Merge pull request #2723 from fidencio/2.2.1-branch-bump

# Kata Containers 2.2.1

.github/cargo-deny-composite-action/cargo-deny-generator.sh

@@ -1,40 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2022 Red Hat
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-script_dir=$(dirname "$(readlink -f "$0")")
-parent_dir=$(realpath "${script_dir}/../..")
-cidir="${parent_dir}/ci"
-source "${cidir}/lib.sh"
-
-cargo_deny_file="${script_dir}/action.yaml"
-
-cat cargo-deny-skeleton.yaml.in > "${cargo_deny_file}"
-
-changed_files_status=$(run_get_pr_changed_file_details)
-changed_files_status=$(echo "$changed_files_status" | grep "Cargo\.toml$" || true)
-changed_files=$(echo "$changed_files_status" | awk '{print $NF}' || true)
-
-if [ -z "$changed_files" ]; then
-  cat >> "${cargo_deny_file}" << EOF
-    - run: echo "No Cargo.toml files to check"
-      shell: bash
-EOF
-fi
-
-for path in $changed_files
-do
-    cat >> "${cargo_deny_file}" << EOF
-
-    - name: ${path}
-      continue-on-error: true
-      shell: bash
-      run: |
-        pushd $(dirname ${path})
-        cargo deny check
-        popd
-EOF
-done

.github/cargo-deny-composite-action/cargo-deny-skeleton.yaml.in

@@ -1,30 +0,0 @@
-#
-# Copyright (c) 2022 Red Hat
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-name: 'Cargo Crates Check'
-description: 'Checks every Cargo.toml file using cargo-deny'
-
-env:
-  CARGO_TERM_COLOR: always
-
-runs:
-  using: "composite"
-  steps:
-    - name: Install Rust
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: nightly 
-        override: true
-
-    - name: Cache
-      uses: Swatinem/rust-cache@v2
-
-    - name: Install Cargo deny
-      shell: bash
-      run: |
-        which cargo
-        cargo install --locked cargo-deny || true

.github/workflows/PR-wip-checks.yaml

@@ -9,17 +9,12 @@ on:
       - labeled
       - unlabeled
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   pr_wip_check:
     runs-on: ubuntu-latest
     name: WIP Check
     steps:
     - name: WIP Check
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
       uses: tim-actions/wip-check@1c2a1ca6c110026b3e2297bb2ef39e1747b5a755
       with:
         labels: '["do-not-merge", "wip", "rfc"]'

.github/workflows/add-issues-to-project.yaml

@@ -11,10 +11,6 @@ on:
       - opened
       - reopened
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   add-new-issues-to-backlog:
     runs-on: ubuntu-latest
@@ -39,7 +35,7 @@ jobs:
           popd &>/dev/null
 
       - name: Checkout code to allow hub to communicate with the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
 
       - name: Add issue to issue backlog
         env:

.github/workflows/add-pr-sizing-label.yaml

@@ -1,53 +0,0 @@
-# Copyright (c) 2022 Intel Corporation
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-name: Add PR sizing label
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  add-pr-size-label:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
-
-      - name: Install PR sizing label script
-        run: |
-          # Clone into a temporary directory to avoid overwriting
-          # any existing github directory.
-          pushd $(mktemp -d) &>/dev/null
-          git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
-          sudo install pr-add-size-label.sh /usr/local/bin
-          popd &>/dev/null
-
-      - name: Add PR sizing label
-        env:
-          GITHUB_TOKEN: ${{ secrets.KATA_GITHUB_ACTIONS_PR_SIZE_TOKEN }}
-        run: |
-          pr=${{ github.event.number }}
-          # Removing man-db, workflow kept failing, fixes: #4480
-          sudo apt -y remove --purge man-db
-          sudo apt -y install diffstat patchutils
-
-          pr-add-size-label.sh -p "$pr"

