ci: add scheduled run of GHA CI #4760

kolyshkin · 2025-05-06T22:24:03Z

This is to ensure that our CI is not rotting away even if there are no new PRs or merges. This is especially useful for release branches which tend to cease working over time due to some external reasons.

Update: I was not sure it's possible, but it appears to work on my fork now, but here it needs #4763 to be merged first, ~~thus the draft status (until #4763 is merged).~~ Update2: dep PR is merged so this one is ready, too.

AkihiroSuda · 2025-05-07T01:34:30Z

.github/workflows/scheduled.yml

+      - name: Trigger ${{ matrix.wf_id }} workflow on ${{ matrix.branch}} branch
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}


Can we explicitly set permissions: for the token?

As far as I understand, permissions for this token are set in https://github.com/opencontainers/runc/settings/actions, under "Workflow permissions".

Also, the file itself sets permissions to create actions and read contents.

Would this work if we set there: "Read repository contents and packages permissions" and not set "Allow GitHub Actions to create and approve pull requests"?

This is needed by opencontainers#4760. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin · 2025-05-08T05:10:17Z

No longer a WIP but a draft waiting for #4763 to be merged first.

kolyshkin · 2025-05-13T20:03:31Z

@rata @lifubang @AkihiroSuda @cyphar ptal

cyphar · 2025-05-14T01:02:28Z

.github/workflows/scheduled.yml

@@ -0,0 +1,29 @@
+name: scheduled
+on:
+  schedule:


Is it not possible to add the cron schedule to the main CI job description? I've done this in other projects and I believe it used to work.

Ah, I guess the problem is that scheduled runs only work on the main branch not release branches?

Scheduled workflows will only run on the default branch.

In that case I think I would prefer including the scheduled job for the main branch in ci.yml and explicitly state this workflow is to run on old release branches.

Yes, this is why it's triggered indirectly. I guess we're mostly ok with main since new PRs pop out regularly.

Most problems we have are with the release branches -- like, you're about to cut a .z release and find out that nothing is working, and you need to backport 27 commits (the number is not entirely unrealistic) just for the CI to work again.

It would be nice to have a comment explaining the need for this, since my first thought was why not have the scheduled section added to ci.yml.

Added a comment.

cyphar · 2025-05-14T01:05:53Z

.github/workflows/scheduled.yml

+  trigger-workflow:
+    strategy:
+      matrix:
+        branch: ["main", "release-1.3"]


Did you want to include 1.2.z as well, since it's still supported?

I do, but I'd like to merge this first to see if it works and iron out any issues (it works on my fork but I'm not 100% sure it will work here).

Once 1.3 is working fine, I'll add 1.2 (which will need something similar to #4763 first, too).

rata · 2025-05-14T10:20:32Z

.github/workflows/validate.yml

+      - name: succeed (not a PR)
+        if: github.event_name != 'pull_request'
+        run: echo "Nothing to check here."


I guess this is needed because something inside the commit check thing needs to run to be marked as succeeded? In that case, can you add a comment explaining this?

First, I don't like this kludge myself, and so I spent some time to find a better way to do that (such as, adding commit job as a needs: to all-done conditionally), but nothing works. If there's a way that I missed, let me know.

Second, this code is added by a separate commit, with a decent explanation which can be found via git blame.

Here's a copy-paste from the commit message as it is:

gha/ci: allow validate/all-done to succeed for non-PRs

When we run CI not on a pull request, the commit job is skipped, as a
result, all-done is also skipped.

To allow all-done to succeed, modify the commit job to succeed for
non-PRs.

I've added another short comment to the .yml

rata · 2025-05-14T10:27:10Z

.github/workflows/scheduled.yml

+      - name: Trigger ${{ matrix.wf_id }} workflow on ${{ matrix.branch}} branch
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}


Would this work if we set there: "Read repository contents and packages permissions" and not set "Allow GitHub Actions to create and approve pull requests"?

rata

This mostly LGTM, I'm just curious about permissions and some more comments to avoid my future self some time :)

Commit 8742074 neglects to update the exclusion rules when bumping Go releases, and so we no longer exclude running on actuated with older Go release, or running with criu-dev with older Go release. Fixes: 8742074 ("CI: add Go 1.24, drop go1.22") Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

When we run CI not on a pull request, the commit job is skipped, as a result, all-done is also skipped. To allow all-done to succeed, modify the commit job to succeed for non-PRs. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

... or from another job. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

This is to ensure that our CI is not rotting away even if there are no new PRs or merges. This is especially useful for release branches which tend to cease working over time due to some external reasons. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin · 2025-05-14T23:23:36Z

from #4760 (comment):

Would this work if we set there: "Read repository contents and packages permissions" and not set "Allow GitHub Actions > to create and approve pull requests"?

