Merge pull request #6517 from gkurz/3.1.0-branch-bump

# Kata Containers 3.1.0

.github/actionlint.yaml

@@ -1,26 +0,0 @@
-# Copyright (c) 2024 Red Hat
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Configuration file with rules for the actionlint tool.
-#
-self-hosted-runner:
-  # Labels of self-hosted runner that linter should ignore
-  labels:
-    - arm64-k8s
-    - ubuntu-22.04-arm
-    - garm-ubuntu-2004
-    - garm-ubuntu-2004-smaller
-    - garm-ubuntu-2204
-    - garm-ubuntu-2304
-    - garm-ubuntu-2304-smaller
-    - garm-ubuntu-2204-smaller
-    - k8s-ppc64le
-    - metrics
-    - ppc64le
-    - riscv-builder
-    - sev
-    - sev-snp
-    - s390x
-    - s390x-large
-    - tdx

.github/cargo-deny-composite-action/cargo-deny-generator.sh

@@ -8,7 +8,7 @@
 script_dir=$(dirname "$(readlink -f "$0")")
 parent_dir=$(realpath "${script_dir}/../..")
 cidir="${parent_dir}/ci"
-source "${cidir}/../tests/common.bash"
+source "${cidir}/lib.sh"
 
 cargo_deny_file="${script_dir}/action.yaml"
 

.github/cargo-deny-composite-action/cargo-deny-skeleton.yaml.in

@@ -21,7 +21,7 @@ runs:
         override: true
 
     - name: Cache
-      uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
+      uses: Swatinem/rust-cache@v2
 
     - name: Install Cargo deny
       shell: bash

.github/workflows/PR-wip-checks.yaml

@@ -9,18 +9,14 @@ on:
       - labeled
       - unlabeled
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   pr_wip_check:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     name: WIP Check
     steps:
     - name: WIP Check
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-      uses: tim-actions/wip-check@1c2a1ca6c110026b3e2297bb2ef39e1747b5a755 # master (2021-06-10)
+      uses: tim-actions/wip-check@1c2a1ca6c110026b3e2297bb2ef39e1747b5a755
       with:
         labels: '["do-not-merge", "wip", "rfc"]'
         keywords: '["WIP", "wip", "RFC", "rfc", "dnm", "DNM", "do-not-merge"]'

.github/workflows/actionlint.yaml

@@ -1,33 +0,0 @@
-name: Lint GHA workflows
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-    paths:
-      - '.github/workflows/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  run-actionlint:
-    env:
-      GH_TOKEN: ${{ github.token }}
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install actionlint gh extension
-        run: gh extension install https://github.com/cschleiden/gh-actionlint
-
-      - name: Run actionlint
-        run:  gh actionlint

.github/workflows/add-backport-label.yaml

@@ -0,0 +1,100 @@
+name: Add backport label
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+      - labeled
+      - unlabeled
+
+jobs:
+  check-issues:
+    if: ${{ github.event.label.name != 'auto-backport' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code to allow hub to communicate with the project
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/checkout@v3
+
+      - name: Install hub extension script
+        run: |
+          pushd $(mktemp -d) &>/dev/null
+          git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
+          sudo install hub-util.sh /usr/local/bin
+          popd &>/dev/null
+
+      - name: Determine whether to add label 
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CONTAINS_AUTO_BACKPORT: ${{ contains(github.event.pull_request.labels.*.name, 'auto-backport') }}
+        id: add_label
+        run: |
+          pr=${{ github.event.pull_request.number }}
+          linked_issue_urls=$(hub-util.sh \
+            list-issues-for-pr "$pr" |\
+            grep -v "^\#"  |\
+            cut -d';' -f3 || true)
+          [ -z "$linked_issue_urls" ] && {
+            echo "::error::No linked issues for PR $pr"
+            exit 1
+          }
+          has_bug=false
+          for issue_url in $(echo "$linked_issue_urls")
+          do
+            issue=$(echo "$issue_url"| awk -F\/ '{print $NF}' || true)
+            [ -z "$issue" ] && {
+              echo "::error::Cannot determine issue number from $issue_url for PR $pr"
+              exit 1
+            }
+            labels=$(hub-util.sh list-labels-for-issue "$issue")
+            
+            label_names=$(echo $labels | jq -r '.[].name' || true)
+            if [[ "$label_names" =~ "bug" ]]; then
+              has_bug=true
+              break
+            fi
+          done
+
+          has_backport_needed_label=${{ contains(github.event.pull_request.labels.*.name, 'needs-backport') }}
+          has_no_backport_needed_label=${{ contains(github.event.pull_request.labels.*.name, 'no-backport-needed') }}
+
+          echo "::set-output name=add_backport_label::false"
+          if [ $has_backport_needed_label  = true ] || [ $has_bug  = true ]; then
+            if [[ $has_no_backport_needed_label = false ]]; then
+              echo "::set-output name=add_backport_label::true"
+            fi
+          fi
+
+          # Do not spam comment, only if auto-backport label is going to be newly added.
+          echo "::set-output name=auto_backport_added::$CONTAINS_AUTO_BACKPORT"
+
+      - name: Add comment
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && steps.add_label.outputs.add_backport_label == 'true' && steps.add_label.outputs.auto_backport_added == 'false' }}
+        uses: actions/github-script@v6
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: 'This issue has been marked for auto-backporting. Add label(s) backport-to-BRANCHNAME to backport to them'
+            })
+
+      # Allow label to be removed by adding no-backport-needed label
+      - name: Remove auto-backport label
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && steps.add_label.outputs.add_backport_label == 'false' }}
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        with:
+          remove-labels: "auto-backport"
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add auto-backport label
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && steps.add_label.outputs.add_backport_label == 'true' }}
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        with:
+          add-labels: "auto-backport"
+          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/add-issues-to-project.yaml

@@ -11,13 +11,9 @@ on:
       - opened
       - reopened
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   add-new-issues-to-backlog:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Install hub
         run: |
@@ -33,13 +29,13 @@ jobs:
         run: |
           # Clone into a temporary directory to avoid overwriting
           # any existing github directory.
-          pushd "$(mktemp -d)" &>/dev/null
+          pushd $(mktemp -d) &>/dev/null
           git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
           sudo install hub-util.sh /usr/local/bin
           popd &>/dev/null
 
       - name: Checkout code to allow hub to communicate with the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
 
       - name: Add issue to issue backlog
         env:

.github/workflows/add-pr-sizing-label.yaml

@@ -12,31 +12,18 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   add-pr-size-label:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+        uses: actions/checkout@v1
 
       - name: Install PR sizing label script
         run: |
           # Clone into a temporary directory to avoid overwriting
           # any existing github directory.
-          pushd "$(mktemp -d)" &>/dev/null
+          pushd $(mktemp -d) &>/dev/null
           git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
           sudo install pr-add-size-label.sh /usr/local/bin
           popd &>/dev/null
@@ -48,6 +35,6 @@ jobs:
           pr=${{ github.event.number }}
           # Removing man-db, workflow kept failing, fixes: #4480
           sudo apt -y remove --purge man-db
-          sudo apt update && sudo apt -y install diffstat patchutils
+          sudo apt -y install diffstat patchutils
 
           pr-add-size-label.sh -p "$pr"

.github/workflows/auto-backport.yaml

@@ -0,0 +1,29 @@
+on:
+  pull_request_target:
+    types: ["labeled", "closed"]
+
+jobs:
+  backport:
+    name: Backport PR
+    runs-on: ubuntu-latest
+    if: |
+      github.event.pull_request.merged == true
+      && contains(github.event.pull_request.labels.*.name, 'auto-backport')
+      && (
+        (github.event.action == 'labeled' && github.event.label.name == 'auto-backport')
+        || (github.event.action == 'closed')
+      )
+    steps:
+      - name: Backport Action
+        uses: sqren/backport-github-action@v8.9.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          auto_backport_label_prefix: backport-to-
+
+      - name: Info log
+        if: ${{ success() }}
+        run: cat /home/runner/.backport/backport.info.log
+        
+      - name: Debug log
+        if: ${{ failure() }}
+        run: cat /home/runner/.backport/backport.debug.log

.github/workflows/basic-ci-amd64.yaml

@@ -1,428 +0,0 @@
-name: CI | Basic amd64 tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'dragonball', 'qemu', 'stratovirt', 'cloud-hypervisor', 'qemu-runtime-rs']
-    runs-on: ubuntu-22.04
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        timeout-minutes: 10
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-  run-containerd-sandboxapi:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['dragonball', 'cloud-hypervisor', 'qemu-runtime-rs']
-    runs-on: ubuntu-22.04
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      SANDBOXER: "shim"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run containerd-sandboxapi tests
-        timeout-minutes: 10
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-  run-containerd-stability:
-    strategy:
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu', 'stratovirt']
-    runs-on: ubuntu-22.04
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      SANDBOXER: "podsandbox"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/stability/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/stability/gha-run.sh install-kata kata-artifacts
-
-      - name: Run containerd-stability tests
-        timeout-minutes: 15
-        run: bash tests/stability/gha-run.sh run
-
-  run-nydus:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'qemu', 'dragonball', 'stratovirt']
-    runs-on: ubuntu-22.04
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/nydus/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/nydus/gha-run.sh install-kata kata-artifacts
-
-      - name: Run nydus tests
-        timeout-minutes: 10
-        run: bash tests/integration/nydus/gha-run.sh run
-
-  run-runk:
-    # Skip runk tests as we have no maintainers. TODO: Decide when to remove altogether
-    if: false
-    runs-on: ubuntu-22.04
-    env:
-      CONTAINERD_VERSION: lts
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/runk/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
-
-      - name: Run runk tests
-        timeout-minutes: 10
-        run: bash tests/integration/runk/gha-run.sh run
-
-  run-tracing:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh # cloud-hypervisor
-          - qemu
-    # TODO: enable me when https://github.com/kata-containers/kata-containers/issues/9763 is fixed
-    # TODO: Transition to free runner (see #9940).
-    if: false
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/tracing/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/functional/tracing/gha-run.sh install-kata kata-artifacts
-
-      - name: Run tracing tests
-        timeout-minutes: 15
-        run: bash tests/functional/tracing/gha-run.sh run
-
-  run-vfio:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - qemu
-    # TODO: enable with clh when https://github.com/kata-containers/kata-containers/issues/9764 is fixed
-    # TODO: enable with qemu when https://github.com/kata-containers/kata-containers/issues/9851 is fixed
-    # TODO: Transition to free runner (see #9940).
-    if: false
-    runs-on: garm-ubuntu-2304
-    env:
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/vfio/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Run vfio tests
-        timeout-minutes: 15
-        run: bash tests/functional/vfio/gha-run.sh run
-
-  run-docker-tests:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # all the tests are not flaky, otherwise we'll fail them
-      # all due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - qemu
-          - dragonball
-          - cloud-hypervisor
-    runs-on: ubuntu-22.04
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/docker/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
-
-      - name: Run docker smoke test
-        timeout-minutes: 5
-        run: bash tests/integration/docker/gha-run.sh run
-
-  run-nerdctl-tests:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # all the tests are not flaky, otherwise we'll fail them
-      # all due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - cloud-hypervisor
-    runs-on: ubuntu-22.04
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        env:
-          GITHUB_API_TOKEN: ${{ github.token }}
-        run: bash tests/integration/nerdctl/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/nerdctl/gha-run.sh install-kata kata-artifacts
-
-      - name: Run nerdctl smoke test
-        timeout-minutes: 5
-        run: bash tests/integration/nerdctl/gha-run.sh run
-
-      - name: Collect artifacts ${{ matrix.vmm }}
-        if: always()
-        run: bash tests/integration/nerdctl/gha-run.sh collect-artifacts
-        continue-on-error: true
-
-      - name: Archive artifacts ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: nerdctl-tests-garm-${{ matrix.vmm }}
-          path: /tmp/artifacts
-          retention-days: 1
-
-  run-kata-agent-apis:
-    strategy:
-      fail-fast: false
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/kata-agent-apis/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/functional/kata-agent-apis/gha-run.sh install-kata kata-artifacts
-
-      - name: Run kata agent api tests with agent-ctl
-        run: bash tests/functional/kata-agent-apis/gha-run.sh run

.github/workflows/basic-ci-s390x.yaml

@@ -1,178 +0,0 @@
-name: CI | Basic s390x tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['qemu', 'qemu-runtime-rs']
-    runs-on: s390x-large
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-  run-containerd-sandboxapi:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['qemu-runtime-rs']
-    runs-on: s390x-large
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      SANDBOXER: "shim"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run containerd-sandboxapi tests
-        timeout-minutes: 10
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-  run-containerd-stability:
-    strategy:
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['qemu']
-    runs-on: s390x-large
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      SANDBOXER: "podsandbox"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/stability/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/stability/gha-run.sh install-kata kata-artifacts
-
-      - name: Run containerd-stability tests
-        timeout-minutes: 15
-        run: bash tests/stability/gha-run.sh run
-
-  run-docker-tests:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # all the tests are not flaky, otherwise we'll fail them
-      # all due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm: ['qemu']
-    runs-on: s390x-large
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/docker/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
-
-      - name: Run docker smoke test
-        timeout-minutes: 5
-        run: bash tests/integration/docker/gha-run.sh run

.github/workflows/build-checks-preview-riscv64.yaml

@@ -1,128 +0,0 @@
-# This yaml is designed to be used until all components listed in
-# `build-checks.yaml` are supported
-on:
-  workflow_dispatch:
-    inputs:
-      instance:
-        default: "riscv-builder"
-        description: "Default instance when manually triggering"
-  workflow_call:
-    inputs:
-      instance:
-        required: true
-        type: string
-
-name: Build checks preview riscv64
-jobs:
-  check:
-    runs-on: ${{ inputs.instance }}
-    strategy:
-      fail-fast: false
-      matrix:
-        command:
-          - "make vendor"
-          - "make check"
-          - "make test"
-          - "sudo -E PATH=\"$PATH\" make test"
-        component:
-          - name: agent
-            path: src/agent
-            needs:
-              - rust
-              - libdevmapper
-              - libseccomp
-              - protobuf-compiler
-              - clang
-          - name: agent-ctl
-            path: src/tools/agent-ctl
-            needs:
-              - rust
-              - musl-tools
-              - protobuf-compiler
-              - clang
-          - name: trace-forwarder
-            path: src/tools/trace-forwarder
-            needs:
-              - rust
-              - musl-tools
-          - name: genpolicy
-            path: src/tools/genpolicy
-            needs:
-              - rust
-              - musl-tools
-              - protobuf-compiler
-          - name: runtime
-            path: src/runtime
-            needs:
-              - golang
-              - XDG_RUNTIME_DIR
-          - name: runtime-rs
-            path: src/runtime-rs
-            needs:
-              - rust
-
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R "$USER":"$USER" "$GITHUB_WORKSPACE" "$HOME"
-          sudo rm -rf "$GITHUB_WORKSPACE"/* || { sleep 10 && sudo rm -rf "$GITHUB_WORKSPACE"/*; }
-          sudo rm -f /tmp/kata_hybrid*  # Sometime we got leftover from test_setup_hvsock_failed()
-
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install yq
-        run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install golang
-        if: contains(matrix.component.needs, 'golang')
-        run: |
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
-      - name: Setup rust
-        if: contains(matrix.component.needs, 'rust')
-        run: |
-          ./tests/install_rust.sh
-          echo "${HOME}/.cargo/bin" >> "$GITHUB_PATH"
-          if [ "$(uname -m)" == "x86_64" ] || [ "$(uname -m)" == "aarch64" ]; then
-            sudo apt-get update && sudo apt-get -y install musl-tools
-          fi
-      - name: Install devicemapper
-        if: contains(matrix.component.needs, 'libdevmapper') && matrix.command == 'make check'
-        run: sudo apt-get update && sudo apt-get -y install libdevmapper-dev
-      - name: Install libseccomp
-        if: contains(matrix.component.needs, 'libseccomp') && matrix.command != 'make vendor' && matrix.command != 'make check'
-        run: |
-          libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
-          gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
-          ./ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
-          echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
-          echo "LIBSECCOMP_LINK_TYPE=static" >> "$GITHUB_ENV"
-          echo "LIBSECCOMP_LIB_PATH=${libseccomp_install_dir}/lib" >> "$GITHUB_ENV"
-      - name: Install protobuf-compiler
-        if: contains(matrix.component.needs, 'protobuf-compiler') && matrix.command != 'make vendor'
-        run: sudo apt-get update && sudo apt-get -y install protobuf-compiler
-      - name: Install clang
-        if: contains(matrix.component.needs, 'clang') && matrix.command == 'make check'
-        run: sudo apt-get update && sudo apt-get -y install clang
-      - name: Setup XDG_RUNTIME_DIR
-        if: contains(matrix.component.needs, 'XDG_RUNTIME_DIR') && matrix.command != 'make check'
-        run: |
-          XDG_RUNTIME_DIR=$(mktemp -d "/tmp/kata-tests-$USER.XXX" | tee >(xargs chmod 0700))
-          echo "XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR}" >> "$GITHUB_ENV"
-      - name: Skip tests that depend on virtualization capable runners when needed
-        if: inputs.instance == 'riscv-builder'
-        run: |
-          echo "GITHUB_RUNNER_CI_NON_VIRT=true" >> "$GITHUB_ENV"
-      - name: Running `${{ matrix.command }}` for ${{ matrix.component.name }}
-        run: |
-          cd ${{ matrix.component.path }}
-          ${{ matrix.command }}
-        env:
-          RUST_BACKTRACE: "1"
-          RUST_LIB_BACKTRACE: "0"
-          SKIP_GO_VERSION_CHECK: "1"

.github/workflows/build-checks.yaml

@@ -1,126 +0,0 @@
-on:
-  workflow_call:
-    inputs:
-      instance:
-        required: true
-        type: string
-
-name: Build checks
-jobs:
-  check:
-    runs-on: ${{ inputs.instance }}
-    strategy:
-      fail-fast: false
-      matrix:
-        command:
-          - "make vendor"
-          - "make check"
-          - "make test"
-          - "sudo -E PATH=\"$PATH\" make test"
-        component:
-          - name: agent
-            path: src/agent
-            needs:
-              - rust
-              - libdevmapper
-              - libseccomp
-              - protobuf-compiler
-              - clang
-          - name: dragonball
-            path: src/dragonball
-            needs:
-              - rust
-          - name: runtime
-            path: src/runtime
-            needs:
-              - golang
-              - XDG_RUNTIME_DIR
-          - name: runtime-rs
-            path: src/runtime-rs
-            needs:
-              - rust
-          - name: agent-ctl
-            path: src/tools/agent-ctl
-            needs:
-              - rust
-              - protobuf-compiler
-              - clang
-          - name: kata-ctl
-            path: src/tools/kata-ctl
-            needs:
-              - rust
-          - name: trace-forwarder
-            path: src/tools/trace-forwarder
-            needs:
-              - rust
-          - name: genpolicy
-            path: src/tools/genpolicy
-            needs:
-              - rust
-              - protobuf-compiler
-
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R "$USER":"$USER" "$GITHUB_WORKSPACE" "$HOME"
-          sudo rm -rf "$GITHUB_WORKSPACE"/* || { sleep 10 && sudo rm -rf "$GITHUB_WORKSPACE"/*; }
-          sudo rm -f /tmp/kata_hybrid*  # Sometime we got leftover from test_setup_hvsock_failed()
-
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install yq
-        run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install golang
-        if: contains(matrix.component.needs, 'golang')
-        run: |
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
-      - name: Setup rust
-        if: contains(matrix.component.needs, 'rust')
-        run: |
-          ./tests/install_rust.sh
-          echo "${HOME}/.cargo/bin" >> "$GITHUB_PATH"
-          if [ "$(uname -m)" == "x86_64" ] || [ "$(uname -m)" == "aarch64" ]; then
-            sudo apt-get update && sudo apt-get -y install musl-tools
-          fi
-      - name: Install devicemapper
-        if: contains(matrix.component.needs, 'libdevmapper') && matrix.command == 'make check'
-        run: sudo apt-get update && sudo apt-get -y install libdevmapper-dev
-      - name: Install libseccomp
-        if: contains(matrix.component.needs, 'libseccomp') && matrix.command != 'make vendor' && matrix.command != 'make check'
-        run: |
-          libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
-          gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
-          ./ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
-          echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
-          echo "LIBSECCOMP_LINK_TYPE=static" >> "$GITHUB_ENV"
-          echo "LIBSECCOMP_LIB_PATH=${libseccomp_install_dir}/lib" >> "$GITHUB_ENV"
-      - name: Install protobuf-compiler
-        if: contains(matrix.component.needs, 'protobuf-compiler') && matrix.command != 'make vendor'
-        run: sudo apt-get update && sudo apt-get -y install protobuf-compiler
-      - name: Install clang
-        if: contains(matrix.component.needs, 'clang') && matrix.command == 'make check'
-        run: sudo apt-get update && sudo apt-get -y install clang
-      - name: Setup XDG_RUNTIME_DIR
-        if: contains(matrix.component.needs, 'XDG_RUNTIME_DIR') && matrix.command != 'make check'
-        run: |
-          XDG_RUNTIME_DIR=$(mktemp -d "/tmp/kata-tests-$USER.XXX" | tee >(xargs chmod 0700))
-          echo "XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR}" >> "$GITHUB_ENV"
-      - name: Skip tests that depend on virtualization capable runners when needed
-        if: ${{ endsWith(inputs.instance, '-arm') }}
-        run: |
-          echo "GITHUB_RUNNER_CI_NON_VIRT=true" >> "$GITHUB_ENV"
-      - name: Running `${{ matrix.command }}` for ${{ matrix.component.name }}
-        run: |
-          cd ${{ matrix.component.path }}
-          ${{ matrix.command }}
-        env:
-          RUST_BACKTRACE: "1"
-          RUST_LIB_BACKTRACE: "0"
-          SKIP_GO_VERSION_CHECK: "1"