.github/workflows/basic-ci-amd64.yaml

@@ -1,336 +0,0 @@
-name: CI | Basic amd64 tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'dragonball', 'qemu', 'stratovirt', 'cloud-hypervisor', 'qemu-runtime-rs']
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        timeout-minutes: 10
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-  run-containerd-stability:
-    strategy:
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu', 'stratovirt']
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/stability/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/stability/gha-run.sh install-kata kata-artifacts
-
-      - name: Run containerd-stability tests
-        timeout-minutes: 15
-        run: bash tests/stability/gha-run.sh run
-
-  run-nydus:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'qemu', 'dragonball', 'stratovirt']
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/nydus/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/nydus/gha-run.sh install-kata kata-artifacts
-
-      - name: Run nydus tests
-        timeout-minutes: 10
-        run: bash tests/integration/nydus/gha-run.sh run
-
-  run-runk:
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: lts
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/runk/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
-
-      - name: Run runk tests
-        timeout-minutes: 10
-        run: bash tests/integration/runk/gha-run.sh run
-
-  run-tracing:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh # cloud-hypervisor
-          - qemu
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/tracing/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/functional/tracing/gha-run.sh install-kata kata-artifacts
-
-      - name: Run tracing tests
-        timeout-minutes: 15
-        run: bash tests/functional/tracing/gha-run.sh run
-
-  run-vfio:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm: ['clh', 'qemu']
-    runs-on: garm-ubuntu-2304
-    env:
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/vfio/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Run vfio tests
-        timeout-minutes: 15
-        run: bash tests/functional/vfio/gha-run.sh run
-
-  run-docker-tests:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # all the tests are not flaky, otherwise we'll fail them
-      # all due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - qemu
-    runs-on: garm-ubuntu-2304-smaller
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/docker/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
-
-      - name: Run docker smoke test
-        timeout-minutes: 5
-        run: bash tests/integration/docker/gha-run.sh run
-
-  run-nerdctl-tests:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # all the tests are not flaky, otherwise we'll fail them
-      # all due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - cloud-hypervisor
-    runs-on: garm-ubuntu-2304-smaller
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/nerdctl/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/nerdctl/gha-run.sh install-kata kata-artifacts
-
-      - name: Run nerdctl smoke test
-        timeout-minutes: 5
-        run: bash tests/integration/nerdctl/gha-run.sh run
-
-      - name: Collect artifacts ${{ matrix.vmm }}
-        run: bash tests/integration/nerdctl/gha-run.sh collect-artifacts
-
-      - name: Archive artifacts ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: nerdctl-tests-garm-${{ matrix.vmm }}
-          path: /tmp/artifacts
-          retention-days: 1

.github/workflows/build-checks.yaml

@@ -1,113 +0,0 @@
-on:
-  workflow_call:
-    inputs:
-      instance:
-        required: true
-        type: string
-
-name: Build checks
-jobs:
-  check:
-    runs-on: ${{ inputs.instance }}
-    strategy:
-      fail-fast: false
-      matrix:
-        component:
-          - agent
-          - dragonball
-          - runtime
-          - runtime-rs
-          - agent-ctl
-          - kata-ctl
-          - runk
-          - trace-forwarder
-          - genpolicy
-        command:
-          - "make vendor"
-          - "make check"
-          - "make test"
-          - "sudo -E PATH=\"$PATH\" make test"
-        include:
-          - component: agent
-            component-path: src/agent
-          - component: dragonball
-            component-path: src/dragonball
-          - component: runtime
-            component-path: src/runtime
-          - component: runtime-rs
-            component-path: src/runtime-rs
-          - component: agent-ctl
-            component-path: src/tools/agent-ctl
-          - component: kata-ctl
-            component-path: src/tools/kata-ctl
-          - component: runk
-            component-path: src/tools/runk
-          - component: trace-forwarder
-            component-path: src/tools/trace-forwarder
-          - install-libseccomp: no
-          - component: agent
-            install-libseccomp: yes
-          - component: runk
-            install-libseccomp: yes
-          - component: genpolicy
-            component-path: src/tools/genpolicy
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE $HOME
-          sudo rm -rf $GITHUB_WORKSPACE/* && echo "GITHUB_WORKSPACE removed" || { sleep 10 && sudo rm -rf $GITHUB_WORKSPACE/*; }
-          sudo rm -f /tmp/kata_hybrid*  # Sometime we got leftover from test_setup_hvsock_failed()
-        if: ${{ inputs.instance != 'ubuntu-20.04' }}
-
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install yq
-        run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install golang
-        if: ${{ matrix.component == 'runtime' }}
-        run: |
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> $GITHUB_PATH
-      - name: Install rust
-        if: ${{ matrix.component != 'runtime' }}
-        run: |
-          ./tests/install_rust.sh
-          echo "${HOME}/.cargo/bin" >> $GITHUB_PATH
-      - name: Install musl-tools
-        if: ${{ matrix.component != 'runtime' }}
-        run: sudo apt-get -y install musl-tools
-      - name: Install devicemapper
-        if: ${{ matrix.command == 'make check' && matrix.component == 'agent' }}
-        run: sudo apt-get -y install libdevmapper-dev
-      - name: Install libseccomp
-        if: ${{ matrix.command != 'make vendor'  &&  matrix.command != 'make check' &&  matrix.install-libseccomp == 'yes' }}
-        run: |
-          libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
-          gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
-          ./ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
-          echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
-          echo "LIBSECCOMP_LINK_TYPE=static" >> $GITHUB_ENV
-          echo "LIBSECCOMP_LIB_PATH=${libseccomp_install_dir}/lib" >> $GITHUB_ENV
-      - name: Install protobuf-compiler
-        if: ${{ matrix.command != 'make vendor' && (matrix.component == 'agent' || matrix.component == 'runk' || matrix.component == 'genpolicy') }}
-        run: sudo apt-get -y install protobuf-compiler
-      - name: Install clang
-        if: ${{ matrix.command == 'make check' && matrix.component == 'agent' }}
-        run: sudo apt-get -y install clang
-      - name: Setup XDG_RUNTIME_DIR for the `runtime` tests
-        if: ${{ matrix.command != 'make vendor' && matrix.command != 'make check' && matrix.component == 'runtime' }}
-        run: |
-          XDG_RUNTIME_DIR=$(mktemp -d /tmp/kata-tests-$USER.XXX | tee >(xargs chmod 0700))
-          echo "XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR}" >> $GITHUB_ENV
-      - name: Running `${{ matrix.command }}` for ${{ matrix.component }}
-        run: |
-          cd ${{ matrix.component-path }}
-          ${{ matrix.command }}
-        env:
-          RUST_BACKTRACE: "1"

