From 7bcd365549bef60d7d01f666d5698e0c575242e2 Mon Sep 17 00:00:00 2001 From: Josh Siviour Date: Tue, 9 Jun 2026 16:58:04 +1000 Subject: [PATCH] ci(eks-ami): build on self-hosted ci-single runner (#326) * ci(eks-ami): build on self-hosted ci-single-1 runner GitHub-hosted ubuntu-24.04 cannot run the libguestfs appliance network: passt fails (PID file denied under its AppArmor confine / privilege drop) and the SLIRP fallback has no outbound, so virt-customize --network dies. The self-hosted ci-single-1 runner has /dev/kvm and real networking, so the existing libguestfs build works unmodified. * fix(build-system-image): add --no-cache, force fresh build on publish The <10min cached-raw skip avoids duplicate work for concurrent e2e jobs, but on the persistent publish runner it could republish a stale image from a prior or concurrent run. Add --no-cache to bypass the skip and have publish-system-image.sh pass it on every build. * ci(eks-ami): target ci-single label (no ci-single-1 label exists) The self-hosted runners are named ci-single/-2/-3 but all share the single label 'ci-single'; runs-on matches labels, not names, so ci-single-1 never schedules. * ci(eks-ami): disable Go cache on self-hosted runner setup-go's cache-save (Post Setup Go) re-uploaded the Go cache to the Actions backend on every run, taking ~2.5min vs the 36s build. The self-hosted runner already keeps the cache on local disk, so cache:false. --- .github/workflows/publish-eks-ami.yml | 8 ++++++-- scripts/build-system-image.sh | 13 +++++++++---- scripts/publish-system-image.sh | 4 +++- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish-eks-ami.yml b/.github/workflows/publish-eks-ami.yml index 89b0d6483..f2c9600f9 100644 --- a/.github/workflows/publish-eks-ami.yml +++ b/.github/workflows/publish-eks-ami.yml @@ -26,7 +26,7 @@ concurrency: jobs: publish: name: Build + publish eks-node AMI - runs-on: ubuntu-24.04 + runs-on: [ self-hosted, ci-single ] steps: - name: Checkout Spinifex @@ -51,8 +51,12 @@ jobs: - name: Setup Go uses: actions/setup-go@v6 with: - cache-dependency-path: "spinifex/go.sum" go-version-file: "spinifex/go.mod" + # Self-hosted runner: the Go module + build cache already persists on + # local disk between runs. setup-go's cache-save ("Post Setup Go") + # otherwise re-uploads hundreds of MB to the Actions cache backend, + # taking longer than the build itself. + cache: false - name: Setup Go Workspace run: go work init ./spinifex ./viperblock ./predastore diff --git a/scripts/build-system-image.sh b/scripts/build-system-image.sh index 6da9c732d..80bbac487 100755 --- a/scripts/build-system-image.sh +++ b/scripts/build-system-image.sh @@ -26,10 +26,11 @@ PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" export LIBGUESTFS_BACKEND="${LIBGUESTFS_BACKEND:-direct}" usage() { - echo "Usage: $0 [--import]" + echo "Usage: $0 [--import] [--no-cache]" echo "" echo " manifest.conf Path to image manifest (see scripts/images/ for examples)" echo " --import Import the built image as an AMI" + echo " --no-cache Always rebuild; ignore a recently-built cached raw" exit 1 } @@ -47,10 +48,12 @@ fi DO_IMPORT=false QUIET=false +NO_CACHE=false for arg in "$@"; do case "$arg" in - --import) DO_IMPORT=true ;; - --quiet) QUIET=true ;; + --import) DO_IMPORT=true ;; + --quiet) QUIET=true ;; + --no-cache) NO_CACHE=true ;; esac done @@ -184,7 +187,9 @@ echo "Lock acquired" # If the raw image was built recently (< 10 min), skip the entire build. # This avoids duplicate work when concurrent CI jobs build the same image. -if [[ -f "$OUTPUT_RAW" ]] && [[ $(( $(date +%s) - $(stat -c %Y "$OUTPUT_RAW") )) -lt 600 ]]; then +# --no-cache (e.g. the publish path) forces a fresh build so a stale raw from +# a prior/concurrent run on a persistent runner is never republished. +if [[ "$NO_CACHE" == false ]] && [[ -f "$OUTPUT_RAW" ]] && [[ $(( $(date +%s) - $(stat -c %Y "$OUTPUT_RAW") )) -lt 600 ]]; then echo "=== Skipping build — $OUTPUT_RAW is fresh (< 10 min old) ===" # Restore stdout if suppressed, then jump to import diff --git a/scripts/publish-system-image.sh b/scripts/publish-system-image.sh index 3a5c05df1..b2a684345 100755 --- a/scripts/publish-system-image.sh +++ b/scripts/publish-system-image.sh @@ -89,7 +89,9 @@ fi if [[ "$DO_BUILD" == true ]]; then echo "=== Building ${IMAGE_NAME} ===" - "${SCRIPT_DIR}/build-system-image.sh" "$MANIFEST" + # --no-cache: publishing must never reuse a stale raw left by a prior or + # concurrent build on a persistent runner. + "${SCRIPT_DIR}/build-system-image.sh" "$MANIFEST" --no-cache fi if [[ ! -f "$RAW_IMAGE" ]]; then