Re: [PATCH 1/5] CI: Adjust test needs[] to ensure binaries/ is non-root

["Orzel, Michal" <michal.orzel@xxxxxxx>]

On 11-May-26 11:03, Andrew Cooper wrote:
> On 11/05/2026 7:16 am, Orzel, Michal wrote:
>>
>> On 08-May-26 23:29, Andrew Cooper wrote:
>>> The binaries/ directory is a composition from the artefacts, and also used 
>>> as
>>> a working directory for most of the tests.  If the very first artefact is 
>>> from
>>> a root container, then the test must also be a root container to use it as a
>>> working directory.
>>>
>>> For arm64, the existing linux-arm64 artefact suffices.  For arm32, pull in 
>>> the
>>> microcode-x86 artefact as it's the smallest available.  This bodge can be
>>> removed when all build containers have become non-root.
>>>
>>> For the qemu-xtf-dom0less-arm64-*-xen-version jobs, use *arm64-test-needs
>>> ahead of alpine-3.18-gcc-* (as it's a root container), and to deduplicate
>>> the *-export dependency.
>>>
>>> This will allow us to change containers to being non-root one at a time,
>>> rather than all in one go.
>>>
>>> No functional change.
>>>
>>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
>>> ---
>>> CC: Anthony PERARD <anthony.perard@xxxxxxxxxx>
>>> CC: Stefano Stabellini <sstabellini@xxxxxxxxxx>
>>> CC: Michal Orzel <michal.orzel@xxxxxxx>
>>> CC: Doug Goldstein <cardoe@xxxxxxxxxx>
>>>
>>> We should also stop using binaries/ as a working directory for the tests, 
>>> but
>>> that gets very complicated very quickly and I don't have time to do it at 
>>> this
>>> juncture.
>>> ---
>>>  automation/gitlab-ci/test.yaml | 10 ++++++++--
>>>  1 file changed, 8 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml
>>> index 8770c523e228..517af1732437 100644
>>> --- a/automation/gitlab-ci/test.yaml
>>> +++ b/automation/gitlab-ci/test.yaml
>>> @@ -15,6 +15,12 @@
>>>    - qemu-system-aarch64-6.0.0-arm64-export
>>>  
>>>  .arm32-test-needs: &arm32-test-needs
>>> +  # Bodge to ensure binaries/ is non-root.  Can be any artefact which comes
>>> +  # from a non-root container, and microcode-x86 is the smallest.  Remove 
>>> when
>>> +  # all build containers have become non-root.
>>> +  - project: $ARTIFACTS_REPO
>>> +    job: microcode-x86
>>> +    ref: $ARTIFACTS_BRANCH
>> I don't see it being removed in this series even though the containers are 
>> non-root.
> 
> Correct.  The Alpine container still being root is discussed in the
> commit message, and is why ...
> 
>>
>>>    - qemu-system-aarch64-6.0.0-arm32-export
>>>  
>>>  .x86-64-test-needs: &x86-64-test-needs
>>> @@ -569,16 +575,16 @@ qemu-xtf-dom0less-arm64-gcc-hyp-xen-version:
>>>    script:
>>>      - ./automation/scripts/qemu-xtf.sh arm64 mmu64le hyp-xen-version 2>&1 
>>> | tee ${LOGFILE}
>>>    needs:
>>> +    - *arm64-test-needs
> 
> ... why use here is ahead of ...
> 
> 
>> This also pulls in Linux image and rootfs which XTF tests don't need. I think
>> it's much better for a test to list the actual list of its dependencies.
>> Otherwise you are asking user/developer to dig into the yaml.
>>
>> ~Michal
>>
>>>      - alpine-3.18-gcc-arm64
>>> -    - qemu-system-aarch64-6.0.0-arm64-export
> 
> ... the alpine inclusion here.
> 
> This can get reverted once the alpine container is split/reworked, but
> not before.
Ok, so once the Alpine container is reworked, we will get back to proper
dependencies list. In that case:
Reviewed-by: Michal Orzel <michal.orzel@xxxxxxx>

~Michal