Skip to content

Commit 8363b56

Browse files
frankdavidbasvandijk
frankdavid
and
basvandijk
authored
chore: Extract Bazel Test Bare Metal job from schedule‑daily (#10582)
We can limit the secrets the workflow needs access to, so it's less risky if we ever want to run the workflow on non-submitted branches. --------- Co-authored-by: Bas van Dijk <bas@dfinity.org>
1 parent e455f73 commit 8363b56

3 files changed

Lines changed: 66 additions & 50 deletions

File tree

‎.github/workflows/schedule-daily-bare-metal.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Schedule Daily Bare Metal tests
2+
3+
on:
4+
schedule:
5+
- cron: "47 1 * * *" # 1:47 UTC - slightly offset to avoid high-load times of other scheduled workflows
6+
workflow_dispatch:
7+
8+
env:
9+
CI_JOB_NAME: ${{ github.job }}
10+
11+
jobs:
12+
bazel-test-bare-metal:
13+
name: Bazel Test Bare Metal
14+
runs-on: &dind-large-setup
15+
labels: dind-large
16+
container: &container-setup
17+
image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
18+
options: >-
19+
-e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
20+
environment: Bare Metal Tests
21+
steps:
22+
- &checkout
23+
name: Checkout
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
- name: Run Bazel Launch Bare Metal
26+
uses: ./.github/actions/bazel
27+
with:
28+
run: |
29+
echo "$ZH2_DLL01_INI_SECRET" > file1
30+
echo "$ZH2_FILE_SHARE_KEY" > file2 && chmod 400 file2
31+
32+
launch_bare_metal() {
33+
34+
# shellcheck disable=SC2046,SC2086
35+
bazel run \
36+
//ic-os/setupos/envs/dev:launch_bare_metal -- \
37+
--config_path "$(realpath ./ic-os/dev-tools/bare_metal_deployment/zh2-dll01.yaml)" \
38+
--ini_filename "$(realpath file1)" \
39+
--file_share_ssh_key "$(realpath file2)" \
40+
--inject_image_pub_key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK3gjE/2K5nxIBbk3ohgs8J5LW+XiObwA+kGtSaF5+4c" \
41+
--file_share_username ci_interim \
42+
--ci_mode \
43+
$@
44+
}
45+
46+
# Run bare metal installation test
47+
launch_bare_metal --hsm
48+
49+
# Run bare metal node performance benchmarks
50+
launch_bare_metal --benchmark
51+
52+
# Run bare metal node hostOS metrics check
53+
launch_bare_metal --check_hostos_metrics
54+
55+
# Run SEV tests
56+
bazel test //rs/tests/nested:guestos_upgrade_from_current_to_current_test_sev --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
57+
bazel test //rs/tests/nested:guestos_upgrade_from_latest_release_to_current_sev --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
58+
bazel test //rs/tests/nested:hostos_upgrade_from_latest_release_to_current_sev --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
59+
bazel test //rs/tests/nested:sev_recovery --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
60+
61+
bazel clean
62+
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
63+
env:
64+
ZH2_DLL01_INI_SECRET: "${{ secrets.ZH2_DLL01_INI_SECRET }}"
65+
ZH2_FILE_SHARE_KEY: "${{ secrets.ZH2_FILE_SHARE_KEY }}"

‎.github/workflows/schedule-daily.yml‎

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -76,55 +76,6 @@ jobs:
7676
--keep_going --test_timeout=7200
7777
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
7878

79-
bazel-test-bare-metal:
80-
name: Bazel Test Bare Metal
81-
runs-on: *dind-large-setup
82-
container: *container-setup
83-
environment: Nightly Tests
84-
steps:
85-
- *checkout
86-
- name: Run Bazel Launch Bare Metal
87-
uses: ./.github/actions/bazel
88-
with:
89-
run: |
90-
echo "$ZH2_DLL01_INI_SECRET" > file1
91-
echo "$ZH2_FILE_SHARE_KEY" > file2 && chmod 400 file2
92-
93-
launch_bare_metal() {
94-
95-
# shellcheck disable=SC2046,SC2086
96-
bazel run \
97-
//ic-os/setupos/envs/dev:launch_bare_metal -- \
98-
--config_path "$(realpath ./ic-os/dev-tools/bare_metal_deployment/zh2-dll01.yaml)" \
99-
--ini_filename "$(realpath file1)" \
100-
--file_share_ssh_key "$(realpath file2)" \
101-
--inject_image_pub_key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK3gjE/2K5nxIBbk3ohgs8J5LW+XiObwA+kGtSaF5+4c" \
102-
--file_share_username ci_interim \
103-
--ci_mode \
104-
$@
105-
}
106-
107-
# Run bare metal installation test
108-
launch_bare_metal --hsm
109-
110-
# Run bare metal node performance benchmarks
111-
launch_bare_metal --benchmark
112-
113-
# Run bare metal node hostOS metrics check
114-
launch_bare_metal --check_hostos_metrics
115-
116-
# Run SEV tests
117-
bazel test //rs/tests/nested:guestos_upgrade_from_current_to_current_test_sev --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
118-
bazel test //rs/tests/nested:guestos_upgrade_from_latest_release_to_current_sev --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
119-
bazel test //rs/tests/nested:hostos_upgrade_from_latest_release_to_current_sev --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
120-
bazel test //rs/tests/nested:sev_recovery --test_env=BARE_METAL_HOST_SECRETS="$(realpath file1)"
121-
122-
bazel clean
123-
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
124-
env:
125-
ZH2_DLL01_INI_SECRET: "${{ secrets.ZH2_DLL01_INI_SECRET }}"
126-
ZH2_FILE_SHARE_KEY: "${{ secrets.ZH2_FILE_SHARE_KEY }}"
127-
12879
nns-tests-nightly:
12980
name: Bazel Test NNS Nightly
13081
runs-on: *dind-large-setup

‎ic-os/guestos/README.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ link:docs/README.adoc#[docs/ subdirectory]
3939
== Performance Benchmarking
4040

4141
Performance benchmarks are run in GuestOS, on hardware, every day during the nightly
42-
link:../../.github/workflows-source/schedule-daily.yml[`Bazel Test Bare Metal`] job.
42+
link:../../.github/workflows-source/schedule-daily-bare-metal.yml[`Bazel Test Bare Metal`] job.
4343

4444
This job runs commands from link:../dev-tools/bare_metal_deployment/benchmark_runner.sh[`benchmark_runner.sh`],
4545
and expects that results are placed into the `results` folder on the node. All results are then

0 commit comments

Comments
 (0)