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -1,142 +0,0 @@
-name: CI | Build kata-static tarball for amd64
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - agent-ctl
-          - cloud-hypervisor
-          - cloud-hypervisor-glibc
-          - coco-guest-components
-          - firecracker
-          - genpolicy
-          - kata-ctl
-          - kata-manager
-          - kernel
-          - kernel-confidential
-          - kernel-dragonball-experimental
-          - kernel-nvidia-gpu
-          - kernel-nvidia-gpu-confidential
-          - nydus
-          - ovmf
-          - ovmf-sev
-          - pause-image
-          - qemu
-          - qemu-snp-experimental
-          - stratovirt
-          - rootfs-image
-          - rootfs-image-confidential
-          - rootfs-initrd
-          - rootfs-initrd-confidential
-          - rootfs-initrd-mariner
-          - runk
-          - shim-v2
-          - trace-forwarder
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-        exclude:
-          - asset: agent
-            stage: release
-          - asset: cloud-hypervisor-glibc
-            stage: release
-          - asset: pause-image
-            stage: release
-          - asset: coco-guest-components
-            stage: release
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          sudo cp -r "${build_dir}" "kata-build"
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-amd64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: ubuntu-latest
-    needs: build-asset
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-amd64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -1,123 +0,0 @@
-name: CI | Build kata-static tarball for arm64
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: arm64-builder
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - cloud-hypervisor
-          - firecracker
-          - kernel
-          - kernel-dragonball-experimental
-          - nydus
-          - qemu
-          - stratovirt
-          - rootfs-image
-          - rootfs-initrd
-          - shim-v2
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          sudo cp -r "${build_dir}" "kata-build"
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: arm64-builder
-    needs: build-asset
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-arm64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-arm64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-ppc64le.yaml

@@ -1,124 +0,0 @@
-name: CI | Build kata-static tarball for ppc64le
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: ppc64le
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - kernel
-          - qemu
-          - rootfs-initrd
-          - shim-v2
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - name: Prepare the self-hosted runner
-        run: |
-            ${HOME}/scripts/prepare_runner.sh
-            sudo rm -rf $GITHUB_WORKSPACE/*
-
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R $(id -u):$(id -g) "kata-build"
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-ppc64le-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: ppc64le
-    needs: build-asset
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-ppc64le-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 1
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -1,172 +0,0 @@
-name: CI | Build kata-static tarball for s390x
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: s390x
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - coco-guest-components
-          - kernel
-          - kernel-confidential
-          - pause-image
-          - qemu
-          - rootfs-image
-          - rootfs-image-confidential
-          - rootfs-initrd
-          - rootfs-initrd-confidential
-          - shim-v2
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-        exclude:
-          - asset: pause-image
-            stage: release
-          - asset: coco-guest-components
-            stage: release
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R $(id -u):$(id -g) "kata-build"
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  build-asset-boot-image-se:
-    runs-on: s390x
-    needs: build-asset
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Place a host key document
-        run: |
-          mkdir -p "host-key-document"
-          cp "${CI_HKD_PATH}" "host-key-document"
-        env:
-          CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
-
-      - name: Build boot-image-se
-        run: |
-          base_dir=tools/packaging/kata-deploy/local-build/
-          cp -r kata-artifacts ${base_dir}/build
-          # Skip building dependant artifacts of boot-image-se-tarball
-          # because we already have them from the previous build
-          sed -i 's/\(^boot-image-se-tarball:\).*/\1/g' ${base_dir}/Makefile
-          make boot-image-se-tarball
-          build_dir=$(readlink -f build)
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R $(id -u):$(id -g) "kata-build"
-        env:
-          HKD_PATH: "host-key-document"
-
-      - name: store-artifact boot-image-se
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-boot-image-se.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: s390x
-    needs: [build-asset, build-asset-boot-image-se]
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/cargo-deny-runner.yaml