(for some reason I could not answer in there, so copy-pasting the question and replying below)

I was writing that a week ago and at that time I

checked the permissions are adequate;
didn't find that we have excessive permissions set.

Unfortunately, I've already closed the tabs with the relevant documentation, but I remember it saying something like "A and B or C need to be set". I can't find where I read it, jumping through these pages:

kolyshkin force-pushed the sched branch from ca7a5ee to 958a92e Compare May 6, 2025 22:24

This comment was marked as outdated.

Sign in to view

kolyshkin marked this pull request as draft May 6, 2025 22:25

kolyshkin changed the title ~~ci: add scheduled run of GHA CI~~ [WIP] ci: add scheduled run of GHA CI May 6, 2025

AkihiroSuda reviewed May 7, 2025

View reviewed changes

kolyshkin force-pushed the sched branch from 958a92e to 37d5310 Compare May 8, 2025 02:23

kolyshkin added a commit to kolyshkin/runc that referenced this pull request May 8, 2025

[release-1.3] allow scheduled CI runs

a18aba7

This is needed by opencontainers#4760. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin mentioned this pull request May 8, 2025

[release-1.3] allow scheduled CI runs #4762

Closed

kolyshkin force-pushed the sched branch from 37d5310 to b62d897 Compare May 8, 2025 04:59

kolyshkin mentioned this pull request May 8, 2025

[1.3] ci fixes + support for scheduled ci jobs #4763

Merged

kolyshkin changed the title ~~[WIP] ci: add scheduled run of GHA CI~~ ci: add scheduled run of GHA CI May 8, 2025

kolyshkin requested a review from AkihiroSuda May 8, 2025 05:09

kolyshkin requested review from lifubang, thaJeztah and cyphar May 8, 2025 05:16

kolyshkin marked this pull request as ready for review May 13, 2025 20:01

kolyshkin force-pushed the sched branch from b62d897 to 7a58743 Compare May 13, 2025 20:01

lifubang approved these changes May 14, 2025

View reviewed changes

cyphar reviewed May 14, 2025

View reviewed changes

AkihiroSuda approved these changes May 14, 2025

View reviewed changes

rata reviewed May 14, 2025

View reviewed changes

kolyshkin added 4 commits May 14, 2025 15:57

gha/ci: allow validate/all-done to succeed for non-PRs

62e6ab6

When we run CI not on a pull request, the commit job is skipped, as a result, all-done is also skipped. To allow all-done to succeed, modify the commit job to succeed for non-PRs. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

ci/gha: allow to run jobs manually

74209b7

... or from another job. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin force-pushed the sched branch from 7a58743 to 995a39a Compare May 14, 2025 23:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add scheduled run of GHA CI #4760

ci: add scheduled run of GHA CI #4760

kolyshkin commented May 6, 2025 •

edited

Loading

This comment was marked as outdated.

AkihiroSuda May 7, 2025

kolyshkin May 8, 2025

rata May 14, 2025

kolyshkin commented May 8, 2025

kolyshkin commented May 13, 2025

cyphar May 14, 2025

cyphar May 14, 2025

kolyshkin May 14, 2025

cyphar May 14, 2025

kolyshkin May 14, 2025

cyphar May 14, 2025

kolyshkin May 14, 2025

rata May 14, 2025

kolyshkin May 14, 2025

rata May 14, 2025

rata left a comment

kolyshkin commented May 14, 2025

ci: add scheduled run of GHA CI #4760

Are you sure you want to change the base?

ci: add scheduled run of GHA CI #4760

Conversation

kolyshkin commented May 6, 2025 • edited Loading

This comment was marked as outdated.

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kolyshkin commented May 8, 2025

kolyshkin commented May 13, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rata left a comment

Choose a reason for hiding this comment

kolyshkin commented May 14, 2025

kolyshkin commented May 6, 2025 •

edited

Loading