From 368f4efa405fbc7a056875a1cd76834d9b7421af Mon Sep 17 00:00:00 2001 From: Julian Sommer <115516918+juliansommer@users.noreply.github.com> Date: Thu, 10 Sep 2026 11:48:14 +1000 Subject: [PATCH] chore: trim comments from workflows --- .github/workflows/apt-packages.yml | 2 - .github/workflows/e2e-baremetal.yml | 10 +---- .github/workflows/e2e-ddil.yml | 11 +----- .github/workflows/e2e-nightly.yml | 19 --------- .github/workflows/e2e-suites.yml | 11 ------ .github/workflows/gpu-e2e.yml | 49 ------------------------ .github/workflows/image-scripts.yml | 18 --------- .github/workflows/publish-system-ami.yml | 9 ++--- 8 files changed, 5 insertions(+), 124 deletions(-) diff --git a/.github/workflows/apt-packages.yml b/.github/workflows/apt-packages.yml index 11859ead0..920e4e8e3 100644 --- a/.github/workflows/apt-packages.yml +++ b/.github/workflows/apt-packages.yml @@ -33,8 +33,6 @@ jobs: strategy: fail-fast: false matrix: - # The suites the nightly E2E matrix actually installs on. This matches - # what detect_os accepts: Debian 13+ and Ubuntu 24.04+. image: - ubuntu:24.04 - ubuntu:26.04 diff --git a/.github/workflows/e2e-baremetal.yml b/.github/workflows/e2e-baremetal.yml index 3d35fb77b..f4280bfbb 100644 --- a/.github/workflows/e2e-baremetal.yml +++ b/.github/workflows/e2e-baremetal.yml @@ -55,15 +55,12 @@ permissions: env: GIT_BRANCH: ${{ github.ref_name }} - # Same central ES/APM sink as the other four e2e workflows. Bare-metal had - # no default here before — this cell's telemetry never reached the sink at - # all (not just missing ci.cell), see bm-bootstrap.sh's telemetry.env step. SPINIFEX_OTLP_ENDPOINT: ${{ vars.SPINIFEX_OTLP_ENDPOINT || 'http://192.168.1.13:8200' }} jobs: e2e_baremetal: name: Bare-Metal Single-Node E2E - runs-on: [ self-hosted, ci-baremetal ] + runs-on: [self-hosted, ci-baremetal] timeout-minutes: 240 concurrency: group: e2e-baremetal-cluster @@ -72,9 +69,6 @@ jobs: BM_ISO_CACHE: /var/cache/spinifex-iso-builder BM_CELL: ${{ inputs.cell || '20' }} ARTIFACT_DIR: /tmp/spinifex-e2e-nightly-cell-${{ inputs.cell || '20' }}-${{ github.run_id }} - # Caller-supplied on workflow_call. A dispatch run has no such input, and - # leaving it empty cost this cell its ci.run_id: its telemetry reached the - # sink but could not be found by run, only by guessing a time window. SPINIFEX_OTEL_ATTRS: ${{ inputs.otel-attrs || format('ci.run_id={0},ci.workflow={1},ci.cell={2},ci.matrix=baremetal/pxe/real-hw', github.run_id, github.workflow, inputs.cell || '20') }} steps: - name: Clean Workspace @@ -190,8 +184,6 @@ jobs: run: | mkdir -p "${ARTIFACT_DIR}" set -o pipefail - # Per-suite budgets are declared once in suite-sets.sh. The script - # applies one timeout to every suite in the list, so the widest wins. . "${GITHUB_WORKSPACE}/.github/scripts/suite-sets.sh" BM_TEST_TIMEOUT="" for suite in ${BM_SUITES}; do diff --git a/.github/workflows/e2e-ddil.yml b/.github/workflows/e2e-ddil.yml index 647ef55bf..48539f409 100644 --- a/.github/workflows/e2e-ddil.yml +++ b/.github/workflows/e2e-ddil.yml @@ -1,7 +1,5 @@ name: E2E DDIL -# This workflow is manually triggered while the DDIL scenarios are being -# validated. on: workflow_dispatch: inputs: @@ -21,27 +19,20 @@ concurrency: permissions: contents: read - # actions: read lets the otel-job-id action look up this job's numeric id via - # the Actions API — github.job is only the YAML key, no context exposes