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -1,332 +0,0 @@
-name: CI | Build kata-static tarball for amd64
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - agent-ctl
-          - busybox
-          - cloud-hypervisor
-          - cloud-hypervisor-glibc
-          - coco-guest-components
-          - csi-kata-directvolume
-          - firecracker
-          - genpolicy
-          - kata-ctl
-          - kata-manager
-          - kernel
-          - kernel-confidential
-          - kernel-dragonball-experimental
-          - kernel-nvidia-gpu
-          - kernel-nvidia-gpu-confidential
-          - nydus
-          - ovmf
-          - ovmf-sev
-          - pause-image
-          - qemu
-          - qemu-snp-experimental
-          - qemu-tdx-experimental
-          - stratovirt
-          - trace-forwarder
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-        exclude:
-          - asset: cloud-hypervisor-glibc
-            stage: release
-    env:
-      PERFORM_ATTESTATION: ${{ matrix.asset == 'agent' && inputs.push-to-registry == 'yes' && 'yes' || 'no' }}
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        id: build
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: Parse OCI image name and digest
-        id: parse-oci-segments
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        run: |
-          oci_image="$(<"build/${{ matrix.asset }}-oci-image")"
-          echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
-          echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"
-
-      - uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          version: "1.2.0"
-
-      # for pushing attestations to the registry
-      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: actions/attest-build-provenance@v1
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          subject-name: ${{ steps.parse-oci-segments.outputs.oci-name }}
-          subject-digest: ${{ steps.parse-oci-segments.outputs.oci-digest }}
-          push-to-registry: true
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-amd64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-      - name: store-extratarballs-artifact ${{ matrix.asset }}
-        if: ${{ startsWith(matrix.asset, 'kernel-nvidia-gpu') }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-amd64-${{ matrix.asset }}-headers${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}-headers.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  build-asset-rootfs:
-    runs-on: ubuntu-22.04
-    needs: build-asset
-    strategy:
-      matrix:
-        asset:
-          - rootfs-image
-          - rootfs-image-confidential
-          - rootfs-image-mariner
-          - rootfs-initrd
-          - rootfs-initrd-confidential
-          - rootfs-nvidia-gpu-initrd
-          - rootfs-nvidia-gpu-confidential-initrd
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-amd64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build ${{ matrix.asset }}
-        id: build
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-amd64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
-  remove-rootfs-binary-artifacts:
-    runs-on: ubuntu-22.04
-    needs: build-asset-rootfs
-    strategy:
-      matrix:
-        asset:
-          - busybox
-          - coco-guest-components
-          - kernel-nvidia-gpu-headers
-          - kernel-nvidia-gpu-confidential-headers
-          - pause-image
-    steps:
-      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
-        with:
-          name: kata-artifacts-amd64-${{ matrix.asset}}${{ inputs.tarball-suffix }}
-
-  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
-  remove-rootfs-binary-artifacts-for-release:
-    runs-on: ubuntu-22.04
-    needs: build-asset-rootfs
-    strategy:
-      matrix:
-        asset:
-          - agent
-    steps:
-      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
-        if: ${{ inputs.stage == 'release' }}
-        with:
-          name: kata-artifacts-amd64-${{ matrix.asset}}${{ inputs.tarball-suffix }}
-
-  build-asset-shim-v2:
-    runs-on: ubuntu-22.04
-    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-amd64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build shim-v2
-        id: build
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: shim-v2
-          TAR_OUTPUT: shim-v2.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          MEASURED_ROOTFS: yes
-
-      - name: store-artifact shim-v2
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-amd64-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: ubuntu-22.04
-    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-amd64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -1,302 +0,0 @@
-name: CI | Build kata-static tarball for arm64
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: ubuntu-22.04-arm
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - busybox
-          - cloud-hypervisor
-          - firecracker
-          - kernel
-          - kernel-dragonball-experimental
-          - kernel-nvidia-gpu
-          - nydus
-          - ovmf
-          - qemu
-          - stratovirt
-          - virtiofsd
-    env:
-      PERFORM_ATTESTATION: ${{ matrix.asset == 'agent' && inputs.push-to-registry == 'yes' && 'yes' || 'no' }}
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: Parse OCI image name and digest
-        id: parse-oci-segments
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        run: |
-          oci_image="$(<"build/${{ matrix.asset }}-oci-image")"
-          echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
-          echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"
-
-      - uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          version: "1.2.0"
-
-      # for pushing attestations to the registry
-      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: actions/attest-build-provenance@v1
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          subject-name: ${{ steps.parse-oci-segments.outputs.oci-name }}
-          subject-digest: ${{ steps.parse-oci-segments.outputs.oci-digest }}
-          push-to-registry: true
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-      - name: store-extratarballs-artifact ${{ matrix.asset }}
-        if: ${{ startsWith(matrix.asset, 'kernel-nvidia-gpu') }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset }}-headers${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}-headers.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  build-asset-rootfs:
-    runs-on: ubuntu-22.04-arm
-    needs: build-asset
-    strategy:
-      matrix:
-        asset:
-          - rootfs-image
-          - rootfs-initrd
-          - rootfs-nvidia-gpu-initrd
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-arm64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
-  remove-rootfs-binary-artifacts:
-    runs-on: ubuntu-22.04-arm
-    needs: build-asset-rootfs
-    strategy:
-      matrix:
-        asset:
-          - busybox
-          - kernel-nvidia-gpu-headers
-    steps:
-      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset}}${{ inputs.tarball-suffix }}
-
-  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
-  remove-rootfs-binary-artifacts-for-release:
-    runs-on: ubuntu-22.04-arm
-    needs: build-asset-rootfs
-    strategy:
-      matrix:
-        asset:
-          - agent
-    steps:
-      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
-        if: ${{ inputs.stage == 'release' }}
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset}}${{ inputs.tarball-suffix }}
-
-  build-asset-shim-v2:
-    runs-on: ubuntu-22.04-arm
-    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-arm64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build shim-v2
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: shim-v2
-          TAR_OUTPUT: shim-v2.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact shim-v2
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-arm64-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: ubuntu-22.04-arm
-    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-arm64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-arm64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-ppc64le.yaml

@@ -1,242 +0,0 @@
-name: CI | Build kata-static tarball for ppc64le
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: ppc64le
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - kernel
-          - qemu
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-ppc64le-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  build-asset-rootfs:
-    runs-on: ppc64le
-    needs: build-asset
-    strategy:
-      matrix:
-        asset:
-          - rootfs-initrd
-        stage:
-          - ${{ inputs.stage }}
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-ppc64le-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-ppc64le-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
-  remove-rootfs-binary-artifacts:
-    runs-on: ubuntu-22.04
-    needs: build-asset-rootfs
-    strategy:
-      matrix:
-        asset:
-          - agent
-    steps:
-      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
-        if: ${{ inputs.stage == 'release' }}
-        with:
-          name: kata-artifacts-ppc64le-${{ matrix.asset}}${{ inputs.tarball-suffix }}
-
-  build-asset-shim-v2:
-    runs-on: ppc64le
-    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-ppc64le-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build shim-v2
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: shim-v2
-          TAR_OUTPUT: shim-v2.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact shim-v2
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-ppc64le-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: ppc64le
-    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R "$USER":"$USER" "$GITHUB_WORKSPACE"
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-ppc64le-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 1
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-riscv64.yaml

@@ -1,79 +0,0 @@
-name: CI | Build kata-static tarball for riscv64
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: riscv-builder
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    strategy:
-      matrix:
-        asset:
-          - kernel
-          - virtiofsd
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -1,324 +0,0 @@
-name: CI | Build kata-static tarball for s390x
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: s390x
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - coco-guest-components
-          - kernel
-          - kernel-confidential
-          - pause-image
-          - qemu
-          - virtiofsd
-    env:
-      PERFORM_ATTESTATION: ${{ matrix.asset == 'agent' && inputs.push-to-registry == 'yes' && 'yes' || 'no' }}
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        id: build
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: Parse OCI image name and digest
-        id: parse-oci-segments
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        run: |
-          oci_image="$(<"build/${{ matrix.asset }}-oci-image")"
-          echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
-          echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"
-
-      # for pushing attestations to the registry
-      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: actions/attest-build-provenance@v1
-        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        with:
-          subject-name: ${{ steps.parse-oci-segments.outputs.oci-name }}
-          subject-digest: ${{ steps.parse-oci-segments.outputs.oci-digest }}
-          push-to-registry: true
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  build-asset-rootfs:
-    runs-on: s390x
-    needs: build-asset
-    strategy:
-      matrix:
-        asset:
-          - rootfs-image
-          - rootfs-image-confidential
-          - rootfs-initrd
-          - rootfs-initrd-confidential
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build ${{ matrix.asset }}
-        id: build
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  build-asset-boot-image-se:
-    runs-on: s390x
-    needs: [build-asset, build-asset-rootfs]
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Place a host key document
-        run: |
-          mkdir -p "host-key-document"
-          cp "${CI_HKD_PATH}" "host-key-document"
-        env:
-          CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
-
-      - name: Build boot-image-se
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "boot-image-se"
-          make boot-image-se-tarball
-          build_dir=$(readlink -f build)
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R "$(id -u)":"$(id -g)" "kata-build"
-        env:
-          HKD_PATH: "host-key-document"
-
-      - name: store-artifact boot-image-se
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-boot-image-se.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
-  remove-rootfs-binary-artifacts:
-    runs-on: ubuntu-22.04
-    needs: [build-asset-rootfs, build-asset-boot-image-se]
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - coco-guest-components
-          - pause-image
-    steps:
-      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
-        if: ${{ inputs.stage == 'release' }}
-        with:
-          name: kata-artifacts-s390x-${{ matrix.asset}}${{ inputs.tarball-suffix }}
-
-  build-asset-shim-v2:
-    runs-on: s390x
-    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Build shim-v2
-        id: build
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "${KATA_ASSET}"
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-build/.
-        env:
-          KATA_ASSET: shim-v2
-          TAR_OUTPUT: shim-v2.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          MEASURED_ROOTFS: no
-
-      - name: store-artifact shim-v2
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: s390x
-    needs:
-      - build-asset
-      - build-asset-rootfs
-      - build-asset-boot-image-se
-      - build-asset-shim-v2
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/cargo-deny-runner.yaml

@@ -6,25 +6,21 @@ on:
       - edited
       - reopened
       - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+    paths-ignore: [ '**.md', '**.png', '**.jpg', '**.jpeg', '**.svg', '/docs/**' ]
 jobs:
   cargo-deny-runner:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Code
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
       - name: Generate Action
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
         run: bash cargo-deny-generator.sh
         working-directory: ./.github/cargo-deny-composite-action/
         env:
-          GOPATH: ${{ github.workspace }}/kata-containers
+          GOPATH: ${{ runner.workspace }}/kata-containers
       - name: Run Action
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
         uses: ./.github/cargo-deny-composite-action

.github/workflows/ci-coco-stability.yaml

@@ -1,19 +0,0 @@
-name: Kata Containers CoCo Stability Tests Weekly
-on:
-  schedule:
-    - cron: '0 0 * * 0'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-containers-ci-on-push:
-    uses: ./.github/workflows/ci-weekly.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      pr-number: "weekly"
-      tag: ${{ github.sha }}-weekly
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit

.github/workflows/ci-devel.yaml

@@ -1,18 +0,0 @@
-name: Kata Containers CI (manually triggered)
-on:
-  workflow_dispatch:
-
-jobs:
-  kata-containers-ci-on-push:
-    uses: ./.github/workflows/ci.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      pr-number: "dev"
-      tag: ${{ github.sha }}-dev
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-checks:
-    uses: ./.github/workflows/build-checks.yaml
-    with:
-      instance: ubuntu-22.04

.github/workflows/ci-nightly-s390x.yaml

@@ -1,22 +0,0 @@
-on:
-  schedule:
-    - cron: '0 5 * * *'
-
-name: Nightly CI for s390x
-jobs:
-  check-internal-test-result:
-    runs-on: s390x
-    strategy:
-      fail-fast: false
-      matrix:
-        test_title:
-          - kata-vfio-ap-e2e-tests
-          - cc-vfio-ap-e2e-tests
-          - cc-se-e2e-tests
-    steps:
-    - name: Fetch a test result for {{ matrix.test_title }}
-      run: |
-        file_name="${TEST_TITLE}-$(date +%Y-%m-%d).log"
-        "/home/${USER}/script/handle_test_log.sh" download "$file_name"
-      env:
-        TEST_TITLE: ${{ matrix.test_title }}

.github/workflows/ci-nightly.yaml

@@ -1,18 +0,0 @@
-name: Kata Containers Nightly CI
-on:
-  schedule:
-    - cron: '0 0 * * *'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-containers-ci-on-push:
-    uses: ./.github/workflows/ci.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      pr-number: "nightly"
-      tag: ${{ github.sha }}-nightly
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit

.github/workflows/ci-on-push.yaml

@@ -1,39 +0,0 @@
-name: Kata Containers CI
-on:
-  pull_request_target:
-    branches:
-      - 'main'
-      - 'stable-*'
-    types:
-      # Adding 'labeled' to the list of activity types that trigger this event
-      # (default: opened, synchronize, reopened) so that we can run this
-      # workflow when the 'ok-to-test' label is added.
-      # Reference: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
-      - opened
-      - synchronize
-      - reopened
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  skipper:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}
-    uses: ./.github/workflows/gatekeeper-skipper.yaml
-    with:
-      commit-hash: ${{ github.event.pull_request.head.sha }}
-      target-branch: ${{ github.event.pull_request.base.ref }}
-
-  kata-containers-ci-on-push:
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_build != 'yes' }}
-    uses: ./.github/workflows/ci.yaml
-    with:
-      commit-hash: ${{ github.event.pull_request.head.sha }}
-      pr-number: ${{ github.event.pull_request.number }}
-      tag: ${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
-      target-branch: ${{ github.event.pull_request.base.ref }}
-      skip-test: ${{ needs.skipper.outputs.skip_test }}
-    secrets: inherit

.github/workflows/ci-weekly.yaml

@@ -1,89 +0,0 @@
-name: Run the CoCo Kata Containers Stability CI
-on:
-  workflow_call:
-    inputs:
-      commit-hash:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-kata-static-tarball-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  publish-kata-deploy-payload-amd64:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-22.04
-      arch: amd64
-    secrets: inherit
-
-  build-and-publish-tee-confidential-unencrypted-image:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Login to Kata Containers ghcr.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker build and push
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
-        with:
-          tags: ghcr.io/kata-containers/test-images:unencrypted-${{ inputs.pr-number }}
-          push: true
-          context: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/
-          platforms: linux/amd64
-          file: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/Dockerfile
-
-  run-kata-coco-stability-tests:
-    needs: [publish-kata-deploy-payload-amd64, build-and-publish-tee-confidential-unencrypted-image]
-    uses: ./.github/workflows/run-kata-coco-stability-tests.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-      tarball-suffix: -${{ inputs.tag }}
-    secrets: inherit

.github/workflows/ci.yaml

@@ -1,345 +0,0 @@
-name: Run the Kata Containers CI
-on:
-  workflow_call:
-    inputs:
-      commit-hash:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-      skip-test:
-        required: false
-        type: string
-        default: no
-
-jobs:
-  build-kata-static-tarball-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  publish-kata-deploy-payload-amd64:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-22.04
-      arch: amd64
-    secrets: inherit
-
-  build-kata-static-tarball-arm64:
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  publish-kata-deploy-payload-arm64:
-    needs: build-kata-static-tarball-arm64
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-arm64
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-22.04-arm
-      arch: arm64
-    secrets: inherit
-
-  build-kata-static-tarball-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  build-kata-static-tarball-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  build-kata-static-tarball-riscv64:
-    uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-s390x:
-    needs: build-kata-static-tarball-s390x
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: s390x
-      arch: s390x
-    secrets: inherit
-
-  publish-kata-deploy-payload-ppc64le:
-    needs: build-kata-static-tarball-ppc64le
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ppc64le
-      arch: ppc64le
-    secrets: inherit
-
-  build-and-publish-tee-confidential-unencrypted-image:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Login to Kata Containers ghcr.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker build and push
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
-        with:
-          tags: ghcr.io/kata-containers/test-images:unencrypted-${{ inputs.pr-number }}
-          push: true
-          context: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/
-          platforms: linux/amd64, linux/s390x
-          file: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/Dockerfile
-
-  publish-csi-driver-amd64:
-    needs: build-kata-static-tarball-amd64
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64-${{ inputs.tag }}
-          path: kata-artifacts
-
-      - name: Install tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
-
-      - name: Copy binary into Docker context
-        run: |
-          # Copy to the location where the Dockerfile expects the binary.
-          mkdir -p src/tools/csi-kata-directvolume/bin/
-          cp /opt/kata/bin/csi-kata-directvolume src/tools/csi-kata-directvolume/bin/directvolplugin
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Login to Kata Containers ghcr.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker build and push
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
-        with:
-          tags: ghcr.io/kata-containers/csi-kata-directvolume:${{ inputs.pr-number }}
-          push: true
-          context: src/tools/csi-kata-directvolume/
-          platforms: linux/amd64
-          file: src/tools/csi-kata-directvolume/Dockerfile
-
-  run-kata-monitor-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/run-kata-monitor-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-k8s-tests-on-aks:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-aks.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-amd64:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-amd64.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-arm64:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-arm64
-    uses: ./.github/workflows/run-k8s-tests-on-arm64.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-arm64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-kata-coco-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs:
-     - publish-kata-deploy-payload-amd64
-     - build-and-publish-tee-confidential-unencrypted-image
-     - publish-csi-driver-amd64
-    uses: ./.github/workflows/run-kata-coco-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-zvsi:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: [publish-kata-deploy-payload-s390x, build-and-publish-tee-confidential-unencrypted-image]
-    uses: ./.github/workflows/run-k8s-tests-on-zvsi.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-ppc64le:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-ppc64le
-    uses: ./.github/workflows/run-k8s-tests-on-ppc64le.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-kata-deploy-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: [publish-kata-deploy-payload-amd64]
-    uses: ./.github/workflows/run-kata-deploy-tests.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-metrics-tests:
-    # Skip metrics tests whilst runner is broken
-    if: false
-    # if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/run-metrics.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-basic-amd64-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/basic-ci-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-basic-s390x-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-s390x
-    uses: ./.github/workflows/basic-ci-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-cri-containerd-tests-ppc64le:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-ppc64le
-    uses: ./.github/workflows/run-cri-containerd-tests-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}

.github/workflows/cleanup-resources.yaml

@@ -1,31 +0,0 @@
-name: Cleanup dangling Azure resources
-on:
-  schedule:
-    - cron: "0 0 * * *"
-  workflow_dispatch:
-
-jobs:
-  cleanup-resources:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Log into Azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-
-      - name: Install Python dependencies
-        run: |
-          pip3 install --user --upgrade \
-            azure-identity==1.16.0 \
-            azure-mgmt-resource==23.0.1
-
-      - name: Cleanup resources
-        env:
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-          CLEANUP_AFTER_HOURS: 24 # Clean up resources created more than this many hours ago.
-        run: python3 tests/cleanup_resources.py

.github/workflows/codeql.yml

@@ -1,95 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL Advanced"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '45 0 * * 1'
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ubuntu-24.04
-    permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - language: go
-          build-mode: manual
-        - language: python
-          build-mode: none
-        # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
-        # Use `c-cpp` to analyze code written in C, C++ or both
-        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
-        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
-        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
-        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
-        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    # Add any setup steps before running the `github/codeql-action/init` action.
-    # This includes steps like installing compilers or runtimes (`actions/setup-node`
-    # or others). This is typically only required for manual builds.
-    # - name: Setup runtime (example)
-    #   uses: actions/setup-example@v1
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
-
-    # If the analyze step fails for one of the languages you are analyzing with
-    # "We were unable to automatically build your code", modify the matrix above
-    # to set the build mode to "manual" for that language. Then modify this step
-    # to build your code.
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-    - if: matrix.build-mode == 'manual' && matrix.language == 'go'
-      shell: bash
-      run: |
-        make -C src/runtime
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"

.github/workflows/commit-message-check.yaml

@@ -6,10 +6,6 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 env:
   error_msg: |+
     See the document below for help on formatting commits for the project.
@@ -18,15 +14,13 @@ env:
 
 jobs:
   commit-message-check:
-    runs-on: ubuntu-22.04
-    env:
-      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+    runs-on: ubuntu-latest
     name: Commit Message Check
     steps:
     - name: Get PR Commits
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
       id: 'get-pr-commits'
-      uses: tim-actions/get-pr-commits@c64db31d359214d244884dd68f971a110b29ab83 # v1.2.0
+      uses: tim-actions/get-pr-commits@v1.2.0
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         # Filter out revert commits
@@ -34,26 +28,23 @@ jobs:
         #
         # Revert "<original-subject-line>"
         #
-        # The format of a re-re-vert commit as follows:
-        #
-        # Reapply "<original-subject-line>"
-        filter_out_pattern: '^Revert "|^Reapply "'
+        filter_out_pattern: '^Revert "'
 
     - name: DCO Check
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-      uses: tim-actions/dco@2fd0504dc0d27b33f542867c300c60840c6dcb20 # master (2020-04-28)
+      uses: tim-actions/dco@2fd0504dc0d27b33f542867c300c60840c6dcb20
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
 
     - name: Commit Body Missing Check
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
-      uses: tim-actions/commit-body-check@d2e0e8e1f0332b3281c98867c42a2fbe25ad3f15 # v1.0.2
+      uses: tim-actions/commit-body-check@v1.0.2
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
 
     - name: Check Subject Line Length
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
-      uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd # v0.3.1
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
         pattern: '^.{0,75}(\n.*)*$'
@@ -61,8 +52,8 @@ jobs:
         post_error: ${{ env.error_msg }}
 
     - name: Check Body Line Length
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
-      uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd # v0.3.1
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
         # Notes:
@@ -71,9 +62,6 @@ jobs:
         #   to be specified at the start of the regex as the action is passed
         #   the entire commit message.
         #
-        # - This check will pass if the commit message only contains a subject
-        #   line, as other body message properties are enforced elsewhere.
-        #
         # - Body lines *can* be longer than the maximum if they start
         #   with a non-alphabetic character or if there is no whitespace in
         #   the line.
@@ -87,13 +75,24 @@ jobs:
         #
         # - A SoB comment can be any length (as it is unreasonable to penalise
         #   people with long names/email addresses :)
-        pattern: '(^[^\n]+$|^.+(\n([a-zA-Z].{0,150}|[^a-zA-Z\n].*|[^\s\n]*|Signed-off-by:.*|))+$)'
+        pattern: '^.+(\n([a-zA-Z].{0,150}|[^a-zA-Z\n].*|[^\s\n]*|Signed-off-by:.*|))+$'
         error: 'Body line too long (max 150)'
         post_error: ${{ env.error_msg }}
 
+    - name: Check Fixes
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}
+        pattern: '\s*Fixes\s*:?\s*(#\d+|github\.com\/kata-containers\/[a-z-.]*#\d+)|^\s*release\s*:'
+        flags: 'i'
+        error: 'No "Fixes" found'
+        post_error: ${{ env.error_msg }}
+        one_pass_all_pass: 'true'
+
     - name: Check Subsystem
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
-      uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd # v0.3.1
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
         pattern: '^[\s\t]*[^:\s\t]+[\s\t]*:'

.github/workflows/darwin-tests.yaml

@@ -5,21 +5,17 @@ on:
       - edited
       - reopened
       - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+    paths-ignore: [ '**.md', '**.png', '**.jpg', '**.jpeg', '**.svg', '/docs/**' ]
 name: Darwin tests
 jobs:
   test:
     runs-on: macos-latest
     steps:
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v2
       with:
-        go-version: 1.23.7
+        go-version: 1.19.3
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
     - name: Build utils
       run: ./ci/darwin-test.sh

.github/workflows/docs-url-alive-check.yaml

@@ -5,28 +5,33 @@ on:
 name: Docs URL Alive Check
 jobs:
   test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04
     # don't run this action on forks
     if: github.repository_owner == 'kata-containers'
     env:
       target_branch: ${{ github.base_ref }}
     steps:
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v2
       with:
-        go-version: 1.23.7
+        go-version: 1.19.3
       env:
-        GOPATH: ${{ github.workspace }}/kata-containers
+        GOPATH: ${{ runner.workspace }}/kata-containers
     - name: Set env
       run: |
-        echo "GOPATH=${{ github.workspace }}" >> "$GITHUB_ENV"
-        echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+        echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
+        echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
       with:
         fetch-depth: 0
         path: ./src/github.com/${{ github.repository }}
+    - name: Setup
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/setup.sh
+      env:
+        GOPATH: ${{ runner.workspace }}/kata-containers
     # docs url alive check
     - name: Docs URL Alive Check
       run: |
-        cd "${GOPATH}/src/github.com/${{ github.repository }}" && make docs-url-alive-check
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make docs-url-alive-check

.github/workflows/gatekeeper-skipper.yaml

@@ -1,52 +0,0 @@
-name: Skipper
-
-# This workflow sets various "skip_*" output values that can be used to
-# determine what workflows/jobs are expected to be executed. Sample usage:
-#
-#   skipper:
-#     uses: ./.github/workflows/gatekeeper-skipper.yaml
-#     with:
-#       commit-hash: ${{ github.event.pull_request.head.sha }}
-#       target-branch: ${{ github.event.pull_request.base.ref }}
-#
-#   your-workflow:
-#     needs: skipper
-#     if: ${{ needs.skipper.outputs.skip_build != 'yes' }}
-
-on:
-  workflow_call:
-    inputs:
-      commit-hash:
-        required: true
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-    outputs:
-      skip_build:
-        value: ${{ jobs.skipper.outputs.skip_build }}
-      skip_test:
-        value: ${{ jobs.skipper.outputs.skip_test }}
-      skip_static:
-        value: ${{ jobs.skipper.outputs.skip_static }}
-
-
-jobs:
-  skipper:
-    runs-on: ubuntu-22.04
-    outputs:
-      skip_build: ${{ steps.skipper.outputs.skip_build }}
-      skip_test: ${{ steps.skipper.outputs.skip_test }}
-      skip_static: ${{ steps.skipper.outputs.skip_static }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - id: skipper
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-        run: |
-          python3 tools/testing/gatekeeper/skips.py | tee -a "$GITHUB_OUTPUT"
-        shell: /usr/bin/bash -x {0}

.github/workflows/gatekeeper.yaml

@@ -1,44 +0,0 @@
-name: Gatekeeper
-
-# Gatekeeper uses the "skips.py" to determine which job names/regexps are
-# required for given PR and waits for them to either complete or fail
-# reporting the status.
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  gatekeeper:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-      - id: gatekeeper
-        env:
-          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          COMMIT_HASH: ${{ github.event.pull_request.head.sha }}
-          GH_PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          #!/usr/bin/env bash -x
-          mapfile -t lines < <(python3 tools/testing/gatekeeper/skips.py -t)
-          export REQUIRED_JOBS="${lines[0]}"
-          export REQUIRED_REGEXPS="${lines[1]}"
-          export REQUIRED_LABELS="${lines[2]}"
-          echo "REQUIRED_JOBS: $REQUIRED_JOBS"
-          echo "REQUIRED_REGEXPS: $REQUIRED_REGEXPS"
-          echo "REQUIRED_LABELS: $REQUIRED_LABELS"
-          python3 tools/testing/gatekeeper/jobs.py
-          exit $?
-        shell: /usr/bin/bash -x {0}

