Update containerization apple main (#4)

Signed-off-by: Kathryn Baldauf <[email protected]>

Author: katiewasnothere

.github/workflows/build-test-images.yml

@@ -0,0 +1,62 @@
+name: Build and publish containerization test images
+
+on: 
+  workflow_dispatch: 
+    inputs: 
+      publish: 
+        type: boolean
+        description: "Publish the built image"
+        default: false
+      version: 
+        type: string
+        description: "Version of the image to create"
+        default: "test"
+      image:
+        type: choice
+        description: Test image to build
+        options:
+          - dockermanifestimage
+          - emptyimage
+        default: 'dockermanifestimage'
+      useBuildx:
+        type: boolean
+        description: "Use docker buildx to build the image"
+        default: false
+
+jobs: 
+  image: 
+    name: Build test images
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write 
+    steps:
+    - name: Check inputs
+      run: |
+        if [ ${{ inputs.image }} == 'dockermanifestimage' ] && [ ${{ inputs.useBuildx }} == true ]; then
+          echo "dockermanifestimage cannot be built with buildx"
+          exit 1
+        fi 
+
+        if [ ${{ inputs.image }} == 'emptyimage' ] && [ ${{ inputs.useBuildx}} != true ]; then
+          echo "emptyimage should be built with buildx"
+          exit 1
+        fi 
+    - name: Checkout repository
+      uses: actions/checkout@v4 
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Set up Docker Buildx
+      if: ${{ inputs.useBuildx }} 
+      uses: docker/setup-buildx-action@v3
+    - name: Build dockerfile and push image
+      uses: docker/build-push-action@v6
+      with:
+        push: ${{ inputs.publish }}
+        context: Tests/TestImages/${{ inputs.image }}
+        tags: ghcr.io/apple/containerization/${{ inputs.image }}:${{ inputs.version }}

.github/workflows/containerization-build-template.yml

@@ -69,8 +69,8 @@ jobs:
       - name: Push vminitd image
         if: ${{ inputs.release }}
         run: |
-          bin/cctl images tag vminit:latest ghcr.io/apple-uat/containerization/vminit:${{ inputs.version }}
-          bin/cctl images push ghcr.io/apple-uat/containerization/vminit:${{ inputs.version }}
+          bin/cctl images tag vminit:latest ghcr.io/apple/containerization/vminit:${{ inputs.version }}
+          bin/cctl images push ghcr.io/apple/containerization/vminit:${{ inputs.version }}
         env:
           REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REGISTRY_USERNAME: ${{ github.actor }}

.github/workflows/docs-release.yaml

@@ -1,22 +1,31 @@
+# Manual workflow for releasing docs ad-hoc. Workflow can only be run for main or release branches. 
+# Workflow does NOT publish a release of containerization.
 name: Deploy application website
 on: 
-  push: 
-    tags:
-      - "[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+
 permissions:
   contents: read
   packages: write
   pages: write
 
 jobs: 
+  checkBranch:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'ref/heads/release')
+    steps:
+      - name: Branch validation 
+        run: echo "Branch ${{ github.ref_name }} is allowed"
+
   buildSite:
     name: Build application website
+    needs: checkBranch
     uses: ./.github/workflows/containerization-build-template.yml
     secrets: inherit
 
-  deploy:
+  deployDocs:
     runs-on: ubuntu-latest
-    needs: buildSite
+    needs: [checkBranch, buildSite]
 
     environment:
       name: github-pages

.github/workflows/release.yml

@@ -5,13 +5,53 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
+permissions:
+  contents: read
+  packages: write
+  pages: write
+
 jobs: 
   containerization:
-    permissions:
-      contents: read
-      packages: write
     uses: ./.github/workflows/containerization-build-template.yml
     with: 
       release: true
-      version: ${{  github.ref_name }}
+      version: ${{ github.ref_name }}
     secrets: inherit
+  deployDocs:
+    runs-on: ubuntu-latest
+    needs: containerization
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
+  release: 
+    name: Publish release
+    timeout-minutes: 30
+    needs: containerization
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4 
+        with:
+          fetch-depth: 0
+      - name: Package sources
+        run: |
+          mkdir -p outputs
+          tar --exclude="./outputs" -czf outputs/sources.tar.gz .
+      - name: Create release
+        uses: softprops/action-gh-release@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          name: ${{ github.ref_name }}-prerelease
+          draft: true
+          make_latest: false
+          prerelease: true
+          fail_on_unmatched_files: true
+          files: |
+            outputs/sources.tar.gz

