Decouple actor lock TTL from workflow deadline via heartbeat (#14) #89
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Google LLC | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| name: pr-workflow | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Weekly run on the default branch keeps the micro-VM asset cache warm (GitHub | |
| # evicts caches idle for 7 days). The push-to-main run populates the cache that | |
| # PRs inherit; this refreshes it so PRs keep hitting it (no virtiofsd rebuild). | |
| - cron: '37 4 * * 1' | |
| jobs: | |
| run-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: 'go.mod' | |
| - run: go test -v ./... | |
| - name: verify | |
| run: hack/verify-all.sh | |
| # One kind cluster exercises BOTH runtimes. Free x86-64 ubuntu-latest runners | |
| # expose /dev/kvm (with a udev rule), so create-kind-cluster.sh mounts it and the | |
| # micro-VM (kata + cloud-hypervisor) sandbox class works alongside gVisor. | |
| e2e-test-matrix: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| auth-mode: [mtls, jwt] | |
| name: e2e-test (${{ matrix.auth-mode }}) | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Free disk space | |
| # The micro-VM guest image/kernel + cloud-hypervisor + kind node image + | |
| # control-plane images + snapshots are tight on the ~14GB runner disk. | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL | |
| df -h / | |
| - name: Cache micro-VM assets | |
| id: microvm-assets | |
| uses: actions/cache@v4 | |
| with: | |
| # Assembling the assets (download kata-static + cloud-hypervisor, build | |
| # virtiofsd from source for the overlay rootfs) is the slow part and is fully | |
| # pinned by assemble.sh, so key the cache on its hash. The push-to-main run | |
| # populates the default-branch cache PRs inherit; the weekly schedule refreshes | |
| # it. run-microvm-demo-kind.sh skips assembling when these are present. | |
| path: bin/microvm-assets/amd64 | |
| key: microvm-assets-amd64-${{ hashFiles('hack/microvm-assets/assemble.sh') }} | |
| - name: Install micro-VM asset build deps | |
| # Only needed when (re)assembling (cache miss): building virtiofsd from source. | |
| if: steps.microvm-assets.outputs.cache-hit != 'true' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends libcap-ng-dev libseccomp-dev pkg-config | |
| curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y | |
| echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" | |
| - name: Enable KVM | |
| # Grant the runner access to /dev/kvm so create-kind-cluster.sh mounts it into | |
| # the node and labels it for the micro-VM sandbox class. | |
| run: | | |
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \ | |
| | sudo tee /etc/udev/rules.d/99-kvm4all.rules | |
| sudo udevadm control --reload-rules | |
| sudo udevadm trigger --name-match=kvm | |
| - name: Create cluster | |
| run: hack/create-kind-cluster.sh | |
| - name: Install Agent Substrate | |
| run: hack/install-ate-kind.sh --deploy-ate-system --auth-mode=${{ matrix.auth-mode }} | |
| - name: Deploy micro-VM counter demo | |
| # Stages the (cached) assets into the cluster's rustfs and applies the | |
| # counter-microvm demo onto the control plane installed above. | |
| run: hack/run-microvm-demo-kind.sh --auth-mode=${{ matrix.auth-mode }} | |
| - name: Deploy gVisor counter demo | |
| run: hack/install-ate-kind.sh --deploy-demo-counter | |
| - name: Wait for micro-VM golden snapshot | |
| run: | | |
| kubectl --context kind-kind wait --for=condition=Ready \ | |
| actortemplate/counter-microvm -n ate-demo-counter-microvm --timeout=600s | |
| - name: Run E2E tests (gVisor) | |
| run: hack/run-e2e-kind.sh -v -args --no-color | |
| - name: Run E2E tests (micro-VM) | |
| # Same demo lifecycle suite (create -> suspend -> resume -> in-RAM continuity), | |
| # pointed at the micro-VM counter via env (see createActorTemplate in demo_test.go). | |
| env: | |
| E2E_TEMPLATE_NAMESPACE: ate-demo-counter-microvm | |
| E2E_TEMPLATE_NAME: counter-microvm | |
| E2E_TEMPLATE_READY_TIMEOUT: 600s | |
| run: hack/run-e2e-kind.sh ./internal/e2e/suites/demo -v -args --no-color | |
| - name: Dump diagnostics on failure | |
| if: failure() | |
| run: | | |
| kubectl --context kind-kind get actortemplate,workerpool,pods -A -o wide || true | |
| for ns in ate-demo-counter-microvm ate-demo-counter ate-system; do | |
| for p in $(kubectl --context kind-kind get pods -n "$ns" -o name 2>/dev/null); do | |
| echo "=== logs: $ns/$p ===" | |
| kubectl --context kind-kind logs -n "$ns" "$p" --all-containers --tail=200 2>/dev/null || true | |
| done | |
| done | |
| e2e-test: | |
| runs-on: ubuntu-latest | |
| needs: e2e-test-matrix | |
| if: always() | |
| steps: | |
| - name: Check E2E matrix | |
| run: | | |
| if [ "${{ needs.e2e-test-matrix.result }}" != "success" ]; then | |
| echo "e2e-test-matrix result: ${{ needs.e2e-test-matrix.result }}" | |
| exit 1 | |
| fi |