it. actions: read env: GIT_BRANCH: ${{ github.ref_name }} - # OTLP export to the central Elastic sink (wattle). Repo variable overrides; - # empty string disables telemetry entirely. SPINIFEX_OTLP_ENDPOINT: ${{ vars.SPINIFEX_OTLP_ENDPOINT || 'http://192.168.1.13:8200' }} SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }} jobs: ddil: name: DDIL Real Multi-Node - runs-on: [ self-hosted, ci-multi ] + runs-on: [self-hosted, ci-multi] timeout-minutes: 60 env: TOFU_LOG: /tmp/e2e-tofu-ddil-${{ github.run_id }}.log - # Job-level env wins over the workflow-level default. ci.cell=ddil marks - # this workflow's telemetry so a DDIL run's partition-induced errors are - # never mistaken for a healthy multi-node run's in the sink. SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }},ci.cell=ddil steps: - name: Clean Workspace diff --git a/.github/workflows/e2e-nightly.yml b/.github/workflows/e2e-nightly.yml index e6fc1d647..761295385 100644 --- a/.github/workflows/e2e-nightly.yml +++ b/.github/workflows/e2e-nightly.yml @@ -11,9 +11,6 @@ on: permissions: contents: read - # actions: read lets the "Resolve CI job id" step below look up this job's - # numeric id via the Actions API — github.job is only the YAML key, no - # context exposes the id itself. actions: read # Every cell builds its cluster on the same five hypervisors, so two runs in @@ -29,22 +26,13 @@ concurrency: group: e2e-hypervisors cancel-in-progress: false -# Scheduled runs are loaded from the default branch (main), so the schedule -# trigger must stay in sync on main for cron to fire — and so must the -# concurrency block above. env: GIT_BRANCH: ${{ github.event_name == 'schedule' && 'dev' || github.ref_name }} UBUNTU_GOLD_IMAGE: /mnt/disk1/gold-images/spinifex-image-builder-ubuntu-26.04.qcow2 - # OTLP export to the central Elastic sink (wattle). Repo variable overrides; - # empty string disables telemetry entirely. SPINIFEX_OTLP_ENDPOINT: ${{ vars.SPINIFEX_OTLP_ENDPOINT || 'http://192.168.1.13:8200' }} SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }} jobs: - # The matrix is built here rather than filtered inside each cell. A job whose - # steps all skip still reports success, so gating steps made a one-cell - # dispatch look like a green nineteen-job suite. A cell that was not selected - # now produces no job at all. select: runs-on: ubuntu-26.04 outputs: @@ -60,9 +48,6 @@ jobs: - id: pick env: CELLS: ${{ github.event_name == 'workflow_dispatch' && inputs.cells || '' }} - # Provision, install and teardown around the suite. Measured at ~6 - # minutes single-node and ~10 multi-node, so this is the floor the - # job budget must carry on top of the suite's own. SETUP_ALLOWANCE_MIN: 10 run: | if [ -z "$CELLS" ]; then @@ -130,10 +115,6 @@ jobs: env: TOFU_LOG: /tmp/e2e-nightly-cell-${{ matrix.cell }}-${{ github.run_id }}.log ARTIFACT_DIR: /tmp/spinifex-e2e-nightly-cell-${{ matrix.cell }}-${{ github.run_id }} - # Job-level env wins over the workflow-level default above, so telemetry - # from this cell carries ci.cell/ci.matrix. Twelve cells run under one - # run id and every cell names its hosts node1/node2/node3, so without - # this every cell's telemetry collapses into one unattributable bucket. SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }},ci.cell=${{ matrix.cell }},ci.matrix=${{ matrix.topo }}/${{ matrix.net }}/${{ matrix.host }} steps: diff --git a/.github/workflows/e2e-suites.yml