.gitignore

@@ -21,6 +21,9 @@ test_results/
 *.ext4
 *.pkg
 *.swp
+*.tar.gz
+*.tar.xz
+vmlinux
 
 # API docs for local preview only.
 _site/

CODE-OF-CONDUCT.md

@@ -0,0 +1,77 @@
+## Code of Conduct
+
+### Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our
+project and our community a harassment-free experience for everyone,
+regardless of age, body size, disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance,
+race, religion, or sexual identity and orientation.
+
+### Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual
+attention or advances
+* Trolling, insulting/derogatory comments, and personal or political
+attacks
+* Public or private harassment
+* Publishing others’ private information, such as a physical or
+electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+professional setting
+
+### Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of
+acceptable behavior and are expected to take appropriate and fair
+corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit,
+or reject comments, commits, code, wiki edits, issues, and other
+contributions that are not aligned to this Code of Conduct, or to ban
+temporarily or permanently any contributor for other behaviors that they
+deem inappropriate, threatening, offensive, or harmful.
+
+### Scope
+
+This Code of Conduct applies within all project spaces, and it also
+applies when an individual is representing the project or its community
+in public spaces. Examples of representing a project or community
+include using an official project e-mail address, posting via an
+official social media account, or acting as an appointed representative
+at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+### Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may
+be reported by contacting the open source team at
+[email protected]. All complaints will be reviewed and
+investigated and will result in a response that is deemed necessary and
+appropriate to the circumstances. The project team is obligated to
+maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted
+separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in
+good faith may face temporary or permanent repercussions as determined
+by other members of the project’s leadership.
+
+### Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://www.contributor-covenant.org), version 1.4, 
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html

Makefile

@@ -26,6 +26,8 @@ LIBARCHIVE_UPSTREAM_REPO := https://github.com/libarchive/libarchive
 LIBARCHIVE_UPSTREAM_VERSION := v3.7.7
 LIBARCHIVE_LOCAL_DIR := workdir/libarchive
 
+KATA_BINARY_PACKAGE := https://github.com/kata-containers/kata-containers/releases/download/3.17.0/kata-static-3.17.0-arm64.tar.xz
+
 include Protobuf.Makefile
 .DEFAULT_GOAL := all
 
@@ -55,7 +57,7 @@ containerization:
 init: vminitd
 	@echo Creating init.ext4...
 	@rm -f bin/init.rootfs.tar.gz bin/init.block
-	@./bin/cctl rootfs create --vminitd vminitd/bin/vminitd --labels org.opencontainers.image.source=https://github.com/apple-uat/containerization --vmexec vminitd/bin/vmexec bin/init.rootfs.tar.gz vminit:latest
+	@./bin/cctl rootfs create --vminitd vminitd/bin/vminitd --labels org.opencontainers.image.source=https://github.com/apple/containerization --vmexec vminitd/bin/vmexec bin/init.rootfs.tar.gz vminit:latest
 
 .PHONY: cross-prep
 cross-prep:
@@ -81,10 +83,24 @@ test:
 	@$(SWIFT) test --enable-code-coverage
 
 .PHONY: integration
-integration:
+integration: kernel-bin
 	@echo Running the integration tests...
 	@./bin/containerization-integration --bootlog ./bin/boot.log
 
+.PHONY: kernel-bin
+kernel-bin:
+	@mkdir -p .local/
+ifeq (,$(wildcard .local/kata.tar.gz))
+	@curl -SsL -o .local/kata.tar.gz ${KATA_BINARY_PACKAGE}
+endif
+ifeq (,$(wildcard .local/vmlinux))
+	@tar -zxf .local/kata.tar.gz -C .local/ --strip-components=1
+	@cp -L .local/opt/kata/share/kata-containers/vmlinux.container .local/vmlinux
+endif
+ifeq (,$(wildcard bin/vmlinux))
+	@cp .local/vmlinux bin/vmlinux
+endif
+
 .PHONY: fmt
 fmt:	swift-fmt update-licenses
 
@@ -107,7 +123,7 @@ check-licenses:
 	@.local/bin/hawkeye check --fail-if-unknown
 
 .PHONY: serve-docs
-serve-docs: site
+serve-docs:
 	@echo 'to browse: open http://127.0.0.1:8000/documentation/'
 	@python3 -m http.server --bind 127.0.0.1 --directory ./_site