.github/workflows/kata-deploy-push.yaml

@@ -0,0 +1,80 @@
+name: kata deploy build
+
+on: 
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+    paths:
+      - tools/**
+      - versions.yaml
+
+jobs:
+  build-asset:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        asset:
+          - kernel
+          - kernel-dragonball-experimental
+          - shim-v2
+          - qemu
+          - cloud-hypervisor
+          - firecracker
+          - rootfs-image
+          - rootfs-initrd
+          - virtiofsd
+          - nydus
+    steps:
+      - uses: actions/checkout@v2
+      - name: Build ${{ matrix.asset }}
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          make "${KATA_ASSET}-tarball"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r --preserve=all "${build_dir}" "kata-build"
+        env:
+          KATA_ASSET: ${{ matrix.asset }}
+
+      - name: store-artifact ${{ matrix.asset }}
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
+
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
+    steps:
+      - uses: actions/checkout@v2
+      - name: get-artifacts
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-artifacts
+          path: build
+      - name: merge-artifacts
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          make merge-builds
+      - name: store-artifacts
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-static-tarball
+          path: kata-static.tar.xz
+
+  make-kata-tarball:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: make kata-tarball
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          make kata-tarball
+          sudo make install-tarball

.github/workflows/kata-deploy-test.yaml

@@ -0,0 +1,164 @@
+on:
+  workflow_dispatch: # this is used to trigger the workflow on non-main branches
+    inputs:
+      pr:
+        description: 'PR number from the selected branch to test'
+        type: string
+        required: true
+  issue_comment:
+    types: [created, edited]
+
+name: test-kata-deploy
+
+jobs:
+  check-comment-and-membership:
+    runs-on: ubuntu-latest
+    if: |
+      github.event.issue.pull_request
+      && github.event_name == 'issue_comment'
+      && github.event.action == 'created'
+      && startsWith(github.event.comment.body, '/test_kata_deploy')
+      || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Check membership on comment or dispatch
+        uses: kata-containers/is-organization-member@1.0.1
+        id: is_organization_member
+        with:
+          organization: kata-containers
+          username: ${{ github.event.comment.user.login || github.event.sender.login }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Fail if not member
+        run: |
+          result=${{ steps.is_organization_member.outputs.result }}
+          if [ $result == false ]; then
+              user=${{ github.event.comment.user.login || github.event.sender.login }}
+              echo Either ${user} is not part of the kata-containers organization
+              echo or ${user} has its Organization Visibility set to Private at
+              echo https://github.com/orgs/kata-containers/people?query=${user}
+              echo 
+              echo Ensure you change your Organization Visibility to Public and
+              echo trigger the test again.
+              exit 1
+          fi
+
+  build-asset:
+    runs-on: ubuntu-latest
+    needs: check-comment-and-membership
+    strategy:
+      matrix:
+        asset:
+          - cloud-hypervisor
+          - firecracker
+          - kernel
+          - kernel-dragonball-experimental
+          - nydus
+          - qemu
+          - rootfs-image
+          - rootfs-initrd
+          - shim-v2
+          - virtiofsd
+    steps:
+      - name: get-PR-ref
+        id: get-PR-ref
+        run: |
+            if [ ${{ github.event_name }} == 'issue_comment' ]; then
+                ref=$(cat $GITHUB_EVENT_PATH | jq -r '.issue.pull_request.url' | sed  's#^.*\/pulls#refs\/pull#' | sed 's#$#\/merge#')
+            else # workflow_dispatch
+                ref="refs/pull/${{ github.event.inputs.pr }}/merge"
+            fi
+            echo "reference for PR: " ${ref} "event:" ${{ github.event_name }}
+            echo "##[set-output name=pr-ref;]${ref}"
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ steps.get-PR-ref.outputs.pr-ref }}
+
+      - name: Build ${{ matrix.asset }}
+        run: |
+          make "${KATA_ASSET}-tarball"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r "${build_dir}" "kata-build"
+        env:
+          KATA_ASSET: ${{ matrix.asset }}
+          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
+
+      - name: store-artifact ${{ matrix.asset }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
+
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
+    steps:
+      - name: get-PR-ref
+        id: get-PR-ref
+        run: |
+            if [ ${{ github.event_name }} == 'issue_comment' ]; then
+                ref=$(cat $GITHUB_EVENT_PATH | jq -r '.issue.pull_request.url' | sed  's#^.*\/pulls#refs\/pull#' | sed 's#$#\/merge#')
+            else # workflow_dispatch
+                ref="refs/pull/${{ github.event.inputs.pr }}/merge"
+            fi
+            echo "reference for PR: " ${ref} "event:" ${{ github.event_name }}
+            echo "##[set-output name=pr-ref;]${ref}"
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ steps.get-PR-ref.outputs.pr-ref }}
+      - name: get-artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-artifacts
+      - name: merge-artifacts
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts
+      - name: store-artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-static-tarball
+          path: kata-static.tar.xz
+
+  kata-deploy:
+    needs: create-kata-tarball
+    runs-on: ubuntu-latest
+    steps:
+      - name: get-PR-ref
+        id: get-PR-ref
+        run: |
+            if [ ${{ github.event_name }} == 'issue_comment' ]; then
+                ref=$(cat $GITHUB_EVENT_PATH | jq -r '.issue.pull_request.url' | sed  's#^.*\/pulls#refs\/pull#' | sed 's#$#\/merge#')
+            else # workflow_dispatch
+                ref="refs/pull/${{ github.event.inputs.pr }}/merge"
+            fi
+            echo "reference for PR: " ${ref} "event:" ${{ github.event_name }}
+            echo "##[set-output name=pr-ref;]${ref}"
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ steps.get-PR-ref.outputs.pr-ref }}
+      - name: get-kata-tarball
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-static-tarball
+      - name: build-and-push-kata-deploy-ci
+        id: build-and-push-kata-deploy-ci
+        run: |
+          PR_SHA=$(git log --format=format:%H -n1)
+          mv kata-static.tar.xz $GITHUB_WORKSPACE/tools/packaging/kata-deploy/kata-static.tar.xz
+          docker build --build-arg KATA_ARTIFACTS=kata-static.tar.xz -t quay.io/kata-containers/kata-deploy-ci:$PR_SHA $GITHUB_WORKSPACE/tools/packaging/kata-deploy
+          docker login -u ${{ secrets.QUAY_DEPLOYER_USERNAME }} -p ${{ secrets.QUAY_DEPLOYER_PASSWORD }} quay.io
+          docker push quay.io/kata-containers/kata-deploy-ci:$PR_SHA
+          mkdir -p packaging/kata-deploy
+          ln -s $GITHUB_WORKSPACE/tools/packaging/kata-deploy/action packaging/kata-deploy/action
+          echo "::set-output name=PKG_SHA::${PR_SHA}"
+      - name: test-kata-deploy-ci-in-aks
+        uses: ./packaging/kata-deploy/action
+        with:
+          packaging-sha: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+        env:
+          PKG_SHA: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+          AZ_APPID: ${{ secrets.AZ_APPID }}
+          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
+          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}

.github/workflows/kata-runtime-classes-sync.yaml

@@ -1,36 +0,0 @@
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-deploy-runtime-classes-check:
-    runs-on: ubuntu-22.04
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    - name: Ensure the split out runtime classes match the all-in-one file
-      run: |
-        pushd tools/packaging/kata-deploy/runtimeclasses/
-        echo "::group::Combine runtime classes"
-        for runtimeClass in $(find . -type f \( -name "*.yaml" -and -not -name "kata-runtimeClasses.yaml" \) | sort); do
-            echo "Adding ${runtimeClass} to the resultingRuntimeClasses.yaml"
-            cat "${runtimeClass}" >> resultingRuntimeClasses.yaml;
-        done
-        echo "::endgroup::"
-        echo "::group::Displaying the content of resultingRuntimeClasses.yaml"
-        cat resultingRuntimeClasses.yaml
-        echo "::endgroup::"
-        echo ""
-        echo "::group::Displaying the content of kata-runtimeClasses.yaml"
-        cat kata-runtimeClasses.yaml
-        echo "::endgroup::"
-        echo ""
-        diff resultingRuntimeClasses.yaml kata-runtimeClasses.yaml

.github/workflows/move-issues-to-in-progress.yaml

@@ -13,7 +13,7 @@ on:
 
 jobs:
   move-linked-issues-to-in-progress:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Install hub
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
@@ -31,24 +31,14 @@ jobs:
         run: |
           # Clone into a temporary directory to avoid overwriting
           # any existing github directory.
-          pushd "$(mktemp -d)" &>/dev/null
+          pushd $(mktemp -d) &>/dev/null
           git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
           sudo install hub-util.sh /usr/local/bin
           popd &>/dev/null
 
       - name: Checkout code to allow hub to communicate with the project
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+        uses: actions/checkout@v2
 
       - name: Move issue to "In progress"
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
@@ -62,19 +52,20 @@ jobs:
             grep -v "^\#"  |\
             cut -d';' -f3 || true)
 
-          # PR doesn't have any linked issues, handle it only if it exists
+          # PR doesn't have any linked issues
+          # (it should, but maybe a new user forgot to add a "Fixes: #XXX" commit).
           [ -z "$linked_issue_urls" ] && {
-            echo "::warning::No linked issues for PR $pr"
-            exit 0
+            echo "::error::No linked issues for PR $pr"
+            exit 1
           }
 
           project_name="Issue backlog"
           project_type="org"
           project_column="In progress"
 
-          for issue_url in $linked_issue_urls
+          for issue_url in $(echo "$linked_issue_urls")
           do
-            issue=$(echo "$issue_url"| awk -F/ '{print $NF}' || true)
+            issue=$(echo "$issue_url"| awk -F\/ '{print $NF}' || true)
 
             [ -z "$issue" ] && {
               echo "::error::Cannot determine issue number from $issue_url for PR $pr"

.github/workflows/payload-after-push.yaml

@@ -1,115 +0,0 @@
-name: CI | Publish Kata Containers payload
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-
-jobs:
-  build-assets-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-assets-arm64:
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-assets-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-assets-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-amd64:
-    needs: build-assets-amd64
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-amd64
-      target-branch: ${{ github.ref_name }}
-      runner: ubuntu-22.04
-      arch: amd64
-    secrets: inherit
-
-  publish-kata-deploy-payload-arm64:
-    needs: build-assets-arm64
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-arm64
-      target-branch: ${{ github.ref_name }}
-      runner: ubuntu-22.04-arm
-      arch: arm64
-    secrets: inherit
-
-  publish-kata-deploy-payload-s390x:
-    needs: build-assets-s390x
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-s390x
-      target-branch: ${{ github.ref_name }}
-      runner: s390x
-      arch: s390x
-    secrets: inherit
-
-  publish-kata-deploy-payload-ppc64le:
-    needs: build-assets-ppc64le
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-ppc64le
-      target-branch: ${{ github.ref_name }}
-      runner: ppc64le
-      arch: ppc64le
-    secrets: inherit
-
-  publish-manifest:
-    runs-on: ubuntu-22.04
-    needs: [publish-kata-deploy-payload-amd64, publish-kata-deploy-payload-arm64, publish-kata-deploy-payload-s390x, publish-kata-deploy-payload-ppc64le]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Push multi-arch manifest
-        run: |
-          ./tools/packaging/release/release.sh publish-multiarch-manifest
-        env:
-          KATA_DEPLOY_IMAGE_TAGS: "kata-containers-latest"
-          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy-ci"

.github/workflows/publish-kata-deploy-payload.yaml

@@ -1,75 +0,0 @@
-name: CI | Publish kata-deploy payload
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-      runner:
-        default: 'ubuntu-22.04'
-        description: The runner to execute the workflow on. Defaults to 'ubuntu-22.04'.
-        required: false
-        type: string
-      arch:
-        description: The arch of the tarball.
-        required: true
-        type: string
-
-jobs:
-  kata-payload:
-    runs-on: ${{ inputs.runner }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball for ${{ inputs.arch }}
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-${{ inputs.arch}}${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload for ${{ inputs.arch }}
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          "$(pwd)"/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}

.github/workflows/release-amd64.yaml

@@ -1,59 +0,0 @@
-name: Publish Kata release artifacts for amd64
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-amd64
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64
-
-      - name: build-and-push-kata-deploy-ci-amd64
-        id: build-and-push-kata-deploy-ci-amd64
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
-          else
-              tags=("${tag}")
-          fi
-          for tag in "${tags[@]}"; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-arm64.yaml

@@ -1,59 +0,0 @@
-name: Publish Kata release artifacts for arm64
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-arm64:
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-arm64
-    runs-on: ubuntu-22.04-arm
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-arm64
-
-      - name: build-and-push-kata-deploy-ci-arm64
-        id: build-and-push-kata-deploy-ci-arm64
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
-          else
-              tags=("${tag}")
-          fi
-          for tag in "${tags[@]}"; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-ppc64le.yaml

@@ -1,59 +0,0 @@
-name: Publish Kata release artifacts for ppc64le
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-ppc64le
-    runs-on: ppc64le
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le
-
-      - name: build-and-push-kata-deploy-ci-ppc64le
-        id: build-and-push-kata-deploy-ci-ppc64le
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
-          else
-              tags=("${tag}")
-          fi
-          for tag in "${tags[@]}"; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-s390x.yaml

@@ -1,59 +0,0 @@
-name: Publish Kata release artifacts for s390x
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-s390x
-    runs-on: s390x
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x
-
-      - name: build-and-push-kata-deploy-ci-s390x
-        id: build-and-push-kata-deploy-ci-s390x
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
-          else
-              tags=("${tag}")
-          fi
-          for tag in "${tags[@]}"; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release.yaml

@@ -1,219 +1,175 @@
-name: Release Kata Containers
+name: Publish Kata release artifacts
 on:
-  workflow_dispatch
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+*'
 
 jobs:
-  release:
-    runs-on: ubuntu-22.04
+  build-asset:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        asset:
+          - cloud-hypervisor
+          - firecracker
+          - kernel
+          - kernel-dragonball-experimental
+          - nydus
+          - qemu
+          - rootfs-image
+          - rootfs-initrd
+          - shim-v2
+          - virtiofsd
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Create a new release
+      - uses: actions/checkout@v2
+      - name: Build ${{ matrix.asset }}
         run: |
-          ./tools/packaging/release/release.sh create-new-release
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-copy-yq-installer.sh
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh --build="${KATA_ASSET}"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r "${build_dir}" "kata-build"
         env:
-          GH_TOKEN: ${{ github.token }}
+          KATA_ASSET: ${{ matrix.asset }}
+          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
 
-  build-and-push-assets-amd64:
-    needs: release
-    uses: ./.github/workflows/release-amd64.yaml
-    with:
-      target-arch: amd64
-    secrets: inherit
+      - name: store-artifact ${{ matrix.asset }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
 
-  build-and-push-assets-arm64:
-    needs: release
-    uses: ./.github/workflows/release-arm64.yaml
-    with:
-      target-arch: arm64
-    secrets: inherit
-
-  build-and-push-assets-s390x:
-    needs: release
-    uses: ./.github/workflows/release-s390x.yaml
-    with:
-      target-arch: s390x
-    secrets: inherit
-
-  build-and-push-assets-ppc64le:
-    needs: release
-    uses: ./.github/workflows/release-ppc64le.yaml
-    with:
-      target-arch: ppc64le
-    secrets: inherit
-
-  publish-multi-arch-images:
-    runs-on: ubuntu-22.04
-    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+      - uses: actions/checkout@v2
+      - name: get-artifacts
+        uses: actions/download-artifact@v2
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+          name: kata-artifacts
+          path: kata-artifacts
+      - name: merge-artifacts
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts
+      - name: store-artifacts
+        uses: actions/upload-artifact@v2
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+          name: kata-static-tarball
+          path: kata-static.tar.xz
 
-      - name: Get the image tags
-        run: |
-          release_version=$(./tools/packaging/release/release.sh release-version)
-          echo "KATA_DEPLOY_IMAGE_TAGS=$release_version latest" >> "$GITHUB_ENV"
-
-      - name: Publish multi-arch manifest on docker.io and quay.io
-        run: |
-          ./tools/packaging/release/release.sh publish-multiarch-manifest
-        env:
-          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy docker.io/katadocker/kata-deploy"
-
-  upload-multi-arch-static-tarball:
-    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
-    runs-on: ubuntu-22.04
+  kata-deploy:
+    needs: create-kata-tarball
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set KATA_STATIC_TARBALL env var
-        run: |
-          tarball=$(pwd)/kata-static.tar.xz
-          echo "KATA_STATIC_TARBALL=${tarball}" >> "$GITHUB_ENV"
-
-      - name: Download amd64 artifacts
-        uses: actions/download-artifact@v4
+      - uses: actions/checkout@v2
+      - name: get-kata-tarball
+        uses: actions/download-artifact@v2
         with:
-          name: kata-static-tarball-amd64
-
-      - name: Upload amd64 static tarball to GitHub
+          name: kata-static-tarball
+      - name: build-and-push-kata-deploy-ci
+        id: build-and-push-kata-deploy-ci
         run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: amd64
-
-      - name: Download arm64 artifacts
-        uses: actions/download-artifact@v4
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          pushd $GITHUB_WORKSPACE
+          git checkout $tag
+          pkg_sha=$(git rev-parse HEAD)
+          popd
+          mv kata-static.tar.xz $GITHUB_WORKSPACE/tools/packaging/kata-deploy/kata-static.tar.xz
+          docker build --build-arg KATA_ARTIFACTS=kata-static.tar.xz -t katadocker/kata-deploy-ci:$pkg_sha -t quay.io/kata-containers/kata-deploy-ci:$pkg_sha $GITHUB_WORKSPACE/tools/packaging/kata-deploy
+          docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
+          docker push katadocker/kata-deploy-ci:$pkg_sha
+          docker login -u ${{ secrets.QUAY_DEPLOYER_USERNAME }} -p ${{ secrets.QUAY_DEPLOYER_PASSWORD }} quay.io
+          docker push quay.io/kata-containers/kata-deploy-ci:$pkg_sha
+          mkdir -p packaging/kata-deploy
+          ln -s $GITHUB_WORKSPACE/tools/packaging/kata-deploy/action packaging/kata-deploy/action
+          echo "::set-output name=PKG_SHA::${pkg_sha}"
+      - name: test-kata-deploy-ci-in-aks
+        uses: ./packaging/kata-deploy/action
         with:
-          name: kata-static-tarball-arm64
-
-      - name: Upload arm64 static tarball to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
+          packaging-sha: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
         env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: arm64
-
-      - name: Download s390x artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x
-
-      - name: Upload s390x static tarball to GitHub
+          PKG_SHA: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+          AZ_APPID: ${{ secrets.AZ_APPID }}
+          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
+          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
+      - name: push-tarball
         run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: s390x
+          # tag the container image we created and push to DockerHub
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tags=($tag)
+          tags+=($([[ "$tag" =~ "alpha"|"rc" ]] && echo "latest" || echo "stable"))
+          for tag in ${tags[@]}; do \
+            docker tag katadocker/kata-deploy-ci:${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}} katadocker/kata-deploy:${tag} && \
+            docker tag quay.io/kata-containers/kata-deploy-ci:${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}} quay.io/kata-containers/kata-deploy:${tag} && \
+            docker push katadocker/kata-deploy:${tag} && \
+            docker push quay.io/kata-containers/kata-deploy:${tag}; \
+          done
 
-      - name: Download ppc64le artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le
-
-      - name: Upload ppc64le static tarball to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: ppc64le
-
-  upload-versions-yaml:
-    needs: release
-    runs-on: ubuntu-22.04
+  upload-static-tarball:
+    needs: kata-deploy
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Upload versions.yaml to GitHub
+      - uses: actions/checkout@v2
+      - name: download-artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-static-tarball
+      - name: install hub
         run: |
-          ./tools/packaging/release/release.sh upload-versions-yaml-file
-        env:
-          GH_TOKEN: ${{ github.token }}
+          HUB_VER=$(curl -s "https://api.github.com/repos/github/hub/releases/latest" | jq -r .tag_name | sed 's/^v//')
+          wget -q -O- https://github.com/github/hub/releases/download/v$HUB_VER/hub-linux-amd64-$HUB_VER.tgz | \
+          tar xz --strip-components=2 --wildcards '*/bin/hub' && sudo mv hub /usr/local/bin/hub
+      - name: push static tarball to github
+        run: |
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tarball="kata-static-$tag-x86_64.tar.xz"
+          mv kata-static.tar.xz "$GITHUB_WORKSPACE/${tarball}"
+          pushd $GITHUB_WORKSPACE
+          echo "uploading asset '${tarball}' for tag: ${tag}"
+          GITHUB_TOKEN=${{ secrets.GIT_UPLOAD_TOKEN }} hub release edit -m "" -a "${tarball}" "${tag}"
+          popd
 
   upload-cargo-vendored-tarball:
-    needs: release
-    runs-on: ubuntu-22.04
+    needs: upload-static-tarball
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Generate and upload vendored code tarball
+      - uses: actions/checkout@v2
+      - name: generate-and-upload-tarball
         run: |
-          ./tools/packaging/release/release.sh upload-vendored-code-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tarball="kata-containers-$tag-vendor.tar.gz"
+          pushd $GITHUB_WORKSPACE
+          bash -c "tools/packaging/release/generate_vendor.sh ${tarball}"
+          GITHUB_TOKEN=${{ secrets.GIT_UPLOAD_TOKEN }} hub release edit -m "" -a "${tarball}" "${tag}" 
+          popd
 
   upload-libseccomp-tarball:
-    needs: release
-    runs-on: ubuntu-22.04
+    needs: upload-cargo-vendored-tarball
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Download libseccomp tarball and upload it to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-libseccomp-tarball
+      - uses: actions/checkout@v2
+      - name: download-and-upload-tarball
         env:
-          GH_TOKEN: ${{ github.token }}
-
-  upload-helm-chart-tarball:
-    needs: release
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install helm
-        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
-        id: install
-
-      - name: Generate and upload helm chart tarball
+          GITHUB_TOKEN: ${{ secrets.GIT_UPLOAD_TOKEN }}
+          GOPATH: ${HOME}/go
         run: |
-          ./tools/packaging/release/release.sh upload-helm-chart-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Login to the OCI registries
-        run: |
-          echo "${{ secrets.QUAY_DEPLOYER_PASSWORD }}" | helm registry login quay.io --username "${{ secrets.QUAY_DEPLOYER_USERNAME }}" --password-stdin
-          echo "${{ secrets.DOCKER_PASSWORD }}" | helm registry login docker.io --username "${{ secrets.DOCKER_USERNAME }}" --password-stdin
-          echo "${{ github.token }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
-
-      - name: Push helm chart to the OCI registries
-        run: |
-          release_version=$(./tools/packaging/release/release.sh release-version)
-          helm push "kata-deploy-${release_version}.tgz" oci://quay.io/kata-containers/kata-deploy-charts
-          helm push "kata-deploy-${release-version}.tgz" oci://docker.io/katadocker/kata-deploy-charts
-          helm push "kata-deploy-${release-version}.tgz" oci://ghcr.io/kata-containers/kata-deploy-charts
-
-  publish-release:
-    needs: [ build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le, publish-multi-arch-images, upload-multi-arch-static-tarball, upload-versions-yaml, upload-cargo-vendored-tarball, upload-libseccomp-tarball ]
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Publish a release
-        run: |
-          ./tools/packaging/release/release.sh publish-release
-        env:
-          GH_TOKEN: ${{ github.token }}
+          pushd $GITHUB_WORKSPACE
+          ./ci/install_yq.sh
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          versions_yaml="versions.yaml"
+          version=$(${GOPATH}/bin/yq read ${versions_yaml} "externals.libseccomp.version")
+          repo_url=$(${GOPATH}/bin/yq read ${versions_yaml} "externals.libseccomp.url")
+          download_url="${repo_url}/releases/download/v${version}"
+          tarball="libseccomp-${version}.tar.gz"
+          asc="${tarball}.asc"
+          curl -sSLO "${download_url}/${tarball}"
+          curl -sSLO "${download_url}/${asc}"
+          # "-m" option should be empty to re-use the existing release title
+          # without opening a text editor.
+          # For the details, check https://hub.github.com/hub-release.1.html.
+          hub release edit -m "" -a "${tarball}" "${tag}"
+          hub release edit -m "" -a "${asc}" "${tag}"
+          popd