b/.github/workflows/e2e-suites.yml index 31a40c6bb..48b929ab8 100644 --- a/.github/workflows/e2e-suites.yml +++ b/.github/workflows/e2e-suites.yml @@ -54,16 +54,11 @@ concurrency: permissions: contents: read - # actions: read lets the otel-job-id action look up a provision job's numeric - # id via the Actions API — github.job is only the YAML key, no context - # exposes it. actions: read env: GIT_BRANCH: ${{ github.ref_name }} TEST_RUN: ${{ inputs.test_run || '' }} - # OTLP export to the central Elastic sink (wattle). Repo variable overrides; - # empty string disables telemetry entirely. SPINIFEX_OTLP_ENDPOINT: ${{ vars.SPINIFEX_OTLP_ENDPOINT || 'http://192.168.1.13:8200' }} SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }} @@ -82,12 +77,6 @@ jobs: matrix: ${{ steps.suites.outputs.matrix }} env: TOFU_LOG: /tmp/e2e-tofu-single-${{ github.run_id }}.log - # This job (not single_suite) is where "Bootstrap via Binary Install" - # bakes SPINIFEX_OTEL_ATTRS into the VM's telemetry.env, before the - # suite matrix even exists — single_suite's legs share this one - # already-booted VM, so daemon telemetry can't be scoped any finer - # than "single env" per suite leg. ci.cell=single distinguishes it - # from multi_provision's VMs within the same run id. SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }},ci.cell=single steps: - name: Reap Orphan Procs diff --git a/.github/workflows/gpu-e2e.yml b/.github/workflows/gpu-e2e.yml index 5126e2e7b..81a95d6ef 100644 --- a/.github/workflows/gpu-e2e.yml +++ b/.github/workflows/gpu-e2e.yml @@ -56,15 +56,7 @@ concurrency: cancel-in-progress: false env: - # OTLP export to the central Elastic sink (wattle is the sink itself — see - # Part A.2). Repo variable overrides; carried for correlation even though - # the GPU suite's own daemon-side spans are emitted by wattle's already- - # configured obs-agent, not by this job. SPINIFEX_OTLP_ENDPOINT: ${{ vars.SPINIFEX_OTLP_ENDPOINT || 'http://192.168.1.13:8200' }} - # ci.cell=gpu keeps this workflow's telemetry separable from the tofu-env - # workflows'. Nothing in this job bakes these attrs into a daemon (see the - # note above), so the label only takes effect once wattle's obs-agent is - # given them; there is deliberately no ci.job_id lookup for the same reason. SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }},ci.cell=gpu WATTLE_SSH_HOST: ${{ vars.WATTLE_SSH_HOST || '192.168.1.13' }} WATTLE_SSH_USER: ${{ vars.WATTLE_SSH_USER || 'tf-user' }} @@ -78,8 +70,6 @@ jobs: env: ARTIFACT_DIR: /tmp/spinifex-gpu-e2e-artifacts-${{ github.run_id }} steps: - # Manual-work mutex gate — see setup note 4 above. Checked BEFORE any - # SSH to wattle so a paused run touches the box zero times. - name: Manual-work mutex gate id: gate env: @@ -122,8 +112,6 @@ jobs: echo "${{ secrets.WATTLE_SSH_KEY }}" > "${RUNNER_TEMP}/wattle-ci" echo "ssh_opts=-o StrictHostKeyChecking=no -o ConnectTimeout=10 -i ${RUNNER_TEMP}/wattle-ci" >> "$GITHUB_ENV" - # Healthcheck: confirm wattle's persistent AWS-compat control plane is - # actually up before spending time building/shipping the test binary. - name: Healthcheck — describe-regions if: steps.gate.outputs.paused != 'true' run: | @@ -131,18 +119,6 @@ jobs: ssh ${{ env.ssh_opts }} "${WATTLE_SSH_USER}@${WATTLE_SSH_HOST}" \ 'AWS_PROFILE=spinifex aws ec2 describe-regions --output text' - # Ensure the base EC2 GPU AMI is present — the raw-EC2 GPU