From 99356fb7a8909c09e7026a0ecdbf8e3361dbe248 Mon Sep 17 00:00:00 2001 From: Manuel Huber Date: Tue, 28 Jul 2026 20:49:52 +0000 Subject: [PATCH] ci: persist genpolicy cache on NVIDIA runners Self-hosted NVIDIA confidential GPU runners receive a clean checkout for each job, so genpolicy discards useful layer metadata and downloads the same image layers again. For CoCo jobs, create a cache under the runner user's home directory and export GENPOLICY_LAYERS_CACHE_FILE_PATH in the test step that consumes it. The cache survives workspace cleanup while the environment variable remains scoped to that process tree. Use the existing KBS job environment variable in the shell condition so matrix expressions are not expanded directly into executable code. Assisted-by: OpenAI Codex Signed-off-by: Manuel Huber --- .github/workflows/run-k8s-tests-on-nvidia-gpu.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml b/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml index aef09019ce..f009927bb8 100644 --- a/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml +++ b/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml @@ -115,7 +115,14 @@ jobs: - name: Run tests ${{ matrix.environment.vmm }} timeout-minutes: 60 - run: bash tests/integration/kubernetes/gha-run.sh run-nv-tests + run: | + if [[ "${KBS}" == "true" ]]; then + cache_dir="${HOME}/.cache/kata-containers/genpolicy" + mkdir -p "${cache_dir}" + export GENPOLICY_LAYERS_CACHE_FILE_PATH="${cache_dir}/layers-cache.json" + fi + + bash tests/integration/kubernetes/gha-run.sh run-nv-tests env: NGC_API_KEY: ${{ secrets.NGC_API_KEY }} ENABLE_NVRC_TRACE: ${{ inputs.enable-nvrc-trace }}