.github/workflows/require-pr-porting-labels.yaml

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+name: Ensure PR has required porting labels
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - labeled
+      - unlabeled
+    branches:
+      - main
+
+jobs:
+  check-pr-porting-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install hub
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          HUB_ARCH="amd64"
+          HUB_VER=$(curl -sL "https://api.github.com/repos/github/hub/releases/latest" |\
+            jq -r .tag_name | sed 's/^v//')
+          curl -sL \
+            "https://github.com/github/hub/releases/download/v${HUB_VER}/hub-linux-${HUB_ARCH}-${HUB_VER}.tgz" |\
+          tar xz --strip-components=2 --wildcards '*/bin/hub' && \
+          sudo install hub /usr/local/bin
+
+      - name: Checkout code to allow hub to communicate with the project
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/checkout@v2
+
+      - name: Install porting checker script
+        run: |
+          # Clone into a temporary directory to avoid overwriting
+          # any existing github directory.
+          pushd $(mktemp -d) &>/dev/null
+          git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
+          sudo install pr-porting-checks.sh /usr/local/bin
+          popd &>/dev/null
+
+      - name: Stop PR being merged unless it has a correct set of porting labels
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.KATA_GITHUB_ACTIONS_TOKEN }}
+        run: |
+          pr=${{ github.event.number }}
+          repo=${{ github.repository }}
+
+          pr-porting-checks.sh "$pr" "$repo"

.github/workflows/run-cri-containerd-tests-ppc64le.yaml

@@ -1,57 +0,0 @@
-name: CI | Run cri-containerd tests on ppc64le
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['qemu']
-    runs-on: ppc64le
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        timeout-minutes: 15
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        run: bash tests/integration/cri-containerd/gha-run.sh run

.github/workflows/run-k8s-tests-on-aks.yaml

@@ -1,133 +0,0 @@
-name: CI | Run kubernetes tests on AKS
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        host_os:
-          - ubuntu
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - qemu-runtime-rs
-          - stratovirt
-          - cloud-hypervisor
-        instance-type:
-          - small
-          - normal
-        include:
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: small
-            genpolicy-pull-method: oci-distribution
-            auto-generate-policy: yes
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: small
-            genpolicy-pull-method: containerd
-            auto-generate-policy: yes
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: normal
-            auto-generate-policy: yes
-    runs-on: ubuntu-22.04
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
-      GENPOLICY_PULL_METHOD: ${{ matrix.genpolicy-pull-method }}
-      AUTO_GENERATE_POLICY: ${{ matrix.auto-generate-policy }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
-
-      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
-        with:
-          timeout_minutes: 15
-          max_attempts: 20
-          retry_on: error
-          retry_wait_seconds: 10
-          command: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

.github/workflows/run-k8s-tests-on-amd64.yaml

@@ -1,109 +0,0 @@
-name: CI | Run kubernetes tests on amd64
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests-amd64:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh #cloud-hypervisor
-          - dragonball
-          - fc #firecracker
-          - qemu
-          - cloud-hypervisor
-        container_runtime:
-          - containerd
-        snapshotter:
-          - devmapper
-        k8s:
-          - k3s
-        include:
-          - vmm: qemu
-            container_runtime: crio
-            snapshotter: ""
-            k8s: k0s
-    runs-on: ubuntu-22.04
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      KUBERNETES_EXTRA_PARAMS: ${{ matrix.container_runtime != 'crio' && '' || '--cri-socket remote:unix:///var/run/crio/crio.sock --kubelet-extra-args --cgroup-driver="systemd"' }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: all
-      CONTAINER_RUNTIME: ${{ matrix.container_runtime }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Configure CRI-O
-        if: matrix.container_runtime == 'crio'
-        run: bash tests/integration/kubernetes/gha-run.sh setup-crio
-
-      - name: Deploy ${{ matrix.k8s }}
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Configure the ${{ matrix.snapshotter }} snapshotter
-        if: matrix.snapshotter != ''
-        run: bash tests/integration/kubernetes/gha-run.sh configure-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Collect artifacts ${{ matrix.vmm }}
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
-        continue-on-error: true
-
-      - name: Archive artifacts ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: k8s-tests-${{ matrix.vmm }}-${{ matrix.snapshotter }}-${{ matrix.k8s }}-${{ inputs.tag }}
-          path: /tmp/artifacts
-          retention-days: 1
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup

.github/workflows/run-k8s-tests-on-arm64.yaml

@@ -1,83 +0,0 @@
-name: CI | Run kubernetes tests on arm64
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests-on-arm64:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        k8s:
-          - kubeadm
-    runs-on: arm64-k8s
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: all
-      TARGET_ARCH: "aarch64"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Collect artifacts ${{ matrix.vmm }}
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
-        continue-on-error: true
-
-      - name: Archive artifacts ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: k8s-tests-${{ matrix.vmm }}-${{ matrix.k8s }}-${{ inputs.tag }}
-          path: /tmp/artifacts
-          retention-days: 1
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup

.github/workflows/run-k8s-tests-on-ppc64le.yaml

@@ -1,77 +0,0 @@
-name: CI | Run kubernetes tests on Power(ppc64le)
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        k8s:
-          - kubeadm
-    runs-on: k8s-ppc64le
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      USING_NFD: "false"
-      TARGET_ARCH: "ppc64le"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install golang
-        run: |
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
-
-      - name: Prepare the runner for k8s cluster creation
-        run: bash "${HOME}/scripts/k8s_cluster_cleanup.sh"
-
-      - name: Create k8s cluster using kubeadm
-        run: bash "${HOME}/scripts/k8s_cluster_create.sh"
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-kubeadm
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete cluster and post cleanup actions
-        run: bash "${HOME}/scripts/k8s_cluster_cleanup.sh"

.github/workflows/run-k8s-tests-on-zvsi.yaml

@@ -1,137 +0,0 @@
-name: CI | Run kubernetes tests on IBM Cloud Z virtual server instance (zVSI)
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        snapshotter:
-          - overlayfs
-          - devmapper
-          - nydus
-        vmm:
-          - qemu
-          - qemu-runtime-rs
-          - qemu-coco-dev
-        k8s:
-          - kubeadm
-        include:
-          - snapshotter: devmapper
-            pull-type: default
-            using-nfd: true
-            deploy-cmd: configure-snapshotter
-          - snapshotter: nydus
-            pull-type: guest-pull
-            using-nfd: false
-            deploy-cmd: deploy-snapshotter
-        exclude:
-          - snapshotter: overlayfs
-            vmm: qemu
-          - snapshotter: overlayfs
-            vmm: qemu-coco-dev
-          - snapshotter: devmapper
-            vmm: qemu-runtime-rs
-          - snapshotter: devmapper
-            vmm: qemu-coco-dev
-          - snapshotter: nydus
-            vmm: qemu
-          - snapshotter: nydus
-            vmm: qemu-runtime-rs
-    runs-on: s390x-large
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: "ubuntu"
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: ${{ matrix.using-nfd }}
-      TARGET_ARCH: "s390x"
-      AUTHENTICATED_IMAGE_USER: ${{ secrets.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Set SNAPSHOTTER to empty if overlayfs
-        run: echo "SNAPSHOTTER=" >> "$GITHUB_ENV"
-        if: ${{ matrix.snapshotter == 'overlayfs' }}
-
-      - name: Set KBS and KBS_INGRESS if qemu-coco-dev
-        run: |
-          echo "KBS=true" >> "$GITHUB_ENV"
-          echo "KBS_INGRESS=nodeport" >> "$GITHUB_ENV"
-        if: ${{ matrix.vmm == 'qemu-coco-dev' }}
-
-      # qemu-runtime-rs only works with overlayfs
-      # See: https://github.com/kata-containers/kata-containers/issues/10066
-      - name: Configure the ${{ matrix.snapshotter }} snapshotter
-        run: bash tests/integration/kubernetes/gha-run.sh ${{ matrix.deploy-cmd }}
-        if: ${{ matrix.snapshotter != 'overlayfs' }}
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-zvsi
-
-      - name: Uninstall previous `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
-        if: ${{ matrix.vmm == 'qemu-coco-dev' }}
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-        if: ${{ matrix.vmm == 'qemu-coco-dev' }}
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-        if: ${{ matrix.vmm == 'qemu-coco-dev' }}
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-zvsi
-
-      - name: Delete CoCo KBS
-        if: always()
-        run: |
-          if [ "${KBS}" == "true" ]; then
-            bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
-          fi

.github/workflows/run-kata-coco-stability-tests.yaml

@@ -1,129 +0,0 @@
-name: CI | Run Kata CoCo k8s Stability Tests
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-      tarball-suffix:
-        required: false
-        type: string
-
-jobs:
-  # Generate jobs for testing CoCo on non-TEE environments
-  run-stability-k8s-tests-coco-nontee:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-coco-dev
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: ubuntu-22.04
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      # Some tests rely on that variable to run (or not)
-      KBS: "true"
-      # Set the KBS ingress handler (empty string disables handling)
-      KBS_INGRESS: "aks"
-      KUBERNETES: "vanilla"
-      PULL_TYPE: ${{ matrix.pull-type }}
-      AUTHENTICATED_IMAGE_USER: ${{ secrets.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
-
-      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
-        with:
-          timeout_minutes: 15
-          max_attempts: 20
-          retry_on: error
-          retry_wait_seconds: 10
-          command: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Run stability tests
-        timeout-minutes: 300
-        run: bash tests/stability/gha-stability-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

.github/workflows/run-kata-coco-tests.yaml

@@ -1,308 +0,0 @@
-name: CI | Run kata coco tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests-on-tdx:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-tdx
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: tdx
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      USING_NFD: "true"
-      KBS: "true"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      KBS_INGRESS: "nodeport"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-      AUTHENTICATED_IMAGE_USER: ${{ secrets.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      ITA_KEY: ${{ secrets.ITA_KEY }}
-      AUTO_GENERATE_POLICY: "yes"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-tdx
-
-      - name: Uninstall previous `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Deploy CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
-
-      - name: Run tests
-        timeout-minutes: 100
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-tdx
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-      - name: Delete CoCo KBS
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
-
-      - name: Delete CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
-
-  # AMD has deprecated SEV support on Kata and henceforth SNP will be the only feature supported for Kata Containers.
-  run-k8s-tests-sev-snp:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-snp
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: sev-snp
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBECONFIG: /home/kata/.kube/config
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      KBS: "true"
-      KBS_INGRESS: "nodeport"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-      AUTHENTICATED_IMAGE_USER: ${{ secrets.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      AUTO_GENERATE_POLICY: "yes"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-snp
-
-      - name: Uninstall previous `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Deploy CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
-
-      - name: Run tests
-        timeout-minutes: 50
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snp
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-      - name: Delete CoCo KBS
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
-
-      - name: Delete CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
-
-  # Generate jobs for testing CoCo on non-TEE environments
-  run-k8s-tests-coco-nontee:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-coco-dev
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: ubuntu-22.04
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      # Some tests rely on that variable to run (or not)
-      KBS: "true"
-      # Set the KBS ingress handler (empty string disables handling)
-      KBS_INGRESS: "aks"
-      KUBERNETES: "vanilla"
-      PULL_TYPE: ${{ matrix.pull-type }}
-      AUTHENTICATED_IMAGE_USER: ${{ secrets.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      # Caution: current ingress controller used to expose the KBS service
-      # requires much vCPUs, lefting only a few for the tests. Depending on the
-      # host type chose it will result on the creation of a cluster with
-      # insufficient resources.
-      K8S_TEST_HOST_TYPE: "all"
-      USING_NFD: "false"
-      AUTO_GENERATE_POLICY: "yes"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
-
-      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
-        with:
-          timeout_minutes: 15
-          max_attempts: 20
-          retry_on: error
-          retry_wait_seconds: 10
-          command: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Deploy CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
-
-      - name: Run tests
-        timeout-minutes: 80
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

.github/workflows/run-kata-deploy-tests-on-aks.yaml

@@ -1,96 +0,0 @@
-name: CI | Run kata-deploy tests on AKS
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-kata-deploy-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        host_os:
-          - ubuntu
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - qemu-runtime-rs
-        include:
-          - host_os: cbl-mariner
-            vmm: clh
-    runs-on: ubuntu-22.04
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Download Azure CLI
-        run: bash tests/functional/kata-deploy/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/functional/kata-deploy/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
-        with:
-          timeout_minutes: 15
-          max_attempts: 20
-          retry_on: error
-          retry_wait_seconds: 10
-          command: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/functional/kata-deploy/gha-run.sh get-cluster-credentials
-
-      - name: Run tests
-        run: bash tests/functional/kata-deploy/gha-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/functional/kata-deploy/gha-run.sh delete-cluster

.github/workflows/run-kata-deploy-tests.yaml

@@ -1,65 +0,0 @@
-name: CI | Run kata-deploy tests
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-kata-deploy-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        k8s:
-          - k0s
-          - k3s
-          - rke2
-          - microk8s
-    runs-on: ubuntu-22.04
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy ${{ matrix.k8s }}
-        run:  bash tests/functional/kata-deploy/gha-run.sh deploy-k8s
-
-      - name: Install `bats`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-bats
-
-      - name: Run tests
-        run: bash tests/functional/kata-deploy/gha-run.sh run-tests

.github/workflows/run-kata-monitor-tests.yaml

@@ -1,64 +0,0 @@
-name: CI | Run kata-monitor tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-monitor:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        container_engine:
-          - crio
-          - containerd
-        # TODO: enable when https://github.com/kata-containers/kata-containers/issues/9853 is fixed
-        #include:
-        #  - container_engine: containerd
-        #    containerd_version: lts
-        exclude:
-          # TODO: enable with containerd when https://github.com/kata-containers/kata-containers/issues/9761 is fixed
-          - container_engine: containerd
-            vmm: qemu
-    runs-on: ubuntu-22.04
-    env:
-      CONTAINER_ENGINE: ${{ matrix.container_engine }}
-      #CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/kata-monitor/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/functional/kata-monitor/gha-run.sh install-kata kata-artifacts
-
-      - name: Run kata-monitor tests
-        run: bash tests/functional/kata-monitor/gha-run.sh run

.github/workflows/run-metrics.yaml

@@ -1,125 +0,0 @@
-name: CI | Run test metrics
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-metrics:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm: ['clh', 'qemu']
-      max-parallel: 1
-    runs-on: metrics
-    env:
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      K8S_TEST_HOST_TYPE: "baremetal"
-      USING_NFD: "false"
-      KUBERNETES: kubeadm
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-kubeadm
-
-      - name: Install check metrics
-        run: bash tests/metrics/gha-run.sh install-checkmetrics
-
-      - name: enabling the hypervisor
-        run: bash tests/metrics/gha-run.sh enabling-hypervisor
-
-      - name: run launch times test
-        timeout-minutes: 15
-        continue-on-error: true
-        run: bash tests/metrics/gha-run.sh run-test-launchtimes
-
-      - name: run memory foot print test
-        timeout-minutes: 15
-        continue-on-error: true
-        run:  bash tests/metrics/gha-run.sh run-test-memory-usage
-
-      - name: run memory usage inside container test
-        timeout-minutes: 15
-        continue-on-error: true
-        run:  bash tests/metrics/gha-run.sh run-test-memory-usage-inside-container
-
-      - name: run blogbench test
-        timeout-minutes: 15
-        continue-on-error: true
-        run:  bash tests/metrics/gha-run.sh run-test-blogbench
-
-      - name: run tensorflow test
-        timeout-minutes: 15
-        continue-on-error: true
-        run:  bash tests/metrics/gha-run.sh run-test-tensorflow
-
-      - name: run fio test
-        timeout-minutes: 15
-        continue-on-error: true
-        run:  bash tests/metrics/gha-run.sh run-test-fio
-
-      - name: run iperf test
-        timeout-minutes: 15
-        continue-on-error: true
-        run:  bash tests/metrics/gha-run.sh run-test-iperf
-
-      - name: run latency test
-        timeout-minutes: 15
-        continue-on-error: true
-        run:  bash tests/metrics/gha-run.sh run-test-latency
-
-      - name: check metrics
-        run:  bash tests/metrics/gha-run.sh check-metrics
-
-      - name: make metrics tarball ${{ matrix.vmm }}
-        run: bash tests/metrics/gha-run.sh make-tarball-results
-
-      - name: archive metrics results ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: metrics-artifacts-${{ matrix.vmm }}
-          path: results-${{ matrix.vmm }}.tar.gz
-          retention-days: 1
-          if-no-files-found: error
-
-      - name: Delete kata-deploy
-        timeout-minutes: 10
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-kubeadm

.github/workflows/run-runk-tests.yaml

@@ -1,48 +0,0 @@
-name: CI | Run runk tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-runk:
-    # Skip runk tests as we have no maintainers. TODO: Decide when to remove altogether
-    if: false
-    runs-on: ubuntu-22.04
-    env:
-      CONTAINERD_VERSION: lts
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/runk/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
-
-      - name: Run runk tests
-        run: bash tests/integration/runk/gha-run.sh run

.github/workflows/shellcheck.yaml

@@ -1,30 +0,0 @@
-# https://github.com/marketplace/actions/shellcheck
-name: Check shell scripts
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  shellcheck:
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/checkout@v4
-      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master (2024-06-20)
-        with:
-          ignore_paths: "**/vendor/**"

.github/workflows/shellcheck_required.yaml

@@ -1,32 +0,0 @@
-
-# https://github.com/marketplace/actions/shellcheck
-name: Shellcheck required
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  shellcheck-required:
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/checkout@v4
-      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master (2024-06-20)
-        with:
-          severity: error
-          ignore_paths: "**/vendor/**"

.github/workflows/snap-release.yaml

@@ -0,0 +1,52 @@
+name: Release Kata in snapcraft store
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+*'
+
+env:
+  SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.snapcraft_token }}
+
+jobs:
+  release-snap:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install Snapcraft
+        run: |
+          # Required to avoid snapcraft install failure
+          sudo chown root:root /
+
+          # "--classic" is needed for the GitHub action runner
+          # environment.
+          sudo snap install snapcraft --classic
+
+          # Allow other parts to access snap binaries
+          echo /snap/bin >> "$GITHUB_PATH"
+
+      - name: Build snap
+        run: |
+          # Removing man-db, workflow kept failing, fixes: #4480
+          sudo apt -y remove --purge man-db
+          sudo apt-get install -y git git-extras
+          kata_url="https://github.com/kata-containers/kata-containers"
+          latest_version=$(git ls-remote --tags ${kata_url}  | egrep -o "refs.*" | egrep -v "\-alpha|\-rc|{}" | egrep -o "[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+" | sort -V -r | head -1)
+          current_version="$(echo ${GITHUB_REF} | cut -d/ -f3)"
+          # Check semantic versioning format (x.y.z) and if the current tag is the latest tag
+          if echo "${current_version}" | grep -q "^[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+$" && echo -e "$latest_version\n$current_version" | sort -C -V; then
+            # Current version is the latest version, build it
+            snapcraft snap --debug --destructive-mode
+          fi
+
+      - name: Upload snap
+        run: |
+          snap_version="$(echo ${GITHUB_REF} | cut -d/ -f3)"
+          snap_file="kata-containers_${snap_version}_amd64.snap"
+          # Upload the snap if it exists
+          if [ -f ${snap_file} ]; then
+            snapcraft upload --release=stable ${snap_file}
+          fi

.github/workflows/snap.yaml

@@ -0,0 +1,37 @@
+name: snap CI
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+    paths-ignore: [ '**.md', '**.png', '**.jpg', '**.jpeg', '**.svg', '/docs/**' ]
+
+jobs:
+  test:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Check out
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install Snapcraft
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          # Required to avoid snapcraft install failure
+          sudo chown root:root /
+
+          # "--classic" is needed for the GitHub action runner
+          # environment.
+          sudo snap install snapcraft --classic
+
+          # Allow other parts to access snap binaries
+          echo /snap/bin >> "$GITHUB_PATH"
+
+      - name: Build snap
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          snapcraft snap --debug --destructive-mode

.github/workflows/stale.yaml

@@ -1,17 +0,0 @@
-name: 'Automatically close stale PRs'
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-jobs:
-  stale:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/stale@v9
-        with:
-          stale-pr-message: 'This PR has been opened without with no activity for 180 days. Comment on the issue otherwise it will be closed in 7 days'
-          days-before-pr-stale: 180
-          days-before-pr-close: 7
-          days-before-issue-stale: -1
-          days-before-issue-close: -1

.github/workflows/static-checks-dragonball.yaml

@@ -0,0 +1,33 @@
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+    paths-ignore: [ '**.md', '**.png', '**.jpg', '**.jpeg', '**.svg', '/docs/**' ]
+
+name: Static checks dragonball
+jobs:
+  test-dragonball:
+    runs-on: self-hosted
+    env:
+      RUST_BACKTRACE: "1"
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set env
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
+      - name: Install Rust
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          ./ci/install_rust.sh
+          PATH=$PATH:"$HOME/.cargo/bin"
+      - name: Run Unit Test
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          cd src/dragonball
+          cargo version
+          rustc --version
+          sudo -E env PATH=$PATH LIBC=gnu SUPPORT_VIRTUALIZATION=true make test

.github/workflows/static-checks-self-hosted.yaml

@@ -1,46 +0,0 @@
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - labeled # a workflow runs only when the 'ok-to-test' label is added
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-name: Static checks self-hosted
-jobs:
-  skipper:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}
-    uses: ./.github/workflows/gatekeeper-skipper.yaml
-    with:
-      commit-hash: ${{ github.event.pull_request.head.sha }}
-      target-branch: ${{ github.event.pull_request.base.ref }}
-
-  build-checks:
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        instance:
-          - "ubuntu-22.04-arm"
-          - "s390x"
-          - "ppc64le"
-    uses: ./.github/workflows/build-checks.yaml
-    with:
-      instance: ${{ matrix.instance }}
-
-  build-checks-preview:
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        instance:
-          - "riscv-builder"
-    uses: ./.github/workflows/build-checks-preview-riscv64.yaml
-    with:
-      instance: ${{ matrix.instance }}