passthrough - # test is the always-on baseline, so CI self-provisions it rather than - # depending on a manual import. `--name` selects the catalog entry (pulls - # the prebuilt image from iso.mulgadc.com); `--ami-name` is REQUIRED to - # name the AMI ubuntu-26.04-nvidia-gpu-x86_64 — without it the import - # falls back to the generic ami---, which the - # tests/e2e/gpu filter would never match. Idempotent — skipped once - # wattle's persistent loop-fs already has the named AMI (the 4.4G source - # qcow2 is cached in the images dir, so a re-import wouldn't re-download). - # `spx admin images import` writes local spinifex storage, so it needs - # the `spinifex` group active (sg); aws-CLI calls hit the gateway over - # HTTPS and don't. - name: Ensure base GPU AMI present (import-if-absent) if: steps.gate.outputs.paused != 'true' run: | @@ -171,11 +147,6 @@ jobs: ' ssh ${{ env.ssh_opts }} "${WATTLE_SSH_USER}@${WATTLE_SSH_HOST}" "$REMOTE" - # Preflight — the base GPU AMI is REQUIRED: the setup step above just - # ensured it, so a miss here means the import silently failed. Hard-fail - # rather than run a false-green all-skipped suite. ECS/EKS node AMIs are - # opt-in tiers (heavier — node AMIs + cluster spin-up); their tests - # self-skip when absent, so only warn. - name: Preflight — verify GPU AMIs if: steps.gate.outputs.paused != 'true' run: | @@ -205,10 +176,6 @@ jobs: ' ssh ${{ env.ssh_opts }} "${WATTLE_SSH_USER}@${WATTLE_SSH_HOST}" "$REMOTE" - # Same build command CI's other e2e workflows use to cross-compile a - # suite into a shippable binary (tests/e2e/Makefile e2e-build target, - # SUITES_BUILD scoped to just gpu). Building on the runner keeps go - # toolchain / module cache off wattle entirely. - name: Build GPU e2e test binary on runner if: steps.gate.outputs.paused != 'true' working-directory: tests/e2e @@ -231,12 +198,6 @@ jobs: ssh ${{ env.ssh_opts }} "$VM" "mkdir -p \$HOME/spinifex-gpu-e2e-bin" scp ${{ env.ssh_opts }} tests/e2e/_bin/gpu.test "$VM":spinifex-gpu-e2e-bin/gpu.test - # Same invocation shape e2e.yml uses to run a pre-built suite binary - # (SPINIFEX_E2E=1 SPINIFEX_MODE=single, ./.test -test.v - # -test.timeout=NNm), plus SPINIFEX_WAN_IP: wattle's ~24 bridges make - # net.InterfaceAddrs() enumeration pick a co-tenant bridge instead of - # the advertised gateway, so the override is required here. The harness - # should prefer spinifex.toml's advertised bridge. - name: Run GPU e2e suite on wattle id: e2e if: steps.gate.outputs.paused != 'true' @@ -287,8 +248,6 @@ jobs: junit-glob: ${{ env.ARTIFACT_DIR }}/junit-*.xml title: "GPU E2E results" - # Tolerated on failure: the sink being unreachable must not turn a - # green test run red. - name: Ship test results to Elasticsearch if: always() && steps.gate.outputs.paused != 'true' continue-on-error: true @@ -313,14 +272,6 @@ jobs: if-no-files-found: warn retention-days: 14 - # Cleanup is NEVER a host teardown: it never runs setup-ovn.sh, - # dev-reset, or cluster-reset. It only reconciles EC2-API-level state — - # terminate any GPU-typed instance still pending/running (the Go - # suite's own t.Cleanup already does this on normal pass/fail exit; - # this is the backstop for a hard `-test.timeout` kill or a workflow - # cancellation, which skip deferred Go cleanups). Termination triggers - # gpuManager.Release() on wattle, returning the A1000 to the pool for - # the next queued run or manual