Re: [PATCH 1/5] CI: Adjust test needs[] to ensure binaries/ is non-root

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 11/05/2026 10:06 am, Orzel, Michal wrote:
>
> On 11-May-26 11:03, Andrew Cooper wrote:
>> On 11/05/2026 7:16 am, Orzel, Michal wrote:
>>> On 08-May-26 23:29, Andrew Cooper wrote:
>>>> The binaries/ directory is a composition from the artefacts, and also used 
>>>> as
>>>> a working directory for most of the tests.  If the very first artefact is 
>>>> from
>>>> a root container, then the test must also be a root container to use it as 
>>>> a
>>>> working directory.
>>>>
>>>> For arm64, the existing linux-arm64 artefact suffices.  For arm32, pull in 
>>>> the
>>>> microcode-x86 artefact as it's the smallest available.  This bodge can be
>>>> removed when all build containers have become non-root.
>>>>
>>>> For the qemu-xtf-dom0less-arm64-*-xen-version jobs, use *arm64-test-needs
>>>> ahead of alpine-3.18-gcc-* (as it's a root container), and to deduplicate
>>>> the *-export dependency.
>>>>
>>>> This will allow us to change containers to being non-root one at a time,
>>>> rather than all in one go.
>>>>
>>>> No functional change.
>>>>
>>>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
>>>> ---
>>>> CC: Anthony PERARD <anthony.perard@xxxxxxxxxx>
>>>> CC: Stefano Stabellini <sstabellini@xxxxxxxxxx>
>>>> CC: Michal Orzel <michal.orzel@xxxxxxx>
>>>> CC: Doug Goldstein <cardoe@xxxxxxxxxx>
>>>>
>>>> We should also stop using binaries/ as a working directory for the tests, 
>>>> but
>>>> that gets very complicated very quickly and I don't have time to do it at 
>>>> this
>>>> juncture.
>>>> ---
>>>>  automation/gitlab-ci/test.yaml | 10 ++++++++--
>>>>  1 file changed, 8 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/automation/gitlab-ci/test.yaml 
>>>> b/automation/gitlab-ci/test.yaml
>>>> index 8770c523e228..517af1732437 100644
>>>> --- a/automation/gitlab-ci/test.yaml
>>>> +++ b/automation/gitlab-ci/test.yaml
>>>> @@ -15,6 +15,12 @@
>>>>    - qemu-system-aarch64-6.0.0-arm64-export
>>>>  
>>>>  .arm32-test-needs: &arm32-test-needs
>>>> +  # Bodge to ensure binaries/ is non-root.  Can be any artefact which 
>>>> comes
>>>> +  # from a non-root container, and microcode-x86 is the smallest.  Remove 
>>>> when
>>>> +  # all build containers have become non-root.
>>>> +  - project: $ARTIFACTS_REPO
>>>> +    job: microcode-x86
>>>> +    ref: $ARTIFACTS_BRANCH
>>> I don't see it being removed in this series even though the containers are 
>>> non-root.
>> Correct.  The Alpine container still being root is discussed in the
>> commit message, and is why ...
>>
>>>>    - qemu-system-aarch64-6.0.0-arm32-export
>>>>  
>>>>  .x86-64-test-needs: &x86-64-test-needs
>>>> @@ -569,16 +575,16 @@ qemu-xtf-dom0less-arm64-gcc-hyp-xen-version:
>>>>    script:
>>>>      - ./automation/scripts/qemu-xtf.sh arm64 mmu64le hyp-xen-version 2>&1 
>>>> | tee ${LOGFILE}
>>>>    needs:
>>>> +    - *arm64-test-needs
>> ... why use here is ahead of ...
>>
>>
>>> This also pulls in Linux image and rootfs which XTF tests don't need. I 
>>> think
>>> it's much better for a test to list the actual list of its dependencies.
>>> Otherwise you are asking user/developer to dig into the yaml.
>>>
>>> ~Michal
>>>
>>>>      - alpine-3.18-gcc-arm64
>>>> -    - qemu-system-aarch64-6.0.0-arm64-export
>> ... the alpine inclusion here.
>>
>> This can get reverted once the alpine container is split/reworked, but
>> not before.
> Ok, so once the Alpine container is reworked, we will get back to proper
> dependencies list.

Yes.  I hope to do so for 4.22, but the alpine container needs more
careful work as it's also used by the QubeOS hardware runner environment.

>  In that case:
> Reviewed-by: Michal Orzel <michal.orzel@xxxxxxx>

Thankyou.

~Andrew