.github/workflows/static-checks.yaml

@@ -6,121 +6,93 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 name: Static checks
 jobs:
-  skipper:
-    uses: ./.github/workflows/gatekeeper-skipper.yaml
-    with:
-      commit-hash: ${{ github.event.pull_request.head.sha }}
-      target-branch: ${{ github.event.pull_request.base.ref }}
-
-  check-kernel-config-version:
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Ensure the kernel config version has been updated
-        run: |
-          kernel_dir="tools/packaging/kernel/"
-          kernel_version_file="${kernel_dir}kata_config_version"
-          modified_files=$(git diff --name-only origin/"$GITHUB_BASE_REF"..HEAD)
-          if git diff --name-only origin/"$GITHUB_BASE_REF"..HEAD "${kernel_dir}" | grep "${kernel_dir}"; then
-            echo "Kernel directory has changed, checking if $kernel_version_file has been updated"
-            if echo "$modified_files" | grep -v "README.md" | grep "${kernel_dir}" >>"/dev/null"; then
-              echo "$modified_files" | grep "$kernel_version_file" >>/dev/null || ( echo "Please bump version in $kernel_version_file" && exit 1)
-            else
-              echo "Readme file changed, no need for kernel config version update."
-            fi
-            echo "Check passed"
-          fi
-
-  build-checks:
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
-    uses: ./.github/workflows/build-checks.yaml
-    with:
-      instance: ubuntu-22.04
-
-  build-checks-depending-on-kvm:
-    runs-on: ubuntu-22.04
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        component:
-          - runtime-rs
-        include:
-          - component: runtime-rs
-            command: "sudo -E env PATH=$PATH LIBC=gnu SUPPORT_VIRTUALIZATION=true make test"
-          - component: runtime-rs
-            component-path: src/dragonball
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Install system deps
-        run: |
-          sudo apt-get update && sudo apt-get install -y build-essential musl-tools
-      - name: Install yq
-        run: |
-          sudo -E ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install rust
-        run: |
-          export PATH="$PATH:/usr/local/bin"
-          ./tests/install_rust.sh
-      - name: Running `${{ matrix.command }}` for ${{ matrix.component }}
-        run: |
-          export PATH="$PATH:${HOME}/.cargo/bin"
-          cd ${{ matrix.component-path }}
-          ${{ matrix.command }}
-        env:
-          RUST_BACKTRACE: "1"
-          RUST_LIB_BACKTRACE: "0"
-
   static-checks:
-    runs-on: ubuntu-22.04
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
+    runs-on: ubuntu-20.04
     strategy:
-      fail-fast: false
       matrix:
         cmd:
+          - "make vendor"
           - "make static-checks"
+          - "make check"
+          - "make test"
+          - "sudo -E PATH=\"$PATH\" make test"
     env:
-      GOPATH: ${{ github.workspace }}
+      TRAVIS: "true"
+      TRAVIS_BRANCH: ${{ github.base_ref }}
+      TRAVIS_PULL_REQUEST_BRANCH: ${{ github.head_ref }}
+      TRAVIS_PULL_REQUEST_SHA : ${{ github.event.pull_request.head.sha }}
+      RUST_BACKTRACE: "1"
+      target_branch: ${{ github.base_ref }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          path: ./src/github.com/${{ github.repository }}
-      - name: Install yq
-        run: |
-          cd "${GOPATH}/src/github.com/${{ github.repository }}"
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install golang
-        run: |
-          cd "${GOPATH}/src/github.com/${{ github.repository }}"
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update && sudo apt-get -y install moreutils hunspell hunspell-en-gb hunspell-en-us pandoc
-      - name: Run check
-        run: |
-          export PATH="${PATH}:${GOPATH}/bin"
-          cd "${GOPATH}/src/github.com/${{ github.repository }}" && ${{ matrix.cmd }}
+    - name: Checkout code
+      uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+        path: ./src/github.com/${{ github.repository }}
+    - name: Install Go
+      uses: actions/setup-go@v3
+      with:
+        go-version: 1.19.3
+      env:
+        GOPATH: ${{ runner.workspace }}/kata-containers
+    - name: Check kernel config version
+      run: |
+        cd "${{ github.workspace }}/src/github.com/${{ github.repository }}"
+        kernel_dir="tools/packaging/kernel/"
+        kernel_version_file="${kernel_dir}kata_config_version"
+        modified_files=$(git diff --name-only origin/main..HEAD)
+        result=$(git whatchanged origin/main..HEAD "${kernel_dir}" >>"/dev/null")
+        if git whatchanged origin/main..HEAD "${kernel_dir}" >>"/dev/null"; then
+          echo "Kernel directory has changed, checking if $kernel_version_file has been updated"
+          if echo "$modified_files" | grep -v "README.md" | grep "${kernel_dir}" >>"/dev/null"; then
+            echo "$modified_files" | grep "$kernel_version_file" >>/dev/null || ( echo "Please bump version in $kernel_version_file" && exit 1)
+          else
+            echo "Readme file changed, no need for kernel config version update."
+          fi
+          echo "Check passed"
+        fi
+    - name: Setup GOPATH
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "TRAVIS_BRANCH: ${TRAVIS_BRANCH}"
+        echo "TRAVIS_PULL_REQUEST_BRANCH: ${TRAVIS_PULL_REQUEST_BRANCH}"
+        echo "TRAVIS_PULL_REQUEST_SHA: ${TRAVIS_PULL_REQUEST_SHA}"
+        echo "TRAVIS: ${TRAVIS}"
+    - name: Set env
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
+        echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+    - name: Setup travis references
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "TRAVIS_BRANCH=${TRAVIS_BRANCH:-$(echo $GITHUB_REF | awk 'BEGIN { FS = \"/\" } ; { print $3 }')}"
+        target_branch=${TRAVIS_BRANCH}
+    - name: Setup
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/setup.sh
+      env:
+        GOPATH: ${{ runner.workspace }}/kata-containers
+    - name: Installing rust
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/install_rust.sh
+        PATH=$PATH:"$HOME/.cargo/bin"
+        rustup target add x86_64-unknown-linux-musl
+        rustup component add rustfmt clippy
+    - name: Setup seccomp
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
+        gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
+        echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
+        echo "LIBSECCOMP_LINK_TYPE=static" >> $GITHUB_ENV
+        echo "LIBSECCOMP_LIB_PATH=${libseccomp_install_dir}/lib" >> $GITHUB_ENV
+    - name: Run check
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ${{ matrix.cmd }}

.gitignore

@@ -6,8 +6,6 @@
 **/.vscode
 **/.idea
 **/.fleet
-**/*.swp
-**/*.swo
 pkg/logging/Cargo.lock
 src/agent/src/version.rs
 src/agent/kata-agent.service
@@ -15,4 +13,3 @@ src/agent/protocols/src/*.rs
 !src/agent/protocols/src/lib.rs
 build
 src/tools/log-parser/kata-log-parser
-tools/packaging/static-build/agent/install_libseccomp.sh

CODEOWNERS

@@ -1,4 +1,4 @@
-# Copyright (c) 2019-2023 Intel Corporation
+# Copyright (c) 2019 Intel Corporation
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -9,83 +9,4 @@
 # Order in this file is important. Only the last match will be
 # used. See https://help.github.com/articles/about-code-owners/
 
-/CODEOWNERS			@kata-containers/codeowners
-
-VERSION				@kata-containers/release
-
-# The versions database needs careful handling
-versions.yaml			@kata-containers/release @kata-containers/ci @kata-containers/tests
-
-Makefile*			@kata-containers/build
-*.mak				@kata-containers/build
-*.mk				@kata-containers/build
-
-# Documentation related files could also appear anywhere
-# else in the repo.
-*.md				@kata-containers/documentation
-*.drawio			@kata-containers/documentation
-*.jpg				@kata-containers/documentation
-*.png				@kata-containers/documentation
-*.svg				@kata-containers/documentation
-
-*.bash				@kata-containers/shell
-*.sh				@kata-containers/shell
-**/completions/			@kata-containers/shell
-
-Dockerfile*			@kata-containers/docker
-
-/ci/				@kata-containers/ci
-
-*.bats				@kata-containers/tests
-/tests/				@kata-containers/tests
-
-*.rs				@kata-containers/rust
-*.go				@kata-containers/golang
-
-/utils/				@kata-containers/utils
-
-# FIXME: Maybe a new "protocol" team would be better?
-#
-# All protocol changes must be reviewed.
-# Note, we include all subdirs, including the vendor dir, as at present there are no .proto files
-# in the vendor dir. Later we may have to extend this matching rule if that changes.
-/src/libs/protocols/*.proto	@kata-containers/architecture-committee @kata-containers/builder @kata-containers/packaging
-
-# GitHub Actions
-/.github/workflows/		@kata-containers/action-admins @kata-containers/ci
-
-/ci/				@kata-containers/ci @kata-containers/tests
-/docs/				@kata-containers/documentation
-
-/src/agent/			@kata-containers/agent
-
-/src/runtime*/			@kata-containers/runtime
-
-/src/runtime/			@kata-containers/golang
-
-src/runtime-rs/			@kata-containers/rust
-src/libs/			@kata-containers/rust
-
-src/dragonball/			@kata-containers/dragonball
-
-/tools/osbuilder/		@kata-containers/builder
-/tools/packaging/		@kata-containers/packaging
-/tools/packaging/kernel/	@kata-containers/kernel
-/tools/packaging/kata-deploy/	@kata-containers/kata-deploy
-/tools/packaging/qemu/		@kata-containers/qemu
-/tools/packaging/release/	@kata-containers/release
-
-**/vendor/			@kata-containers/vendoring
-
-# Handle arch specific files last so they match more specifically than
-# the kernel packaging files.
-**/*aarch64*			@kata-containers/arch-aarch64
-**/*arm64*			@kata-containers/arch-aarch64
-
-**/*amd64*			@kata-containers/arch-amd64
-**/*x86-64*			@kata-containers/arch-amd64
-**/*x86_64*			@kata-containers/arch-amd64
-
-**/*ppc64*			@kata-containers/arch-ppc64le
-
-**/*s390x*			@kata-containers/arch-s390x
+*.md    @kata-containers/documentation

Makefile

@@ -1,4 +1,4 @@
-# Copyright (c) 2020-2023 Intel Corporation
+# Copyright (c) 2020 Intel Corporation
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -23,10 +23,6 @@ TOOLS += trace-forwarder
 
 STANDARD_TARGETS = build check clean install static-checks-build test vendor
 
-# Variables for the build-and-publish-kata-debug target
-KATA_DEBUG_REGISTRY ?= ""
-KATA_DEBUG_TAG ?= ""
-
 default: all
 
 include utils.mk
@@ -42,14 +38,11 @@ generate-protocols:
 
 # Some static checks rely on generated source files of components.
 static-checks: static-checks-build
-	bash tests/static-checks.sh github.com/kata-containers/kata-containers
+	bash ci/static-checks.sh
 
 docs-url-alive-check:
 	bash ci/docs-url-alive-check.sh
 
-build-and-publish-kata-debug:
-	bash tools/packaging/kata-debug/kata-debug-build-and-upload-payload.sh ${KATA_DEBUG_REGISTRY} ${KATA_DEBUG_TAG} 
-
 .PHONY: \
 	all \
 	kata-tarball \

README.md

@@ -1,6 +1,4 @@
-<img src="https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/kata/SVG/kata-1.svg" width="900">
-
-[![CI | Publish Kata Containers payload](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml) [![Kata Containers Nightly CI](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml)
+<img src="https://www.openstack.org/assets/kata/kata-vertical-on-white.png" width="150">
 
 # Kata Containers
 
@@ -123,7 +121,7 @@ The table below lists the core parts of the project:
 | [agent](src/agent) | core | Management process running inside the virtual machine / POD that sets up the container environment. |
 | [`dragonball`](src/dragonball) | core | An optional built-in VMM brings out-of-the-box Kata Containers experience with optimizations on container workloads |
 | [documentation](docs) | documentation | Documentation common to all components (such as design and install documentation). |
-| [tests](tests) | tests | Excludes unit tests which live with the main code. |
+| [tests](https://github.com/kata-containers/tests) | tests | Excludes unit tests which live with the main code. |
 
 ### Additional components
 
@@ -134,28 +132,19 @@ The table below lists the remaining parts of the project:
 | [packaging](tools/packaging) | infrastructure | Scripts and metadata for producing packaged binaries<br/>(components, hypervisors, kernel and rootfs). |
 | [kernel](https://www.kernel.org) | kernel | Linux kernel used by the hypervisor to boot the guest image. Patches are stored [here](tools/packaging/kernel). |
 | [osbuilder](tools/osbuilder) | infrastructure | Tool to create "mini O/S" rootfs and initrd images and kernel for the hypervisor. |
-| [kata-debug](tools/packaging/kata-debug/README.md) | infrastructure | Utility tool to gather Kata Containers debug information from Kubernetes clusters. |
 | [`agent-ctl`](src/tools/agent-ctl) | utility | Tool that provides low-level access for testing the agent. |
 | [`kata-ctl`](src/tools/kata-ctl) | utility | Tool that provides advanced commands and debug facilities. |
 | [`trace-forwarder`](src/tools/trace-forwarder) | utility | Agent tracing helper. |
 | [`runk`](src/tools/runk) | utility | Standard OCI container runtime based on the agent. |
-| [`ci`](.github/workflows) | CI | Continuous Integration configuration files and scripts. |
-| [`ocp-ci`](ci/openshift-ci/README.md) | CI | Continuous Integration configuration for the OpenShift pipelines. |
+| [`ci`](https://github.com/kata-containers/ci) | CI | Continuous Integration configuration files and scripts. |
 | [`katacontainers.io`](https://github.com/kata-containers/www.katacontainers.io) | Source for the [`katacontainers.io`](https://www.katacontainers.io) site. |
-| [`Webhook`](tools/testing/kata-webhook/README.md) | utility | Example of a simple admission controller webhook to annotate pods with the Kata runtime class |
 
 ### Packaging and releases
 
 Kata Containers is now
 [available natively for most distributions](docs/install/README.md#packaged-installation-methods).
-
-## General tests
-
-See the [tests documentation](tests/README.md).
-
-## Metrics tests
-
-See the [metrics documentation](tests/metrics/README.md).
+However, packaging scripts and metadata are still used to generate [snap](snap/local) and GitHub releases. See
+the [components](#components) section for further details.
 
 ## Glossary of Terms
 

VERSION

@@ -1 +1 @@
-3.17.0
+3.1.0

ci/README.md

@@ -1,416 +0,0 @@
-# Kata Containers CI
-
-> [!WARNING]
-> While this project's CI has several areas for improvement, it is constantly
-> evolving. This document attempts to describe its current state, but due to
-> ongoing changes, you may notice some outdated information here. Feel free to
-> modify/improve this document as you use the CI and notice anything odd. The
-> community appreciates it!
-
-## Introduction
-
-The Kata Containers CI relies on [GitHub Actions][gh-actions], where the actions
-themselves can be found in the `.github/workflows` directory, and they may call
-helper scripts, which are located under the `tests` directory, to actually
-perform the tasks required for each test case.
-
-## The different workflows
-
-There are a few different sets of workflows that are running as part of our CI,
-and here we're going to cover the ones that are less likely to get rotten.  With
-this said, it's fair to advise that if the reader finds something that got
-rotten, opening an issue to the project pointing to the problem is a nice way to
-help, and providing a fix for the issue is a very encouraging way to help.
-
-### Jobs that run automatically when a PR is raised
-
-These are a bunch of tests that will automatically run as soon as a PR is
-opened, they're mostly running on "cost free" runners, and they do some
-pre-checks to evaluate that your PR may be okay to start getting reviewed.
-
-Mind, though, that the community expects the contributors to, at least, build
-their code before submitting a PR, which the community sees as a very fair
-request.
-
-Without getting into the weeds with details on this, those jobs are the ones
-responsible for ensuring that:
-
-- The commit message is in the expected format
-- There's no missing Developer's Certificate of Origin
-- Static checks are passing
-
-### Jobs that require a maintainer's approval to run
-
-There are some tests, and our so-called "CI".  These require a
-maintainer's approval to run as parts of those jobs will be running on "paid
-runners", which are currently using Azure infrastructure.
-
-Once a maintainer of the project gives "the green light" (currently by adding an
-`ok-to-test` label to the PR, soon to be changed to commenting "/test" as part
-of a PR review), the following tests will be executed:
-
-- Build all the components (runs on free cost runners, or bare-metal depending on the architecture)
-- Create a tarball with all the components (runs on free cost runners, or bare-metal depending on the architecture)
-- Create a kata-deploy payload with the tarball generated in the previous step (runs on free costs runner, or bare-metal depending on the architecture)
-- Run the following tests:
-  - Tests depending on the generated tarball
-    - Metrics (runs on bare-metal)
-    - `docker` (runs on cost free runners)
-    - `nerdctl` (runs on cost free runners)
-    - `kata-monitor` (runs on cost free runners)
-    - `cri-containerd` (runs on cost free runners)
-    - `nydus` (runs on cost free runners)
-    - `vfio` (runs on cost free runners)
-  - Tests depending on the generated kata-deploy payload
-    - kata-deploy (runs on cost free runners)
-      - Tests are performed using different "Kubernetes flavors", such as k0s, k3s, rke2, and Azure Kubernetes Service (AKS).
-    - Kubernetes (runs in Azure small and medium instances depending on what's required by each test, and on TEE bare-metal machines)
-      - Tests are performed with different runtime engines, such as CRI-O and containerd.
-      - Tests are performed with different snapshotters for containerd, namely OverlayFS and devmapper.
-      - Tests are performed with all the supported hypervisors, which are Cloud Hypervisor, Dragonball, Firecracker, and QEMU.
-
-For all the tests relying on Azure instances, real money is being spent, so the
-community asks for the maintainers to be mindful about those, and avoid abusing
-them to merely debug issues.
-
-## The different runners
-
-In the previous section we've mentioned using different runners, now in this section we'll go through each type of runner used.
-
-- Cost free runners:  Those are the runners provided by GitHub itself, and
-  those are fairly small machines with virtualization capabilities enabled.
-- Azure small instances: Those are runners which have virtualization
-  capabilities enabled, 2 CPUs, and 8GB of RAM.  These runners have a "-smaller"
-  suffix to their name.
-- Azure normal instances: Those are runners which have virtualization
-  capabilities enabled, 4 CPUs, and 16GB of RAM.  These runners are usually
-  `garm` ones with no "-smaller" suffix.
-- Bare-metal runners: Those are runners provided by community contributors,
-  and they may vary in architecture, size and virtualization capabilities.
-  Builder runners don't actually require any virtualization capabilities, while
-  runners which will be actually performing the tests must have virtualization
-  capabilities and a reasonable amount for CPU and RAM available (at least
-  matching the Azure normal instances).
-
-## Adding new tests
-
-Before someone decides to add a new test, we strongly recommend them to go
-through [GitHub Actions Documentation][gh-actions],
-which will provide you a very sensible background on how to read and understand
-current tests we have, and also become familiar with how to write a new test.
-
-On the Kata Containers land, there are basically two sets of tests: "standalone"
-and "part of something bigger".
-
-The "standalone" tests, for example the commit message check, won't be covered
-here as they're better covered by the GitHub Actions documentation pasted above.
-
-The "part of something bigger" is the more complicated one and not so
-straightforward to add, so we'll be focusing our efforts on describing the
-addition of those.
-
-> [!NOTE]
-> TODO: Currently, this document refers to "tests" when it actually means the
-> jobs (or workflows) of GitHub. In an ideal world, except in some specific cases,
-> new tests should be added without the need to add new workflows. In the
-> not-too-distant future (hopefully), we will improve the workflows to support
-> this.
-
-### Adding a new test that's "part of something bigger"
-
-The first important thing here is to align expectations, and we must say that
-the community strongly prefers receiving tests that already come with:
-
-- Instructions how to run them
-- A proven run where it's passing
-
-There are several ways to achieve those two requirements, and an example of that
-can be seen in PR #8115.
-
-With the expectations aligned, adding a test consists in:
-
-- Adding a new yaml file for your test, and ensure it's called from the
-  "bigger" yaml. See the [Kata Monitor test example][monitor-ex01].
-
-- Adding the helper scripts needed for your test to run. Again, use the [Kata Monitor script as example][monitor-ex02].
-
-Following those examples, the community advice during the review, and even
-asking the community directly on Slack are the best ways to get your test
-accepted.
-
-## Required tests
-
-In our CI we have two categories of jobs - required and non-required:
-- Required jobs need to all pass for a PR to be merged normally and
-should cover all the core features on Kata Containers that we want to
-ensure don't have regressions.
-- The non-required jobs are for unstable tests, or for features that
-are experimental and not-fully supported. We'd like those tests to also
-pass on all PRs ideally, but don't block merging if they don't as it's
-not necessarily an indication of the PR code causing regressions.
-
-### Transitioning between required and non-required status
-
-Required jobs that fail block merging of PRs, so we want to ensure that
-jobs are stable and maintained before we make them required.
-
-The [Kata Containers CI Dashboard](https://kata-containers.github.io/)
-is a useful resource to check when collecting evidence of job stability.
-At time of writing it reports the last ten days of Kata CI nightly test
-results for each job. This isn't perfect as it doesn't currently capture
-results on PRs, but is a good guideline for stability.
-
-> [!NOTE]
-> Below are general guidelines about jobs being marked as
-> required/non-required, but they are subject to change and the Kata
-> Architecture Committee may overrule these guidelines at their
-> discretion.
-
-#### Initial marking as required
-
-For new jobs, or jobs that haven't been marked as required recently,
-the criteria to be initially marked as required is ten days
-of passing tests, with no relevant PR failures reported in that time.
-Required jobs also need one or more nominated maintainers that are
-responsible for the stability of their jobs. Maintainers can be registered
-in [`maintainers.yml`](https://github.com/kata-containers/kata-containers.github.io/blob/main/maintainers.yml)
-and will then show on the CI Dashboard.
-
-To add transparency to making jobs required/non-required and to keep the
-GitHub UI in sync with the [Gatekeeper job](../tools/testing/gatekeeper),
-the process to update a job's required state is as follows:
-1. Create a PR to update `maintainers.yml`, if new maintainers are being
-declared on a CI job.
-1. Create a PR which updates
-[`required-tests.yaml`](../tools/testing/gatekeeper/required-tests.yaml)
-adding the new job and listing the evidence that the job meets the
-requirements above. Ensure that all maintainers and
-@kata-containers/architecture-committee are notified to give them the
-opportunity to review the PR. See
-[#11015](https://github.com/kata-containers/kata-containers/pull/11015)
-as an example.
-1. The maintainers and Architecture Committee get a chance to review the PR.
-It can be discussed in an AC meeting to get broader input.
-1. Once the PR has been merged, a Kata Containers admin should be notified
-to ensure that the GitHub UI is updated to reflect the change in
-`required-tests.yaml`.
-
-#### Expectation of required job maintainers
-
-Due to the nature of the Kata Containers community having contributors
-spread around the world, required jobs being blocked due to infrastructure,
-or test issues can have a big impact on work. As such, the expectation is
-that when a problem with a required job is noticed/reported, the maintainers
-have one working day to acknowledge the issue, perform an initial
-investigation and then either fix it, or get it marked as non-required
-whilst the investigation and/or fix it done.
-
-### Re-marking of required status
-
-Once a job has been removed from the required list, it requires two
-consecutive successful nightly test runs before being made required
-again.
-
-## Running tests
-
-### Running the tests as part of the CI
-
-If you're a maintainer of the project, you'll be able to kick in the tests by
-yourself.  With the current approach, you just need to add the `ok-to-test`
-label and the tests will automatically start.  We're moving, though, to use a
-`/test` command as part of a GitHub review comment, which will simplify this
-process.
-
-If you're not a maintainer, please, send a message on Slack or wait till one of
-the maintainers reviews your PR.  Maintainers will then kick in the tests on
-your behalf.
-
-In case a test fails and there's the suspicion it happens due to flakiness in
-the test itself, please, create an issue for us, and then re-run (or asks
-maintainers to re-run) the tests following these steps:
-
-- Locate which tests is failing
-- Click in "details"
-- In the top right corner, click in "Re-run jobs"
-- And then in "Re-run failed jobs"
-- And finally click in the green "Re-run jobs" button
-
-> [!NOTE]
-> TODO: We need figures here
-
-### Running the tests locally
-
-In this section, aligning expectations is also something very important, as one
-will not be able to run the tests exactly in the same way the tests are running
-in the CI, as one most likely won't have access to an Azure subscription.
-However, we're trying our best here to provide you with instructions on how to
-run the tests in an environment that's "close enough" and will help you to debug
-issues you find with the current tests, or even provide a proof-of-concept to
-the new test you're trying to add.
-
-The basic steps, which we will cover in details down below are:
-
- 1. Create a VM matching the configuration of the target runner
- 2. Generate the artifacts you'll need for the test, or download them from a
-    current failed run
- 3. Follow the steps provided in the action itself to run the tests.
-
-Although the general overview looks easy, we know that some tricks need to be
-shared, and we'll go through the general process of debugging one non-Kubernetes
-and one Kubernetes specific test for educational purposes.
-
-One important thing to note is that "Create a VM" can be done in innumerable
-different ways, using the tools of your choice.  For the sake of simplicity on
-this guide, we'll be using `kcli`, which we strongly recommend in case you're a
-non-experienced user, and happen to be developing on a Linux box.
-
-For both non-Kubernetes and Kubernetes cases, we'll be using PR #8070 as an
-example, which at the time this document is being written serves us very well
-the purpose, as you can see that we have `nerdctl` and Kubernetes tests failing.
-
-## Debugging tests
-
-### Debugging a non Kubernetes test
-
-As shown above, the `nerdctl` test is failing.
-
-As a developer you can go ahead to the details of the job, and expand the job
-that's failing in order to gather more information.
-
-But when that doesn't help, we need to set up our own environment to debug
-what's going on.
-
-Taking a look at the `nerdctl` test, which is located here, you can easily see
-that it runs-on a `garm-ubuntu-2304-smaller` virtual machine.
-
-The important parts to understand are `ubuntu-2304`, which is the OS where the
-test is running on; and "smaller", which means we're running it on a machine
-with 2 CPUs and 8GB of RAM.
-
-With this information, we can go ahead and create a similar VM locally using `kcli`.
-
-```bash
-$ sudo kcli create vm -i ubuntu2304 -P disks=[60] -P numcpus=2 -P memory=8192 -P cpumodel=host-passthrough debug-nerdctl-pr8070
-```
-
-In order to run the tests, you'll need the "kata-tarball" artifacts, which you
-can build your own using "make kata-tarball" (see below), or simply get them
-from the PR where the tests failed.  To download them, click on the "Summary"
-button that's on the top left corner, and then scroll down till you see the
-artifacts, as shown below.
-
-Unfortunately GitHub doesn't give us a link that we can download those from
-inside the VM, but we can download them on our local box, and then `scp` the
-tarball to the newly created VM that will be used for debugging purposes.
-
-> [!NOTE]
-> Those artifacts are only available (for 15 days) when all jobs are finished.
-
-Once you have the `kata-static.tar.xz` in your VM, you can login to the VM with
-`kcli ssh debug-nerdctl-pr8070`, go ahead and then clone your development branch
-
-```bash
-$ git clone --branch feat_add-fc-runtime-rs https://github.com/nubificus/kata-containers
-```
-
-Add the upstream as a remote, set up your git, and rebase your branch atop of the upstream main one
-
-```bash
-$ git remote add upstream https://github.com/kata-containers/kata-containers
-$ git remote update
-$ git config --global user.email "you@example.com"
-$ git config --global user.name "Your Name"
-$ git rebase upstream/main
-```
-
-Now copy the `kata-static.tar.xz` into your `kata-containers/kata-artifacts` directory
-
-```bash
-$ mkdir kata-artifacts
-$ cp ../kata-static.tar.xz kata-artifacts/
-```
-
-> [!NOTE]
-> If you downloaded the .zip from GitHub you need to uncompress first to see `kata-static.tar.xz`
-
-And finally run the tests following what's in the yaml file for the test you're
-debugging.
-
-In our case, the `run-nerdctl-tests-on-garm.yaml`.
-
-When looking at the file you'll notice that some environment variables are set,
-such as `KATA_HYPERVISOR`, and should be aware that, for this particular example,
-the important steps to follow are:
-
-Install the dependencies
-Install kata
-Run the tests
-
-Let's now run the steps mentioned above exporting the expected environment variables
-
-```bash
-$ export KATA_HYPERVISOR=dragonball
-$ bash ./tests/integration/nerdctl/gha-run.sh install-dependencies
-$ bash ./tests/integration/nerdctl/gha-run.sh install-kata
-$ bash tests/integration/nerdctl/gha-run.sh run
-```
-
-And with this you should've been able to reproduce exactly the same issue found
-in the CI, and from now on you can build your own code, use your own binaries,
-and have fun debugging and hacking!
-
-### Debugging a Kubernetes test
-
-Steps for debugging the Kubernetes tests are very similar to the ones for
-debugging non-Kubernetes tests, with the caveat that what you'll need, this
-time, is not the `kata-static.tar.xz` tarball, but rather a payload to be used
-with kata-deploy.
-
-In order to generate your own kata-deploy image you can generate your own
-`kata-static.tar.xz` and then take advantage of the following script.  Be aware
-that the image generated and uploaded must be accessible by the VM where you'll
-be performing your tests.
-
-In case you want to take advantage of the payload that was already generated
-when you faced the CI failure, which is considerably easier, take a look at the
-failed job, then click in "Deploy Kata" and expand the "Final kata-deploy.yaml
-that is used in the test" section.  From there you can see exactly what you'll
-have to use when deploying kata-deploy in your local cluster.
-
-> [!NOTE]
-> TODO: WAINER TO FINISH THIS PART BASED ON HIS PR TO RUN A LOCAL CI
-
-## Adding new runners
-
-Any admin of the project is able to add or remove GitHub runners, and those are
-the folks you should rely on.
-
-If you need a new runner added, please, tag @ac in the Kata Containers slack,
-and someone from that group will be able to help you.
-
-If you're part of that group and you're looking for information on how to help
-someone, this is simple, and must be done in private. Basically what you have to
-do is:
-
-- Go to the kata-containers/kata-containers repo
-- Click on the Settings button, located in the top right corner
-- On the left panel, under "Code and automation", click on "Actions"
-- Click on "Runners"
-
-If you want to add a new self-hosted runner:
-
-- In the top right corner there's a green button called "New self-hosted runner"
-
-If you want to remove a current self-hosted runner:
-
-- For each runner there's a "..." menu, where you can just click and the
-  "Remove runner" option will show up
-
-## Known limitations
-
-As the GitHub actions are structured right now we cannot: Test the addition of a
-GitHub action that's not triggered by a pull_request event as part of the PR.
-
-[gh-actions]: https://docs.github.com/en/actions
-[monitor-ex01]: https://github.com/kata-containers/kata-containers/commit/a3fb067f1bccde0cbd3fd4d5de12dfb3d8c28b60
-[monitor-ex02]: https://github.com/kata-containers/kata-containers/commit/489caf1ad0fae27cfd00ba3c9ed40e3d512fa492