test. - name: Cleanup — terminate leftover GPU instances, release GPU if: always() && steps.gate.outputs.paused != 'true' run: | diff --git a/.github/workflows/image-scripts.yml b/.github/workflows/image-scripts.yml index 98cb48fe3..61f0753dc 100644 --- a/.github/workflows/image-scripts.yml +++ b/.github/workflows/image-scripts.yml @@ -1,9 +1,5 @@ name: Image Scripts -# Separate from spinifex.yml on purpose: scripts/images/ and images/ are shell -# and mkosi assets baked into system images, not Go, so they get their own -# path-filtered gate instead of running on every Go contributor's push (see -# ui.yml for the same pattern applied to the frontend). on: push: branches: @@ -38,15 +34,6 @@ jobs: - name: Run image script tests + shellcheck run: make test-images - # The mkosi EKS image is what customers run, and until now nothing built it: - # the composition existed in mkosi-build.sh but had no caller, so a change - # that broke it was only found by hand. Cell-25 still boots the Alpine image, - # so this is the only gate the Ubuntu one has. - # - # Self-hosted because the build needs Docker and several GB of disk, matching - # publish-system-ami.yml. Its own concurrency group, not e2e-hypervisors: the - # build provisions no libvirt guest, and sharing that group would queue image - # builds behind whole nightlies. eks_mkosi_image: name: Build mkosi EKS image runs-on: [self-hosted, ci-single] @@ -58,9 +45,6 @@ jobs: - name: Checkout Code uses: actions/checkout@v7 - # The profile binaries (eks-token-webhook, eks-gateway-publish, ...) are - # built on the host, not in the builder container, so Go is needed here - # even though the toolchain image carries mkosi itself. - name: Set up Go uses: actions/setup-go@v7 with: @@ -69,7 +53,5 @@ jobs: # disk, and cache-save would re-upload hundreds of MB for nothing. cache: false - # stage_profile_binaries() sets GOWORK=off, so the sub-repo resolves its - # own go.mod and the sibling monorepo checkouts are not needed here. - name: Build the image run: make build-eks-node-mkosi-image diff --git a/.github/workflows/publish-system-ami.yml b/.github/workflows/publish-system-ami.yml index b0e829e96..b0694abdf 100644 --- a/.github/workflows/publish-system-ami.yml +++ b/.github/workflows/publish-system-ami.yml @@ -60,7 +60,7 @@ concurrency: jobs: matrix: name: Resolve image matrix - runs-on: [ self-hosted, ci-single ] + runs-on: [self-hosted, ci-single] outputs: images: ${{ steps.gen.outputs.images }} steps: @@ -84,7 +84,7 @@ jobs: publish: name: Build + publish ${{ matrix.name }} needs: matrix - runs-on: [ self-hosted, ci-single ] + runs-on: [self-hosted, ci-single] strategy: fail-fast: false # ci-single is one runner and each GPU build needs ~16G of scratch disk; @@ -131,9 +131,7 @@ jobs: with: go-version-file: "spinifex/go.mod" # Self-hosted runner: the Go module + build cache already persists on - # local disk between runs. setup-go's cache-save ("Post Setup Go") - # otherwise re-uploads hundreds of MB to the Actions cache backend, - # taking longer than the build itself. + # local disk between runs. cache: false - name: Setup Go Workspace @@ -160,7 +158,6 @@ jobs: - name: Build + publish ${{ matrix.name }} to R2 working-directory: spinifex env: - # Map the repo's R2 secrets onto the names publish-system-image.sh reads. AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }} R2_ENDPOINT: ${{ secrets.CF_R2_ENDPOINT_URL }}