates the lot transitively (start-runner → changes → rest).sandbox-e2e-kvm.yml—prepare-fixtureandkvm-e2emove fromkvm-enabledtokvm-gcp, gated on the samestart-runner.start-kvm-runner.yml(new) — reusable WIF-authenticated wake workflow. Idempotentstart(describes status first), serialised by aconcurrencygroup so concurrent runs don't race thegcloud startAPI.Review findings resolved (from #560)
on.push.branchesstays[main]— the test-scaffolding flip to the feature branch is gone, so post-merge push CI onmainkeeps firing.workflow_dispatchsleep operand —wait_secondsis now declared on bothworkflow_callandworkflow_dispatch, with asleep "${{ inputs.wait_seconds || 60 }}"shell default as a belt-and-suspenders guard.repository/ refusing fork subjects) in the workflow header, since both live outside this file.startstep actually cold-booted the instance (started=trueoutput), so warm runs don't burn it.Scope note
claude-md-sync.ymlandk8s-pilot-validation.ymlstill referencearc-runner-set— intentional partial migration, that runner-set is retained.Merge readiness
rust-ci.ymlis fully exercised by this PR: editing.github/workflows/rust-ci.ymltrips thesandboxpaths-filter, so the sandbox-adapter jobs run onkvm-gcptoo.sandbox-e2e-kvm.ymltriggers onworkflow_dispatch+ weeklyscheduleonly — not onpull_request. Manually dispatch it on this branch to validate itskvm-gcpmigration before merge.