ci/darwin-test.sh

@@ -7,16 +7,16 @@
 set -e
 
 cidir=$(dirname "$0")
-runtimedir=${cidir}/../src/runtime
+runtimedir=$cidir/../src/runtime
 
 build_working_packages() {
 	# working packages:
-	device_api=${runtimedir}/pkg/device/api
-	device_config=${runtimedir}/pkg/device/config
-	device_drivers=${runtimedir}/pkg/device/drivers
-	device_manager=${runtimedir}/pkg/device/manager
-	rc_pkg_dir=${runtimedir}/pkg/resourcecontrol/
-	utils_pkg_dir=${runtimedir}/virtcontainers/utils
+	device_api=$runtimedir/pkg/device/api
+	device_config=$runtimedir/pkg/device/config
+	device_drivers=$runtimedir/pkg/device/drivers
+	device_manager=$runtimedir/pkg/device/manager
+	rc_pkg_dir=$runtimedir/pkg/resourcecontrol/
+	utils_pkg_dir=$runtimedir/virtcontainers/utils
 
 	# broken packages :( :
 	#katautils=$runtimedir/pkg/katautils
@@ -24,15 +24,15 @@ build_working_packages() {
 	#vc=$runtimedir/virtcontainers
 
 	pkgs=(
-		"${device_api}"
-		"${device_config}"
-		"${device_drivers}"
-		"${device_manager}"
-		"${utils_pkg_dir}"
-		"${rc_pkg_dir}")
+		"$device_api"
+		"$device_config"
+		"$device_drivers"
+		"$device_manager"
+		"$utils_pkg_dir"
+		"$rc_pkg_dir")
 	for pkg in "${pkgs[@]}"; do
-		echo building "${pkg}"
-		pushd "${pkg}" &>/dev/null
+		echo building "$pkg"
+		pushd "$pkg" &>/dev/null
 		go build
 		go test
 		popd &>/dev/null

ci/docs-url-alive-check.sh

@@ -7,6 +7,6 @@
 set -e
 
 cidir=$(dirname "$0")
-source "${cidir}/../tests/common.bash"
+source "${cidir}/lib.sh"
 
 run_docs_url_alive_check

ci/gh-util.sh

@@ -1,184 +0,0 @@
-#!/bin/bash
-
-# Copyright (c) 2020 Intel Corporation
-# Copyright (c) 2024 IBM Corporation
-#
-# SPDX-License-Identifier: Apache-2.0
-
-set -o errexit
-set -o errtrace
-set -o nounset
-set -o pipefail
-
-[[ -n "${DEBUG:-}" ]] && set -o xtrace
-
-script_name=${0##*/}
-
-#---------------------------------------------------------------------
-
-die()
-{
-    echo >&2 "$*"
-    exit 1
-}
-
-usage()
-{
-    cat <<EOF
-Usage: ${script_name} [OPTIONS] [command] [arguments]
-
-Description: Utility to expand the abilities of the GitHub CLI tool, gh.
-
-Command descriptions:
-
-  list-issues-for-pr     List issues linked to a PR.
-  list-labels-for-issue  List labels, in json format for an issue
-
-Commands and arguments:
-
-  list-issues-for-pr <pr>
-  list-labels-for-issue <issue>
-
-Options:
-
- -h                 Show this help statement.
- -r <owner/repo>    Optional <org/repo> specification. Default: 'kata-containers/kata-containers'
-
-Examples:
-
-- List issues for a Pull Request 123 in kata-containers/kata-containers repo
-
-  $ ${script_name} list-issues-for-pr 123
-EOF
-}
-
-list_issues_for_pr()
-{
-    local pr="${1:-}"
-    local repo="${2:-kata-containers/kata-containers}"
-
-    [[ -z "${pr}" ]] && die "need PR"
-
-    local commits
-	commits=$(gh pr view "${pr}" --repo "${repo}" --json commits --jq .commits[].messageBody)
-
-    [[ -z "${commits}" ]] && die "cannot determine commits for PR ${pr}"
-
-    # Extract the issue number(s) from the commits.
-    #
-    # This needs to be careful to take account of lines like this:
-    #
-    # fixes 99
-    # fixes: 77
-    # fixes #123.
-    # Fixes: #1, #234, #5678.
-    #
-    # Note the exclusion of lines starting with whitespace which is
-    # specifically to ignore vendored git log comments, which are whitespace
-    # indented and in the format:
-    #
-    #     "<git-commit> <git-commit-msg>"
-    #
-    local issues
-	issues=$(echo "${commits}" |\
-        grep -v -E "^( |	)" |\
-        grep -i -E "fixes:* *(#*[0-9][0-9]*)" |\
-        tr ' ' '\n' |\
-        grep "[0-9][0-9]*" |\
-        sed 's/[.,\#]//g' |\
-        sort -nu || true)
-
-    [[ -z "${issues}" ]] && die "cannot determine issues for PR ${pr}"
-
-    echo "# Issues linked to PR"
-    echo "#"
-    echo "# Fields: issue_number"
-
-    local issue
-    echo "${issues}" | while read -r issue
-    do
-        printf "%s\n" "${issue}"
-    done
-}
-
-list_labels_for_issue()
-{
-    local issue="${1:-}"
-
-    [[ -z "${issue}" ]] && die "need issue number"
-
-    local labels
-	labels=$(gh issue view "${issue}" --repo kata-containers/kata-containers --json labels)
-
-    [[ -z "${labels}" ]] && die "cannot determine labels for issue ${issue}"
-
-    echo "${labels}"
-}
-
-setup()
-{
-    for cmd in gh jq
-    do
-        command -v "${cmd}" &>/dev/null || die "need command: ${cmd}"
-    done
-}
-
-handle_args()
-{
-    setup
-
-    local opt
-
-    while getopts "hr:" opt "$@"
-    do
-        case "${opt}" in
-            h) usage && exit 0 ;;
-            r) repo="${OPTARG}" ;;
-			*) echo "use '-h' to get list of supprted aruments" && exit 1 ;;
-        esac
-    done
-
-    shift $((OPTIND - 1))
-
-    local repo="${repo:-kata-containers/kata-containers}"
-    local cmd="${1:-}"
-
-    case "${cmd}" in
-        list-issues-for-pr) ;;
-        list-labels-for-issue) ;;
-
-        "") usage && exit 0 ;;
-        *) die "invalid command: '${cmd}'" ;;
-    esac
-
-    # Consume the command name
-    shift
-
-    local issue=""
-    local pr=""
-
-    case "${cmd}" in
-        list-issues-for-pr)
-            pr="${1:-}"
-
-            list_issues_for_pr "${pr}" "${repo}"
-            ;;
-
-        list-labels-for-issue)
-            issue="${1:-}"
-
-            list_labels_for_issue "${issue}"
-            ;;
-
-        *) die "impossible situation: cmd: '${cmd}'" ;;
-    esac
-
-    exit 0
-}
-
-main()
-{
-    handle_args "$@"
-}
-
-main "$@"

ci/install_go.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+cidir=$(dirname "$0")
+source "${cidir}/lib.sh"
+
+clone_tests_repo
+
+new_goroot=/usr/local/go
+
+pushd "${tests_repo_dir}"
+# Force overwrite the current version of golang
+[ -z "${GOROOT}" ] || rm -rf "${GOROOT}"
+.ci/install_go.sh -p -f -d "$(dirname ${new_goroot})"
+[ -z "${GOROOT}" ] || sudo ln -sf "${new_goroot}" "${GOROOT}"
+go version
+popd

ci/install_libseccomp.sh

@@ -7,9 +7,12 @@
 
 set -o errexit
 
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cidir=$(dirname "$0")
+source "${cidir}/lib.sh"
 
-source "${script_dir}/../tests/common.bash"
+clone_tests_repo
+
+source "${tests_repo_dir}/.ci/lib.sh"
 
 # The following variables if set on the environment will change the behavior
 # of gperf and libseccomp configure scripts, that may lead this script to
@@ -21,12 +24,12 @@ workdir="$(mktemp -d --tmpdir build-libseccomp.XXXXX)"
 
 # Variables for libseccomp
 libseccomp_version="${LIBSECCOMP_VERSION:-""}"
-if [[ -z "${libseccomp_version}" ]]; then
-	libseccomp_version=$(get_from_kata_deps ".externals.libseccomp.version")
+if [ -z "${libseccomp_version}" ]; then
+    libseccomp_version=$(get_version "externals.libseccomp.version")
 fi
 libseccomp_url="${LIBSECCOMP_URL:-""}"
-if [[ -z "${libseccomp_url}" ]]; then
-	libseccomp_url=$(get_from_kata_deps ".externals.libseccomp.url")
+if [ -z "${libseccomp_url}" ]; then
+    libseccomp_url=$(get_version "externals.libseccomp.url")
 fi
 libseccomp_tarball="libseccomp-${libseccomp_version}.tar.gz"
 libseccomp_tarball_url="${libseccomp_url}/releases/download/v${libseccomp_version}/${libseccomp_tarball}"
@@ -34,79 +37,76 @@ cflags="-O2"
 
 # Variables for gperf
 gperf_version="${GPERF_VERSION:-""}"
-if [[ -z "${gperf_version}" ]]; then
-	gperf_version=$(get_from_kata_deps ".externals.gperf.version")
+if [ -z "${gperf_version}" ]; then
+    gperf_version=$(get_version "externals.gperf.version")
 fi
 gperf_url="${GPERF_URL:-""}"
-if [[ -z "${gperf_url}" ]]; then
-	gperf_url=$(get_from_kata_deps ".externals.gperf.url")
+if [ -z "${gperf_url}" ]; then
+    gperf_url=$(get_version "externals.gperf.url")
 fi
 gperf_tarball="gperf-${gperf_version}.tar.gz"
 gperf_tarball_url="${gperf_url}/${gperf_tarball}"
 
-# We need to build the libseccomp library from sources to create a static
-# library for the musl libc.
-# However, ppc64le, riscv64 and s390x have no musl targets in Rust. Hence, we do
-# not set cflags for the musl libc.
-if [[ "${arch}" != "ppc64le" ]] && [[ "${arch}" != "riscv64" ]] && [[ "${arch}" != "s390x" ]]; then
-	# Set FORTIFY_SOURCE=1 because the musl-libc does not have some functions about FORTIFY_SOURCE=2
-	cflags="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1 -O2"
+# We need to build the libseccomp library from sources to create a static library for the musl libc.
+# However, ppc64le and s390x have no musl targets in Rust. Hence, we do not set cflags for the musl libc.
+if ([ "${arch}" != "ppc64le" ] && [ "${arch}" != "s390x" ]); then
+    # Set FORTIFY_SOURCE=1 because the musl-libc does not have some functions about FORTIFY_SOURCE=2
+    cflags="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1 -O2"
 fi
 
 die() {
-	msg="$*"
-	echo "[Error] ${msg}" >&2
-	exit 1
+    msg="$*"
+    echo "[Error] ${msg}" >&2
+    exit 1
 }
 
 finish() {
-	rm -rf "${workdir}"
+    rm -rf "${workdir}"
 }
 
 trap finish EXIT
 
 build_and_install_gperf() {
-	echo "Build and install gperf version ${gperf_version}"
-	mkdir -p "${gperf_install_dir}"
-	curl -sLO "${gperf_tarball_url}"
-	tar -xf "${gperf_tarball}"
-	pushd "gperf-${gperf_version}"
-	# Unset $CC for configure, we will always use native for gperf
-	CC="" ./configure --prefix="${gperf_install_dir}"
-	make
-	make install
-	export PATH=${PATH}:"${gperf_install_dir}"/bin
-	popd
-	echo "Gperf installed successfully"
+    echo "Build and install gperf version ${gperf_version}"
+    mkdir -p "${gperf_install_dir}"
+    curl -sLO "${gperf_tarball_url}"
+    tar -xf "${gperf_tarball}"
+    pushd "gperf-${gperf_version}"
+    # Unset $CC for configure, we will always use native for gperf
+    CC= ./configure --prefix="${gperf_install_dir}"
+    make
+    make install
+    export PATH=$PATH:"${gperf_install_dir}"/bin
+    popd
+    echo "Gperf installed successfully"
 }
 
 build_and_install_libseccomp() {
-	echo "Build and install libseccomp version ${libseccomp_version}"
-	mkdir -p "${libseccomp_install_dir}"
-	curl -sLO "${libseccomp_tarball_url}"
-	tar -xf "${libseccomp_tarball}"
-	pushd "libseccomp-${libseccomp_version}"
-	[[ "${arch}" == $(uname -m) ]] && cc_name="" || cc_name="${arch}-linux-gnu-gcc"
-	CC=${cc_name} ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static --host="${arch}"
-	make
-	make install
-	popd
-	echo "Libseccomp installed successfully"
+    echo "Build and install libseccomp version ${libseccomp_version}"
+    mkdir -p "${libseccomp_install_dir}"
+    curl -sLO "${libseccomp_tarball_url}"
+    tar -xf "${libseccomp_tarball}"
+    pushd "libseccomp-${libseccomp_version}"
+    ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static --host="${arch}"
+    make
+    make install
+    popd
+    echo "Libseccomp installed successfully"
 }
 
 main() {
-	local libseccomp_install_dir="${1:-}"
-	local gperf_install_dir="${2:-}"
+    local libseccomp_install_dir="${1:-}"
+    local gperf_install_dir="${2:-}"
 
-	if [[ -z "${libseccomp_install_dir}" ]] || [[ -z "${gperf_install_dir}" ]]; then
-		die "Usage: ${0} <libseccomp-install-dir> <gperf-install-dir>"
-	fi
+    if [ -z "${libseccomp_install_dir}" ] || [ -z "${gperf_install_dir}" ]; then
+        die "Usage: ${0} <libseccomp-install-dir> <gperf-install-dir>"
+    fi
 
-	pushd "${workdir}"
-	# gperf is required for building the libseccomp.
-	build_and_install_gperf
-	build_and_install_libseccomp
-	popd
+    pushd "$workdir"
+    # gperf is required for building the libseccomp.
+    build_and_install_gperf
+    build_and_install_libseccomp
+    popd
 }
 
 main "$@"

ci/install_rust.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Copyright (c) 2019 Ant Financial
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+set -e
+
+cidir=$(dirname "$0")
+source "${cidir}/lib.sh"
+
+clone_tests_repo
+
+pushd ${tests_repo_dir}
+.ci/install_rust.sh ${1:-}
+popd

ci/install_vc.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2018 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+cidir=$(dirname "$0")
+vcdir="${cidir}/../src/runtime/virtcontainers/"
+source "${cidir}/lib.sh"
+export CI_JOB="${CI_JOB:-default}"
+
+clone_tests_repo
+
+if [ "${CI_JOB}" != "PODMAN" ]; then
+	echo "Install virtcontainers"
+	make -C "${vcdir}" && chronic sudo make -C "${vcdir}" install
+fi

ci/install_yq.sh

@@ -5,57 +5,28 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 
-[[ -n "${DEBUG}" ]] && set -o xtrace
-
 # If we fail for any reason a message will be displayed
 die() {
 	msg="$*"
-	echo "ERROR: ${msg}" >&2
+	echo "ERROR: $msg" >&2
 	exit 1
 }
 
-function verify_yq_exists() {
-	local yq_path=$1
-	local yq_version=$2
-	local expected="yq (https://github.com/mikefarah/yq/) version ${yq_version}"
-	if [[ -x  "${yq_path}" ]] && [[ "$(${yq_path} --version)"X == "${expected}"X ]]; then
-		return 0
-	else
-		return 1
-	fi
-}
-
 # Install the yq yaml query package from the mikefarah github repo
 # Install via binary download, as we may not have golang installed at this point
 function install_yq() {
 	local yq_pkg="github.com/mikefarah/yq"
-	local yq_version=v4.44.5
-	local precmd=""
-	local yq_path=""
+	local yq_version=3.4.1
 	INSTALL_IN_GOPATH=${INSTALL_IN_GOPATH:-true}
 
-	if [[ "${INSTALL_IN_GOPATH}" == "true" ]]; then
+	if [ "${INSTALL_IN_GOPATH}"  == "true" ];then
 		GOPATH=${GOPATH:-${HOME}/go}
 		mkdir -p "${GOPATH}/bin"
-		yq_path="${GOPATH}/bin/yq"
+		local yq_path="${GOPATH}/bin/yq"
 	else
 		yq_path="/usr/local/bin/yq"
 	fi
-	if verify_yq_exists "${yq_path}" "${yq_version}"; then
-		echo "yq is already installed in correct version"
-		return
-	fi
-	if [[ "${yq_path}" == "/usr/local/bin/yq" ]]; then
-		# Check if we need sudo to install yq
-		if [[ ! -w "/usr/local/bin" ]]; then
-			# Check if we have sudo privileges
-			if ! sudo -n true 2>/dev/null; then
-				die "Please provide sudo privileges to install yq"
-			else
-				precmd="sudo"
-			fi
-		fi
-	fi
+	[ -x  "${yq_path}" ] && [ "`${yq_path} --version`"X == "yq version ${yq_version}"X ] && return
 
 	read -r -a sysInfo <<< "$(uname -sm)"
 
@@ -76,15 +47,12 @@ function install_yq() {
 		# If we're on an apple silicon machine, just assign amd64. 
 		# The version of yq we use doesn't have a darwin arm build, 
 		# but Rosetta can come to the rescue here.
-		if [[ ${goos} == "Darwin" ]]; then
+		if [ $goos == "Darwin" ]; then 
 			goarch=amd64
 		else 
 			goarch=arm64
 		fi
 		;;
-	"riscv64")
-		goarch=riscv64
-		;;
 	"ppc64le")
 		goarch=ppc64le
 		;;
@@ -107,8 +75,9 @@ function install_yq() {
 
 	## NOTE: ${var,,} => gives lowercase value of var
 	local yq_url="https://${yq_pkg}/releases/download/${yq_version}/yq_${goos}_${goarch}"
-	${precmd} curl -o "${yq_path}" -LSsf "${yq_url}" || die "Download ${yq_url} failed"
-	${precmd} chmod +x "${yq_path}"
+	curl -o "${yq_path}" -LSsf "${yq_url}"
+	[ $? -ne 0 ] && die "Download ${yq_url} failed"
+	chmod +x "${yq_path}"
 
 	if ! command -v "${yq_path}" >/dev/null; then
 		die "Cannot not get ${yq_path} executable"

ci/lib.sh

@@ -0,0 +1,66 @@
+#
+# Copyright (c) 2018 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -o nounset
+
+export tests_repo="${tests_repo:-github.com/kata-containers/tests}"
+export tests_repo_dir="$GOPATH/src/$tests_repo"
+export branch="${target_branch:-main}"
+
+# Clones the tests repository and checkout to the branch pointed out by
+# the global $branch variable.
+# If the clone exists and `CI` is exported then it does nothing. Otherwise
+# it will clone the repository or `git pull` the latest code.
+#
+clone_tests_repo()
+{
+	if [ -d "$tests_repo_dir" ]; then
+		[ -n "${CI:-}" ] && return
+		# git config --global --add safe.directory will always append
+		# the target to .gitconfig without checking the existence of
+		# the target, so it's better to check it before adding the target repo.
+		local sd="$(git config --global --get safe.directory ${tests_repo_dir} || true)"
+		if [ -z "${sd}" ]; then
+			git config --global --add safe.directory ${tests_repo_dir}
+		fi
+		pushd "${tests_repo_dir}"
+		git checkout "${branch}"
+		git pull
+		popd
+	else
+		git clone -q "https://${tests_repo}" "$tests_repo_dir"
+		pushd "${tests_repo_dir}"
+		git checkout "${branch}"
+		popd
+	fi
+}
+
+run_static_checks()
+{
+	clone_tests_repo
+	# Make sure we have the targeting branch
+	git remote set-branches --add origin "${branch}"
+	git fetch -a
+	bash "$tests_repo_dir/.ci/static-checks.sh" "$@"
+}
+
+run_docs_url_alive_check()
+{
+	clone_tests_repo
+	# Make sure we have the targeting branch
+	git remote set-branches --add origin "${branch}"
+	git fetch -a
+	bash "$tests_repo_dir/.ci/static-checks.sh" --docs --all "github.com/kata-containers/kata-containers"
+}
+
+run_get_pr_changed_file_details()
+{
+	clone_tests_repo
+	# Make sure we have the targeting branch
+	git remote set-branches --add origin "${branch}"
+	git fetch -a
+	source "$tests_repo_dir/.ci/lib.sh"
+	get_pr_changed_file_details
+}

ci/openshift-ci/README.md

@@ -1,157 +0,0 @@
-OpenShift CI
-============
-
-This directory contains scripts used by
-[the OpenShift CI](https://github.com/openshift/release/tree/master/ci-operator/config/kata-containers/kata-containers)
-pipelines to monitor selected functional tests on OpenShift.
-There are 2 pipelines, history and logs can be accessed here:
-
-* [main - currently supported OCP](https://prow.ci.openshift.org/job-history/gs/origin-ci-test/logs/periodic-ci-kata-containers-kata-containers-main-e2e-tests)
-* [next - currently under development OCP](https://prow.ci.openshift.org/job-history/gs/origin-ci-test/logs/periodic-ci-kata-containers-kata-containers-main-next-e2e-tests)
-
-
-Running openshift-tests on OCP with kata-containers manually
-============================================================
-
-To run openshift-tests (or other suites) with kata-containers one can use
-the kata-webhook. To deploy everything you can mimic the CI pipeline by:
-
-```bash
-#!/bin/bash -e
-# Setup your kubectl and check it's accessible by
-kubectl nodes
-# Deploy kata (set KATA_DEPLOY_IMAGE to override the default kata-deploy-ci:latest image)
-./test.sh
-# Deploy the webhook
-KATA_RUNTIME=kata-qemu cluster/deploy_webhook.sh
-```
-
-This should ensure kata-containers as well as kata-webhook are installed and
-working. Before running the openshift-tests it's (currently) recommended to
-ignore some security features by:
-
-```bash
-#!/bin/bash -e
-oc adm policy add-scc-to-group privileged system:authenticated system:serviceaccounts
-oc adm policy add-scc-to-group anyuid system:authenticated system:serviceaccounts
-oc label --overwrite ns default pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-```
-
-Now you should be ready to run the openshift-tests. Our CI only uses a subset
-of tests, to get the current ``TEST_SKIPS`` see
-[the pipeline config](https://github.com/openshift/release/tree/master/ci-operator/config/kata-containers/kata-containers).
-Following steps require the [openshift tests](https://github.com/openshift/origin)
-being cloned and built in the current directory:
-
-```bash
-#!/bin/bash -e
-# Define tests to be skipped (see the pipeline config for the current version)
-TEST_SKIPS="\[sig-node\] Security Context should support seccomp runtime/default\|\[sig-node\] Variable Expansion should allow substituting values in a volume subpath\|\[k8s.io\] Probing container should be restarted with a docker exec liveness probe with timeout\|\[sig-node\] Pods Extended Pod Container lifecycle evicted pods should be terminal\|\[sig-node\] PodOSRejection \[NodeConformance\] Kubelet should reject pod when the node OS doesn't match pod's OS\|\[sig-network\].*for evicted pods\|\[sig-network\].*HAProxy router should override the route\|\[sig-network\].*HAProxy router should serve a route\|\[sig-network\].*HAProxy router should serve the correct\|\[sig-network\].*HAProxy router should run\|\[sig-network\].*when FIPS.*the HAProxy router\|\[sig-network\].*bond\|\[sig-network\].*all sysctl on whitelist\|\[sig-network\].*sysctls should not affect\|\[sig-network\] pods should successfully create sandboxes by adding pod to network"
-# Get the list of tests to be executed
-TESTS="$(./openshift-tests run --dry-run --provider "${TEST_PROVIDER}" "${TEST_SUITE}")"
-# Store the list of tests in /tmp/tsts file
-echo "${TESTS}" | grep -v "$TEST_SKIPS" > /tmp/tsts
-# Remove previously-existing temporarily files as well as previous results
-OUT=RESULTS/tmp
-rm -Rf /tmp/*test* /tmp/e2e-*
-rm -R $OUT
-mkdir -p $OUT
-# Run the tests ignoring the monitor health checks
-./openshift-tests run --provider azure -o "$OUT/job.log" --junit-dir "$OUT" --file /tmp/tsts --max-parallel-tests 5 --cluster-stability Disruptive --run '^\[sig-node\].*|^\[sig-network\]'
-```
-
-[!NOTE]
-Note we are ignoring the cluster stability checks because our public cloud is
-not that stable and running with VMs instead of containers results in minor
-stability issues. Some of the old monitor stability tests do not reflect
-the ``--cluster-stability`` setting, one should simply ignore these. If you
-get a message like ``invariant was violated`` or ``error: failed due to a
-MonitorTest failure``, it's usually an indication that only those kind of
-tests failed but the real tests passed. See
-[wrapped-openshift-tests.sh](https://github.com/openshift/release/blob/master/ci-operator/config/kata-containers/kata-containers/wrapped-openshift-tests.sh)
-for details how our pipeline deals with that.
-
-[!TIP]
-To compare multiple results locally one can use
-[junit2html](https://github.com/inorton/junit2html) tool.
-
-
-Best-effort kata-containers cleanup
-===================================
-
-If you need to cleanup the cluster after testing, you can use the
-``cleanup.sh`` script from the current directory. It tries to delete all
-resources created by ``test.sh`` as well as ``cluster/deploy_webhook.sh``
-ignoring all failures. The primary purpose of this script is to allow
-soft-cleanup after deployment to test different versions without
-re-provisioning everything.
-
-[!WARNING]
-Do not rely on this script in production, return codes are not checked!**
-
-
-Bisecting e2e tests failures
-============================
-
-Let's say the OCP pipeline passed running with
-``quay.io/kata-containers/kata-deploy-ci:kata-containers-d7afd31fd40e37a675b25c53618904ab57e74ccd-amd64``
-but failed running with
-``quay.io/kata-containers/kata-deploy-ci:kata-containers-9f512c016e75599a4a921bd84ea47559fe610057-amd64``
-and you'd like to know which PR caused the regression. You can either run with
-all the 60 tags between or you can utilize the [bisecter](https://github.com/ldoktor/bisecter)
-to optimize the number of steps in between.
-
-Before running the bisection you need a reproducer script. Sample one called
-``sample-test-reproducer.sh`` is provided in this directory but you might
-want to copy and modify it, especially:
-
-* ``OCP_DIR`` - directory where your openshift/release is located (can be exported)
-* ``E2E_TEST`` - openshift-test(s) to be executed (can be exported)
-* behaviour of SETUP (returning 125 skips the current image tag, returning
-  >=128 interrupts the execution, everything else reports the tag as failure
-* what should be executed (perhaps running the setup is enough for you or
-  you might want to be looking for specific failures...)
-* use ``timeout`` to interrupt execution in case you know things should be faster
-
-Executing that script with the GOOD commit should pass
-``./sample-test-reproducer.sh quay.io/kata-containers/kata-deploy-ci:kata-containers-d7afd31fd40e37a675b25c53618904ab57e74ccd-amd64``
-and fail when executed with the BAD commit
-``./sample-test-reproducer.sh quay.io/kata-containers/kata-deploy-ci:kata-containers-9f512c016e75599a4a921bd84ea47559fe610057-amd64``.
-
-To get the list of all tags in between those two PRs you can use the
-``bisect-range.sh`` script
-
-```bash
-./bisect-range.sh d7afd31fd40e37a675b25c53618904ab57e74ccd 9f512c016e75599a4a921bd84ea47559fe610057
-```
-
-[!NOTE]
-The tagged images are only built per PR, not for individual commits. See
-[kata-deploy-ci](https://quay.io/kata-containers/kata-deploy-ci) to see the
-available images.
-
-To find out which PR caused this regression, you can either manually try the
-individual commits or you can simply execute:
-
-```bash
-bisecter start "$(./bisect-range.sh d7afd31fd40 9f512c016)"
-OCP_DIR=/path/to/openshift/release bisecter run ./sample-test-reproducer.sh
-```
-
-[!NOTE]
-If you use ``KATA_WITH_SYSTEM_QEMU=yes`` you might want to deploy once with
-it and skip it for the cleanup. That way you might (in most cases) test
-all images with a single MCP update instead of per-image MCP update.
-
-[!TIP]
-You can check the bisection progress during/after execution by running
-``bisecter log`` from the current directory. Before starting a new
-bisection you need to execute ``bisecter reset``.
-
-
-Peer pods
-=========
-
-It's possible to run similar testing on peer-pods using cloud-api-adaptor.
-Our CI configuration to run inside azure's OCP is in ``peer-pods-azure.sh``
-and can be used to replace the `test.sh` step in snippets above.

ci/openshift-ci/bisect-range.sh

@@ -1,30 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2024 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-if [[ "$#" -gt 2 ]] || [[ "$#" -lt 1 ]] ; then
-	echo "Usage: $0 GOOD [BAD]"
-	echo "Prints list of available kata-deploy-ci tags between GOOD and BAD commits (by default BAD is the latest available tag)"
-	exit 255
-fi
-GOOD="$1"
-[[ -n "$2" ]] && BAD="$2"
-ARCH=amd64
-REPO="quay.io/kata-containers/kata-deploy-ci"
-
-TAGS=$(skopeo list-tags "docker://${REPO}")
-# For testing
-#echo "$TAGS" > tags
-#TAGS=$(cat tags)
-# Only amd64
-TAGS=$(echo "${TAGS}" | jq '.Tags' | jq "map(select(endswith(\"${ARCH}\")))" | jq -r '.[]')
-# Sort by git
-SORTED=""
-[[ -n "${BAD}" ]] && LOG_ARGS="${GOOD}~1..${BAD}" || LOG_ARGS="${GOOD}~1.."
-for TAG in $(git log --merges --pretty=format:%H --reverse "${LOG_ARGS}"); do
-	[[ "${TAGS}" =~ ${TAG} ]] && SORTED+="
-kata-containers-${TAG}-${ARCH}"
-done
-# Comma separated tags with repo
-echo "${SORTED}" | tail -n +2 | sed -e "s@^@${REPO}:@" | paste -s -d, -

ci/openshift-ci/cleanup.sh

@@ -1,61 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2024 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script tries to removes most of the resources added by `test.sh` script
-# from the cluster.
-
-scripts_dir=$(dirname "$0")
-deployments_dir=${scripts_dir}/cluster/deployments
-
-# shellcheck disable=SC1091 # import based on variable
-source "${scripts_dir}/lib.sh"
-
-# Set your katacontainers repo dir location
-[[ -z "${katacontainers_repo_dir}" ]] && echo "Please set katacontainers_repo_dir variable to your kata repo"
-
-# Set to 'yes' if you want to configure SELinux to permissive on the cluster
-# workers.
-#
-SELINUX_PERMISSIVE=${SELINUX_PERMISSIVE:-no}
-
-# Enable workaround for OCP 4.13 https://github.com/kata-containers/kata-containers/pull/9206
-#
-WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
-
-# Ignore errors as we want best-effort-approach here
-trap - ERR
-
-# Delete webhook resources
-oc delete -f "${scripts_dir}/../../tools/testing/kata-webhook/deploy"
-oc delete -f "${scripts_dir}/cluster/deployments/configmap_kata-webhook.yaml.in"
-
-# Delete potential smoke-test resources
-oc delete -f "${scripts_dir}/smoke/service.yaml"
-oc delete -f "${scripts_dir}/smoke/service_kubernetes.yaml"
-oc delete -f "${scripts_dir}/smoke/http-server.yaml"
-
-# Delete test.sh resources
-oc delete -f "${deployments_dir}/relabel_selinux.yaml"
-if [[ "${WORKAROUND_9206_CRIO}" == "yes" ]]; then
-	oc delete -f "${deployments_dir}/workaround-9206-crio-ds.yaml"
-	oc delete -f "${deployments_dir}/workaround-9206-crio.yaml"
-fi
-[[ ${SELINUX_PERMISSIVE} == "yes" ]] && oc delete -f "${deployments_dir}/machineconfig_selinux.yaml.in"
-
-# Delete kata-containers
-pushd "${katacontainers_repo_dir}/tools/packaging/kata-deploy" || { echo "Failed to push to ${katacontainers_repo_dir}/tools/packaging/kata-deploy"; exit 125; }
-oc delete -f kata-deploy/base/kata-deploy.yaml
-oc -n kube-system wait --timeout=10m --for=delete -l name=kata-deploy pod
-oc apply -f kata-cleanup/base/kata-cleanup.yaml
-echo "Wait for all related pods to be gone"
-( repeats=1; for _ in $(seq 1 600); do
-  oc get pods -l name="kubelet-kata-cleanup" --no-headers=true -n kube-system 2>&1 | grep "No resources found" -q && ((repeats++)) || repeats=1
-  [[ "${repeats}" -gt 5 ]] && echo kata-cleanup finished && break
-  sleep 1
-done) || { echo "There are still some kata-cleanup related pods after 600 iterations"; oc get all -n kube-system; exit 1; }
-oc delete -f kata-cleanup/base/kata-cleanup.yaml
-oc delete -f kata-rbac/base/kata-rbac.yaml
-oc delete -f runtimeclasses/kata-runtimeClasses.yaml

ci/openshift-ci/cluster/configs/selinux.conf

@@ -1,6 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-SELINUX=permissive
-SELINUXTYPE=targeted

ci/openshift-ci/cluster/deploy_webhook.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script builds the kata-webhook and deploys it in the test cluster.
-#
-# You should export the KATA_RUNTIME variable with the runtimeclass name
-# configured in your cluster in case it is not the default "kata-ci".
-#
-set -e
-set -o nounset
-set -o pipefail
-
-script_dir="$(realpath "$(dirname "$0")")"
-webhook_dir="${script_dir}/../../../tools/testing/kata-webhook"
-# shellcheck disable=SC1091 # import based on variable
-source "${script_dir}/../lib.sh"
-KATA_RUNTIME=${KATA_RUNTIME:-kata-ci}
-
-pushd "${webhook_dir}" >/dev/null
-# Build and deploy the webhook
-#
-info "Builds the kata-webhook"
-./create-certs.sh
-info "Override our KATA_RUNTIME ConfigMap"
-sed -i deploy/webhook.yaml -e "s/runtime_class: .*$/runtime_class: ${KATA_RUNTIME}/g"
-info "Deploys the kata-webhook"
-oc apply -f deploy/
-
-# Check the webhook was deployed and is working.
-RUNTIME_CLASS="${KATA_RUNTIME}" ./webhook-check.sh
-popd >/dev/null

ci/openshift-ci/cluster/deployments/configmap_installer_kernel.yaml

@@ -1,13 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Instruct the daemonset installer to configure Kata Containers to use the
-# host kernel.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ci.kata.installer.kernel
-data:
-  host_kernel: "yes"

ci/openshift-ci/cluster/deployments/configmap_installer_qemu.yaml

@@ -1,14 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Instruct the daemonset installer to configure Kata Containers to use the
-# system QEMU.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ci.kata.installer.qemu
-data:
-  qemu_path: /usr/libexec/qemu-kvm
-  host_kernel: "yes"

ci/openshift-ci/cluster/deployments/machineconfig_sandboxedcontainers_extension.yaml

@@ -1,9 +0,0 @@
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 50-enable-sandboxed-containers-extension
-spec:
-  extensions:
-  - sandboxed-containers

ci/openshift-ci/cluster/deployments/machineconfig_selinux.yaml.in

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Configure SELinux on worker nodes.
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 51-kata-selinux
-spec:
-  config:
-    ignition:
-      version: 2.2.0
-    storage:
-      files:
-      - contents:
-              source: data:text/plain;charset=utf-8;base64,${SELINUX_CONF_BASE64}
-        filesystem: root
-        mode: 0644
-        path: /etc/selinux/config

ci/openshift-ci/cluster/deployments/relabel_selinux.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: relabel-selinux-daemonset
-  namespace: kube-system
-spec:
-  selector:
-    matchLabels:
-      app: restorecon
-  template:
-    metadata:
-      labels:
-        app: restorecon
-    spec:
-      serviceAccountName: kata-deploy-sa
-      hostPID: true
-      containers:
-        - name: relabel-selinux-container
-          image: alpine
-          securityContext:
-            privileged: true
-          command: ["/bin/sh", "-c", "
-            set -e;
-            echo Starting the relabel;
-            nsenter --target 1 --mount bash -xc '
-                command -v semanage &>/dev/null || { echo Does not look like a SELINUX cluster, skipping; exit 0; };
-                for ENTRY in \
-                    \"/(.*/)?opt/kata/bin(/.*)?\" \
-                    \"/(.*/)?opt/kata/runtime-rs/bin(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/kata-.*(/.*)?(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/ovmf(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/tdvf(/.*)?\" \
-                    \"/(.*/)?opt/kata/libexec(/.*)?\";
-                do
-                    semanage fcontext -a -t qemu_exec_t \"$ENTRY\" || semanage fcontext -m -t qemu_exec_t \"$ENTRY\" || { echo \"Error in semanage command\"; exit 1; }
-                done;
-                restorecon -v -R /opt/kata || { echo \"Error in restorecon command\"; exit 1; }
-            ';
-            echo NSENTER_FINISHED_WITH: $?;
-            sleep infinity"]

ci/openshift-ci/cluster/deployments/workaround-9206-crio-ds.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: workaround-9206-crio-ds
-spec:
-  selector:
-    matchLabels:
-      app: workaround-9206-crio-ds
-  template:
-    metadata:
-      labels:
-        app: workaround-9206-crio-ds
-    spec:
-      containers:
-      - name: workaround-9206-crio-ds
-        image: alpine
-        volumeMounts:
-        - name: host-dir
-          mountPath: /tmp/config
-        securityContext:
-          runAsUser: 0
-          privileged: true
-        command: ["/bin/sh", "-c", "while [ ! -f '/tmp/config/10-workaround-9206-crio' ]; do sleep 1; done; echo 'Config file present'; sleep infinity"]
-      volumes:
-      - name: host-dir
-        hostPath:
-          path: /etc/crio/crio.conf.d/

ci/openshift-ci/cluster/deployments/workaround-9206-crio.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 10-workaround-9206-crio
-spec:
-  config:
-    ignition:
-      version: 2.2.0
-    storage:
-      files:
-      - contents:
-              source: data:text/plain;charset=utf-8;base64,W2NyaW9dCnN0b3JhZ2Vfb3B0aW9uID0gWwoJIm92ZXJsYXkuc2tpcF9tb3VudF9ob21lPXRydWUiLApdCg==
-        filesystem: root
-        mode: 0644
-        path: /etc/crio/crio.conf.d/10-workaround-9206-crio

ci/openshift-ci/cluster/install_kata.sh

@@ -1,251 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script installs the built kata-containers in the test cluster,
-# and configure a runtime.
-
-scripts_dir=$(dirname "$0")
-deployments_dir=${scripts_dir}/deployments
-configs_dir=${scripts_dir}/configs
-
-# shellcheck disable=SC1091 # import based on variable
-source "${scripts_dir}/../lib.sh"
-
-# Set your katacontainers repo dir location
-[[ -z "${katacontainers_repo_dir}" ]] && echo "Please set katacontainers_repo_dir variable to your kata repo"
-
-# Set to 'yes' if you want to configure SELinux to permissive on the cluster
-# workers.
-#
-SELINUX_PERMISSIVE=${SELINUX_PERMISSIVE:-no}
-
-# Set to 'yes' if you want to configure Kata Containers to use the system's
-# QEMU (from the RHCOS extension).
-#
-KATA_WITH_SYSTEM_QEMU=${KATA_WITH_SYSTEM_QEMU:-no}
-
-# Set to 'yes' if you want to configure Kata Containers to use the host kernel.
-#
-KATA_WITH_HOST_KERNEL=${KATA_WITH_HOST_KERNEL:-no}
-
-# kata-deploy image to be used to deploy the kata (by default use CI image
-# that is built for each pull request)
-#
-KATA_DEPLOY_IMAGE=${KATA_DEPLOY_IMAGE:-quay.io/kata-containers/kata-deploy-ci:kata-containers-latest}
-
-# Enable workaround for OCP 4.13 https://github.com/kata-containers/kata-containers/pull/9206
-#
-WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
-
-# Leverage kata-deploy to install Kata Containers in the cluster.
-#
-apply_kata_deploy() {
-	local deploy_file="tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml"
-	pushd "${katacontainers_repo_dir}" || die
-	sed -ri "s#(\s+image:) .*#\1 ${KATA_DEPLOY_IMAGE}#" "${deploy_file}"
-
-	info "Applying kata-deploy"
-	oc apply -f tools/packaging/kata-deploy/kata-rbac/base/kata-rbac.yaml
-	oc label --overwrite ns kube-system pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-	oc apply -f "${deploy_file}"
-	oc -n kube-system wait --timeout=10m --for=condition=Ready -l name=kata-deploy pod
-
-	info "Adding the kata runtime classes"
-	oc apply -f tools/packaging/kata-deploy/runtimeclasses/kata-runtimeClasses.yaml
-	popd || die
-}
-
-
-# Wait all worker nodes reboot.
-#
-# Params:
-#   $1 - timeout in seconds (default to 900).
-#
-wait_for_reboot() {
-	local delta="${1:-900}"
-	local sleep_time=60
-	declare -A BOOTIDS
-	local workers
-	mapfile -t workers < <(oc get nodes | awk '{if ($3 == "worker") { print $1 } }')
-	# Get the boot ID to compared it changed over time.
-	for node in "${workers[@]}"; do
-		BOOTIDS[${node}]=$(oc get -o jsonpath='{.status.nodeInfo.bootID}'\
-			"node/${node}")
-		echo "Wait ${node} reboot"
-	done
-
-	echo "Set timeout to ${delta} seconds"
-	timer_start=$(date +%s)
-	while [[ ${#workers[@]} -gt 0 ]]; do
-		sleep "${sleep_time}"
-		now=$(date +%s)
-		if [[ $((timer_start + delta)) -lt ${now} ]]; then
-			echo "Timeout: not all workers rebooted"
-			return 1
-		fi
-		echo "Checking after $((now - timer_start)) seconds"
-		for i in "${!workers[@]}"; do
-			current_id=$(oc get \
-				-o jsonpath='{.status.nodeInfo.bootID}' \
-				"node/${workers[i]}")
-			if [[ "${current_id}" != "${BOOTIDS[${workers[i]}]}" ]]; then
-				echo "${workers[i]} rebooted"
-				unset "workers[i]"
-			fi
-		done
-	done
-}
-
-wait_mcp_update() {
-	local delta="${1:-3600}"
-	local sleep_time=30
-	# The machineconfigpool is fine when all the workers updated and are ready,
-	# and none are degraded.
-	local ready_count=0
-	local degraded_count=0
-	local machine_count
-	machine_count=$(oc get mcp worker -o jsonpath='{.status.machineCount}')
-
-	if [[ -z "${machine_count}" && "${machine_count}" -lt 1 ]]; then
-		warn "Unabled to obtain the machine count"
-		return 1
-	fi
-
-	echo "Set timeout to ${delta} seconds"
-	local deadline=$(($(date +%s) + delta))
-	local now
-	# The ready count might not have changed yet, so wait a little.
-	while [[ "${ready_count}" != "${machine_count}" && \
-		"${degraded_count}" == 0 ]]; do
-		# Let's check it hit the timeout (or not).
-		now=$(date +%s)
-		if [[ ${deadline} -lt ${now} ]]; then
-			echo "Timeout: not all workers updated" >&2
-			return 1
-		fi
-		sleep "${sleep_time}"
-		ready_count=$(oc get mcp worker \
-			-o jsonpath='{.status.readyMachineCount}')
-		degraded_count=$(oc get mcp worker \
-			-o jsonpath='{.status.degradedMachineCount}')
-		echo "check machineconfigpool - ready_count: ${ready_count} degraded_count: ${degraded_count}"
-	done
-	[[ ${degraded_count} -eq 0 ]]
-}
-
-# Enable the RHCOS extension for the Sandboxed Containers.
-#
-enable_sandboxedcontainers_extension() {
-	info "Enabling the RHCOS extension for Sandboxed Containers"
-	local deployment_file="${deployments_dir}/machineconfig_sandboxedcontainers_extension.yaml"
-	oc apply -f "${deployment_file}"
-	oc get -f "${deployment_file}" || \
-		die "Sandboxed Containers extension machineconfig not found"
-	wait_mcp_update 3600 || die "Failed to update the machineconfigpool"
-}
-
-# Print useful information for debugging.
-#
-# Params:
-#   $1 - the pod name
-debug_pod() {
-	local pod="$1"
-	info "Debug pod: ${pod}"
-	oc describe pods "${pod}"
-        oc logs "${pod}"
-}
-
-# Wait for all pods of the app label to contain expected message
-#
-# Params:
-#   $1 - app labela
-#   $2 - expected pods count (>=1)
-#   $3 - message to be present in the logs
-#   $4 - timeout (60)
-#   $5 - namespace (the current one)
-wait_for_app_pods_message() {
-	local app="$1"
-	local pod_count="$2"
-	local message="$3"
-	local timeout="$4"
-	local namespace="$5"
-	[[ -z "${pod_count}" ]] && pod_count=1
-	[[ -z "${timeout}" ]] && timeout=60
-	[[ -n "${namespace}" ]] && namespace=" -n ${namespace} "
-	local pod
-	local pods
-	local i
-	SECONDS=0
-	while :; do
-		mapfile -t pods < <(oc get pods -l app="${app}" --no-headers=true "${namespace}" | awk '{print $1}')
-		[[ "${#pods}" -ge "${pod_count}" ]] && break
-		if [[ "${SECONDS}" -gt "${timeout}" ]]; then
-			printf "Unable to find ${pod_count} pods for '-l app=\"${app}\"' in ${SECONDS}s (%s)" "${pods[@]}"
-			return 1
-		fi
-	done
-	local log
-	for pod in "${pods[@]}"; do
-		while :; do
-			log=$(oc logs "${namespace}" "${pod}")
-			echo "${log}" | grep "${message}" -q && echo "Found $(echo "${log}" | grep "${message}") in ${pod}'s log (${SECONDS})" && break;
-			if [[ "${SECONDS}" -gt "${timeout}" ]]; then
-				echo -n "Message '${message}' not present in '${pod}' pod of the '-l app=\"${app}\"' "
-				printf "pods after ${SECONDS}s :(%s)\n" "${pods[@]}"
-				echo "Pod ${pod}'s output so far:"
-				echo "${log}"
-				return 1
-			fi
-			sleep 1;
-		done
-	done
-}
-
-oc config set-context --current --namespace=default
-
-worker_nodes=$(oc get nodes |  awk '{if ($3 == "worker") { print $1 } }')
-num_nodes=$(echo "${worker_nodes}" | wc -w)
-[[ ${num_nodes} -ne 0 ]] || \
-	die "No worker nodes detected. Something is wrong with the cluster"
-
-if [[ "${KATA_WITH_SYSTEM_QEMU}" == "yes" ]]; then
-	# QEMU is deployed on the workers via RCHOS extension.
-	enable_sandboxedcontainers_extension
-	oc apply -f "${deployments_dir}/configmap_installer_qemu.yaml"
-fi
-
-if [[ "${KATA_WITH_HOST_KERNEL}" == "yes" ]]; then
-	oc apply -f "${deployments_dir}/configmap_installer_kernel.yaml"
-fi
-
-apply_kata_deploy
-
-# Set SELinux to permissive mode
-if [[ ${SELINUX_PERMISSIVE} == "yes" ]]; then
-	info "Configuring SELinux"
-	if [[ -z "${SELINUX_CONF_BASE64}" ]]; then
-		SELINUX_CONF_BASE64=$(base64 -w0 < "${configs_dir}/selinux.conf")
-		export SELINUX_CONF_BASE64
-	fi
-	envsubst < "${deployments_dir}"/machineconfig_selinux.yaml.in | \
-		oc apply -f -
-	oc get machineconfig/51-kata-selinux || \
-		die "SELinux machineconfig not found"
-	# The new SELinux configuration will trigger another reboot.
-	wait_for_reboot 900
-fi
-
-if [[ "${WORKAROUND_9206_CRIO}" == "yes" ]]; then
-	info "Applying workaround to enable skip_mount_home in crio on OCP 4.13"
-	oc apply -f "${deployments_dir}/workaround-9206-crio.yaml"
-	oc apply -f "${deployments_dir}/workaround-9206-crio-ds.yaml"
-	wait_for_app_pods_message workaround-9206-crio-ds "${num_nodes}" "Config file present" 1200 || echo "Failed to apply the workaround, proceeding anyway..."
-fi
-
-# FIXME: Remove when https://github.com/kata-containers/kata-containers/pull/8417 is resolved
-# Selinux context is currently not handled by kata-deploy
-oc apply -f "${deployments_dir}/relabel_selinux.yaml"
-wait_for_app_pods_message restorecon "${num_nodes}" "NSENTER_FINISHED_WITH:" 120 "kube-system" || echo "Failed to treat selinux, proceeding anyway..."

ci/openshift-ci/images/Dockerfile.buildroot

@@ -4,7 +4,7 @@
 #
 # This is the build root image for Kata Containers on OpenShift CI.
 #
-FROM quay.io/centos/centos:stream9
+FROM quay.io/centos/centos:stream8
 
 RUN yum -y update && \
     yum -y install \

ci/openshift-ci/lib.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright (c) 2023 Red Hat
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-# Ensure GOPATH set
-if command -v go > /dev/null; then
-    export GOPATH=${GOPATH:-$(go env GOPATH)}
-else
-    # if go isn't installed, set default location for GOPATH
-    export GOPATH="${GOPATH:-${HOME}/go}"
-fi
-
-lib_dir=$(dirname "${BASH_SOURCE[0]}")
-# shellcheck disable=SC1091 # import based on variable
-source "${lib_dir}/../../tests/common.bash"
-
-export katacontainers_repo=${katacontainers_repo:="github.com/kata-containers/kata-containers"}
-export katacontainers_repo_dir="${GOPATH}/src/${katacontainers_repo}"

ci/openshift-ci/peer-pods-azure.sh

@@ -1,217 +0,0 @@
-#!/bin/bash -e
-# Setup peer-pods using cloud-api-adaptor on azure
-#
-# WARNING: When running outside "eastus" region this script creates a new
-#          resource group in "eastus" region and peers the network. You
-#          have to remove these manually (or use temporary accounts)
-
-###############################
-# Disable security to allow e2e
-###############################
-
-# Disable security
-oc adm policy add-scc-to-group privileged system:authenticated system:serviceaccounts
-oc adm policy add-scc-to-group anyuid system:authenticated system:serviceaccounts
-oc label --overwrite ns default pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-
-
-####################################
-# Get basic credentials from cluster
-####################################
-
-oc -n kube-system get secret azure-credentials -o json > azure_credentials.json
-AZURE_CLIENT_ID="$(jq -r .data.azure_client_id azure_credentials.json|base64 -d)"
-AZURE_CLIENT_SECRET="$(jq -r .data.azure_client_secret azure_credentials.json|base64 -d)"
-AZURE_TENANT_ID="$(jq -r .data.azure_tenant_id azure_credentials.json|base64 -d)"
-AZURE_SUBSCRIPTION_ID="$(jq -r .data.azure_subscription_id azure_credentials.json|base64 -d)"
-rm -f azure_credentials.json
-AZURE_RESOURCE_GROUP=$(oc get infrastructure/cluster -o jsonpath='{.status.platformStatus.azure.resourceGroupName}')
-az login --service-principal -u "${AZURE_CLIENT_ID}" -p "${AZURE_CLIENT_SECRET}" --tenant "${AZURE_TENANT_ID}"
-
-AZURE_VNET_NAME=$(az network vnet list --resource-group "${AZURE_RESOURCE_GROUP}" --query "[].{Name:name}" --output tsv)
-AZURE_SUBNET_NAME=$(az network vnet subnet list --resource-group "${AZURE_RESOURCE_GROUP}" --vnet-name "${AZURE_VNET_NAME}" --query "[].{Id:name} | [? contains(Id, 'worker')]" --output tsv)
-AZURE_SUBNET_ID=$(az network vnet subnet list --resource-group "${AZURE_RESOURCE_GROUP}" --vnet-name "${AZURE_VNET_NAME}" --query "[].{Id:id} | [? contains(Id, 'worker')]" --output tsv)
-AZURE_REGION=$(az group show --resource-group "${AZURE_RESOURCE_GROUP}" --query "{Location:location}" --output tsv)
-
-# Create workload identity
-AZURE_WORKLOAD_IDENTITY_NAME="caa-${AZURE_CLIENT_ID}"
-az identity create   --name "${AZURE_WORKLOAD_IDENTITY_NAME}"   --resource-group "${AZURE_RESOURCE_GROUP}"   --location "${AZURE_REGION}"
-USER_ASSIGNED_CLIENT_ID="$(az identity show --resource-group "${AZURE_RESOURCE_GROUP}" --name "${AZURE_WORKLOAD_IDENTITY_NAME}" --query 'clientId' -otsv)"
-
-
-#############################
-# Ensure we can run in eastus
-#############################
-
-PP_REGION=eastus
-if [[ "${AZURE_REGION}" == "${PP_REGION}" ]]; then
-    echo "Using the current region ${AZURE_REGION}"
-    PP_RESOURCE_GROUP="${AZURE_RESOURCE_GROUP}"
-    PP_VNET_NAME="${AZURE_VNET_NAME}"
-    PP_SUBNET_NAME="${AZURE_SUBNET_NAME}"
-    PP_SUBNET_ID="${AZURE_SUBNET_ID}"
-else
-    echo "Creating peering between ${AZURE_REGION} and ${PP_REGION}"
-    PP_RESOURCE_GROUP="${AZURE_RESOURCE_GROUP}-eastus"
-    PP_VNET_NAME="${AZURE_VNET_NAME}-eastus"
-    PP_SUBNET_NAME="${AZURE_SUBNET_NAME}-eastus"
-    PP_NSG_NAME="${AZURE_VNET_NAME}-nsg-eastus"
-    az group create --name "${PP_RESOURCE_GROUP}" --location "${PP_REGION}"
-    az network vnet create --resource-group "${PP_RESOURCE_GROUP}" --name "${PP_VNET_NAME}" --location "${PP_REGION}" --address-prefixes 10.2.0.0/16 --subnet-name "${PP_SUBNET_NAME}" --subnet-prefixes 10.2.1.0/24
-    az network nsg create --resource-group "${PP_RESOURCE_GROUP}" --name "${PP_NSG_NAME}" --location "${PP_REGION}"
-    az network vnet subnet update --resource-group "${PP_RESOURCE_GROUP}" --vnet-name "${PP_VNET_NAME}" --name "${PP_SUBNET_NAME}" --network-security-group "${PP_NSG_NAME}"
-    AZURE_VNET_ID=$(az network vnet show --resource-group "${AZURE_RESOURCE_GROUP}" --name "${AZURE_VNET_NAME}" --query id --output tsv)
-    PP_VNET_ID=$(az network vnet show --resource-group "${PP_RESOURCE_GROUP}" --name "${PP_VNET_NAME}" --query id --output tsv)
-    az network vnet peering create --name westus-to-eastus --resource-group "${AZURE_RESOURCE_GROUP}" --vnet-name "${AZURE_VNET_NAME}" --remote-vnet "${PP_VNET_ID}" --allow-vnet-access
-    az network vnet peering create --name eastus-to-westus --resource-group "${PP_RESOURCE_GROUP}" --vnet-name "${PP_VNET_NAME}" --remote-vnet "${AZURE_VNET_ID}" --allow-vnet-access
-    PP_SUBNET_ID=$(az network vnet subnet list --resource-group "${PP_RESOURCE_GROUP}" --vnet-name "${PP_VNET_NAME}" --query "[].{Id:id} | [? contains(Id, 'worker')]" --output tsv)
-fi
-
-# Peer-pod requires gateway
-az network public-ip create \
-  --resource-group "${PP_RESOURCE_GROUP}" \
-  --name MyPublicIP \
-  --sku Standard \
-  --allocation-method Static
-az network nat gateway create \
-  --resource-group "${PP_RESOURCE_GROUP}" \
-  --name MyNatGateway \
-  --public-ip-addresses MyPublicIP \
-  --idle-timeout 10
-az network vnet subnet update \
-  --resource-group "${PP_RESOURCE_GROUP}" \
-  --vnet-name "${PP_VNET_NAME}" \
-  --name "${PP_SUBNET_NAME}" \
-  --nat-gateway MyNatGateway
-
-
-##########################################
-# Setup CAA
-#########################################
-
-# Label the nodes
-for NODE_NAME in $(kubectl get nodes -o jsonpath='{.items[*].metadata.name}'); do [[ "${NODE_NAME}" =~ 'worker' ]] && kubectl label node "${NODE_NAME}" node.kubernetes.io/worker=; done
-
-# CAA artifacts
-CAA_IMAGE="quay.io/confidential-containers/cloud-api-adaptor"
-TAGS="$(curl https://quay.io/api/v1/repository/confidential-containers/cloud-api-adaptor/tag/?onlyActiveTags=true)"
-DIGEST=$(echo "${TAGS}" | jq -r '.tags[] | select(.name | contains("latest-amd64")) | .manifest_digest')
-CAA_TAG="$(echo "${TAGS}" | jq -r '.tags[] | select(.manifest_digest | contains("'"${DIGEST}"'")) | .name' | grep -v "latest")"
-
-# Get latest PP image
-SUCCESS_TIME=$(curl -s \
-  -H "Accept: application/vnd.github+json" \
-  "https://api.github.com/repos/confidential-containers/cloud-api-adaptor/actions/workflows/azure-nightly-build.yml/runs?status=success" \
-  | jq -r '.workflow_runs[0].updated_at')
-PP_IMAGE_ID="/CommunityGalleries/cocopodvm-d0e4f35f-5530-4b9c-8596-112487cdea85/Images/podvm_image0/Versions/$(date -u -jf "%Y-%m-%dT%H:%M:%SZ" "${SUCCESS_TIME}" "+%Y.%m.%d" 2>/dev/null || date -d "${SUCCESS_TIME}" +%Y.%m.%d)"
-
-echo "AZURE_REGION: \"${AZURE_REGION}\""
-echo "PP_REGION: \"${PP_REGION}\""
-echo "AZURE_RESOURCE_GROUP: \"${AZURE_RESOURCE_GROUP}\""
-echo "PP_RESOURCE_GROUP: \"${PP_RESOURCE_GROUP}\""
-echo "PP_SUBNET_ID: \"${PP_SUBNET_ID}\""
-echo "CAA_TAG: \"${CAA_TAG}\""
-echo "PP_IMAGE_ID: \"${PP_IMAGE_ID}\""
-
-# Clone and configure caa
-git clone --depth 1 --no-checkout https://github.com/confidential-containers/cloud-api-adaptor.git
-pushd cloud-api-adaptor
-git sparse-checkout init --cone
-git sparse-checkout set src/cloud-api-adaptor/install/
-git checkout
-echo "CAA_GIT_SHA: \"$(git rev-parse HEAD)\""
-pushd src/cloud-api-adaptor
-cat <<EOF > install/overlays/azure/workload-identity.yaml
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: cloud-api-adaptor-daemonset
-  namespace: confidential-containers-system
-spec:
-  template:
-    metadata:
-      labels:
-        azure.workload.identity/use: "true"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cloud-api-adaptor
-  namespace: confidential-containers-system
-  annotations:
-    azure.workload.identity/client-id: "${USER_ASSIGNED_CLIENT_ID}"
-EOF
-PP_INSTANCE_SIZE="Standard_D2as_v5"
-DISABLECVM="true"
-cat <<EOF > install/overlays/azure/kustomization.yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-bases:
-- ../../yamls
-images:
-- name: cloud-api-adaptor
-  newName: "${CAA_IMAGE}"
-  newTag: "${CAA_TAG}"
-generatorOptions:
-  disableNameSuffixHash: true
-configMapGenerator:
-- name: peer-pods-cm
-  namespace: confidential-containers-system
-  literals:
-  - CLOUD_PROVIDER="azure"
-  - AZURE_SUBSCRIPTION_ID="${AZURE_SUBSCRIPTION_ID}"
-  - AZURE_REGION="${PP_REGION}"
-  - AZURE_INSTANCE_SIZE="${PP_INSTANCE_SIZE}"
-  - AZURE_RESOURCE_GROUP="${PP_RESOURCE_GROUP}"
-  - AZURE_SUBNET_ID="${PP_SUBNET_ID}"
-  - AZURE_IMAGE_ID="${PP_IMAGE_ID}"
-  - DISABLECVM="${DISABLECVM}"
-  - PEERPODS_LIMIT_PER_NODE="50"
-secretGenerator:
-- name: peer-pods-secret
-  namespace: confidential-containers-system
-  envs:
-  - service-principal.env
-- name: ssh-key-secret
-  namespace: confidential-containers-system
-  files:
-  - id_rsa.pub
-patchesStrategicMerge:
-- workload-identity.yaml
-EOF
-ssh-keygen -t rsa -f install/overlays/azure/id_rsa -N ''
-echo "AZURE_CLIENT_ID=${AZURE_CLIENT_ID}" > install/overlays/azure/service-principal.env
-echo "AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}" >> install/overlays/azure/service-principal.env
-echo "AZURE_TENANT_ID=${AZURE_TENANT_ID}" >> install/overlays/azure/service-principal.env
-
-# Deploy Operator
-git clone --depth 1 --no-checkout https://github.com/confidential-containers/operator
-pushd operator
-git sparse-checkout init --cone
-git sparse-checkout set "config/"
-git checkout
-echo "OPERATOR_SHA: \"$(git rev-parse HEAD)\""
-oc apply -k "config/release"
-oc apply -k "config/samples/ccruntime/peer-pods"
-popd
-
-# Deploy CAA
-kubectl apply -k "install/overlays/azure"
-popd
-popd
-
-# Wait for runtimeclass
-SECONDS=0
-( while [[ "${SECONDS}" -lt 360 ]]; do
-    kubectl get runtimeclass | grep -q kata-remote && exit 0
-done; exit 1 ) || { echo "kata-remote runtimeclass not initialized in 60s"; kubectl -n confidential-containers-system get all; echo; echo CAA; kubectl -n confidential-containers-system logs daemonset.apps/cloud-api-adaptor-daemonset; echo pre-install; kubectl -n confidential-containers-system logs daemonset.apps/cc-operator-pre-install-daemon; echo install; kubectl -n confidential-containers-system logs daemonset.apps/cc-operator-daemon-install; exit 1; }
-
-
-################
-# Deploy webhook
-################
-pushd ci/openshift-ci/cluster/
-kubectl create ns default || true
-kubectl config set-context --current --namespace=default
-KATA_RUNTIME=kata-remote ./deploy_webhook.sh
-popd

ci/openshift-ci/run_smoke_test.sh

@@ -1,95 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Run a smoke test.
-#
-
-script_dir=$(dirname "$0")
-# shellcheck disable=SC1091 # import based on variable
-source "${script_dir}/lib.sh"
-
-pod='http-server'
-
-# Create a pod.
-#
-info "Creating the ${pod} pod"
-[[ -z "${KATA_RUNTIME}" ]] && die "Please set the KATA_RUNTIME first"
-envsubst < "${script_dir}/smoke/${pod}.yaml.in" | \
-	oc apply -f - || \
-	die "failed to create ${pod} pod"
-
-# Check it eventually goes to 'running'
-#
-wait_time=600
-sleep_time=5
-cmd="oc get pod/${pod} -o jsonpath='{.status.containerStatuses[0].state}' | \
-	grep running > /dev/null"
-info "Wait until the pod gets running"
-waitForProcess "${wait_time}" "${sleep_time}" "${cmd}" || timed_out=$?
-if [[ -n "${timed_out}" ]]; then
-	oc describe "pod/${pod}"
-	oc delete "pod/${pod}"
-	die "${pod} not running"
-fi
-info "${pod} is running"
-
-# Add a file with the hello message
-#
-hello_file=/tmp/hello
-hello_msg='Hello World'
-oc exec "${pod}" -- sh -c "echo ${hello_msg} > ${hello_file}"
-
-info "Creating the service and route"
-if oc apply -f "${script_dir}/smoke/service.yaml"; then
-    # Likely on OCP, use service
-    is_ocp=1
-    host=$(oc get route/http-server-route -o jsonpath="{.spec.host}")
-    port=80
-else
-    # Likely on plain kubernetes, test using another container
-    is_ocp=0
-    info "Failed to create service, likely not on OCP, trying via NodePort"
-    oc apply -f "${script_dir}/smoke/service_kubernetes.yaml"
-    # For some reason kcli's cluster lists external IP as internal IP, try both
-    host=$(oc get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="ExternalIP")].address}')
-    [[ -z "${host}" ]] && host=$(oc get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
-    port=$(oc get service/http-server-service -o jsonpath='{.spec.ports[0].nodePort}')
-fi
-
-info "Wait for the HTTP server to respond"
-tempfile=$(mktemp)
-check_cmd="curl -vvv '${host}:${port}${hello_file}' 2>&1 | tee -a '${tempfile}' | grep -q '${hello_msg}'"
-if waitForProcess 60 1 "${check_cmd}"; then
-    test_status=0
-    info "HTTP server is working"
-else
-    test_status=1
-    echo "::error:: HTTP server not working"
-    echo "::group::Output of the \"curl -vvv '${host}:${port}${hello_file}'\""
-    cat "${tempfile}"
-    echo "::endgroup::"
-    echo "::group::Describe kube-system namespace"
-    oc describe -n kube-system all
-    echo "::endgroup::"
-    echo "::group::Descibe current namespace"
-    oc describe all
-    echo "::endgroup::"
-    info "HTTP server is unreachable"
-fi
-rm -f "${tempfile}"
-
-# Delete the resources.
-#
-info "Deleting the service/route"
-if [[ "${is_ocp}" -eq 0 ]]; then
-    oc delete -f "${script_dir}/smoke/service_kubernetes.yaml"
-else
-    oc delete -f "${script_dir}/smoke/service.yaml"
-fi
-info "Deleting the ${pod} pod"
-oc delete "pod/${pod}" || test_status=$?
-
-exit "${test_status}"

ci/openshift-ci/sample-test-reproducer.sh

@@ -1,50 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2024 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# A sample script to deploy, configure, run E2E_TEST and soft-cleanup
-# afterwards OCP cluster using kata-containers primarily created for use
-# with https://github.com/ldoktor/bisecter
-
-[[ "$#" -ne 1 ]] && echo "Provide image as the first and only argument" && exit 255
-export KATA_DEPLOY_IMAGE="$1"
-OCP_DIR="${OCP_DIR:-/path/to/your/openshift/release/}"
-E2E_TEST="${E2E_TEST:-'"[sig-node] Container Runtime blackbox test on terminated container should report termination message as empty when pod succeeds and TerminationMessagePolicy FallbackToLogsOnError is set [NodeConformance] [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]"'}"
-KATA_CI_DIR="${KATA_CI_DIR:-$(pwd)}"
-export KATA_RUNTIME="${KATA_RUNTIME:-kata-qemu}"
-
-## SETUP
-# Deploy kata
-SETUP=0
-pushd "${KATA_CI_DIR}" || { echo "Failed to cd to '${KATA_CI_DIR}'"; exit 255; }
-./test.sh || SETUP=125
-cluster/deploy_webhook.sh || SETUP=125
-if [[ ${SETUP} != 0 ]]; then
-    ./cleanup.sh
-    exit "${SETUP}"
-fi
-popd || true
-# Disable security
-oc adm policy add-scc-to-group privileged system:authenticated system:serviceaccounts
-oc adm policy add-scc-to-group anyuid system:authenticated system:serviceaccounts
-oc label --overwrite ns default pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-
-## TEST EXECUTION
-# Run the testing
-pushd "${OCP_DIR}" || { echo "Failed to cd to '${OCP_DIR}'"; exit 255; }
-echo "${E2E_TEST}" > /tmp/tsts
-# Remove previously-existing temporarily files as well as previous results
-OUT=RESULTS/tmp
-rm -Rf /tmp/*test* /tmp/e2e-*
-rm -R "${OUT}"
-mkdir -p "${OUT}"
-# Run the tests ignoring the monitor health checks
-./openshift-tests run --provider azure -o "${OUT}/job.log" --junit-dir "${OUT}" --file /tmp/tsts --max-parallel-tests 5 --cluster-stability Disruptive
-RET=$?
-popd || true
-
-## CLEANUP
-./cleanup.sh
-exit "${RET}"
-

ci/openshift-ci/smoke/http-server.yaml.in

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Define the pod for a http server app.
----
-apiVersion: v1
-kind: Pod
-metadata:
-  name: http-server
-  labels:
-    app: http-server-app
-spec:
-  containers:
-    - name: http-server
-      image: docker.io/library/python:3
-      ports:
-        - containerPort: 8080
-      command: ["python3"]
-      args: [ "-m", "http.server", "8080"]
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-            - ALL
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-  runtimeClassName: ${KATA_RUNTIME}