@@ -1,30 +0,0 @@
-name: Cargo Crates Check Runner
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  cargo-deny-runner:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout Code
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        uses: actions/checkout@v4
-      - name: Generate Action
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        run: bash cargo-deny-generator.sh
-        working-directory: ./.github/cargo-deny-composite-action/
-        env:
-          GOPATH: ${{ runner.workspace }}/kata-containers
-      - name: Run Action
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        uses: ./.github/cargo-deny-composite-action

.github/workflows/ci-nightly-s390x.yaml

@@ -1,21 +0,0 @@
-on:
-  schedule:
-    - cron: '0 5 * * *'
-
-name: Nightly CI for s390x
-jobs:
-  check-internal-test-result:
-    runs-on: s390x
-    strategy:
-      fail-fast: false
-      matrix:
-        test_title:
-          - kata-vfio-ap-e2e-tests
-          - cc-se-e2e-tests
-    steps:
-    - name: Fetch a test result for {{ matrix.test_title }}
-      run: |
-        file_name="${TEST_TITLE}-$(date +%Y-%m-%d).log"
-        /home/${USER}/script/handle_test_log.sh download $file_name
-      env:
-        TEST_TITLE: ${{ matrix.test_title }}

.github/workflows/ci-nightly.yaml

@@ -1,19 +0,0 @@
-name: Kata Containers Nightly CI
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-containers-ci-on-push:
-    uses: ./.github/workflows/ci.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      pr-number: "nightly"
-      tag: ${{ github.sha }}-nightly
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit

.github/workflows/ci-on-push.yaml

@@ -1,30 +0,0 @@
-name: Kata Containers CI
-on:
-  pull_request_target:
-    branches:
-      - 'main'
-      - 'stable-*'
-    types:
-      # Adding 'labeled' to the list of activity types that trigger this event
-      # (default: opened, synchronize, reopened) so that we can run this
-      # workflow when the 'ok-to-test' label is added.
-      # Reference: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
-      - opened
-      - synchronize
-      - reopened
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-containers-ci-on-push:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}
-    uses: ./.github/workflows/ci.yaml
-    with:
-      commit-hash: ${{ github.event.pull_request.head.sha }}
-      pr-number: ${{ github.event.pull_request.number }}
-      tag: ${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
-      target-branch: ${{ github.event.pull_request.base.ref }}
-    secrets: inherit

.github/workflows/ci.yaml

@@ -1,248 +0,0 @@
-name: Run the Kata Containers CI
-on:
-  workflow_call:
-    inputs:
-      commit-hash:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-kata-static-tarball-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  publish-kata-deploy-payload-amd64:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/publish-kata-deploy-payload-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  build-kata-static-tarball-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-  
-  build-kata-static-tarball-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  publish-kata-deploy-payload-s390x:
-    needs: build-kata-static-tarball-s390x
-    uses: ./.github/workflows/publish-kata-deploy-payload-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-  
-  publish-kata-deploy-payload-ppc64le:
-    needs: build-kata-static-tarball-ppc64le
-    uses: ./.github/workflows/publish-kata-deploy-payload-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  build-and-publish-tee-confidential-unencrypted-image:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Kata Containers ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker build and push
-        uses: docker/build-push-action@v5
-        with:
-          tags: ghcr.io/kata-containers/test-images:unencrypted-${{ inputs.pr-number }}
-          push: true
-          context: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/
-          platforms: linux/amd64, linux/s390x
-          file: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/Dockerfile
-
-  run-kata-deploy-tests-on-aks:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-kata-deploy-tests-on-aks.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-kata-deploy-tests-on-garm:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-kata-deploy-tests-on-garm.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-kata-monitor-tests:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/run-kata-monitor-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-k8s-tests-on-aks:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-aks.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-garm:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-garm.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-with-crio-on-garm:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-with-crio-on-garm.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-kata-coco-tests:
-    needs: [publish-kata-deploy-payload-amd64, build-and-publish-tee-confidential-unencrypted-image]
-    uses: ./.github/workflows/run-kata-coco-tests.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-zvsi:
-    needs: [publish-kata-deploy-payload-s390x, build-and-publish-tee-confidential-unencrypted-image]
-    uses: ./.github/workflows/run-k8s-tests-on-zvsi.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-      
-  run-k8s-tests-on-ppc64le:
-    needs: publish-kata-deploy-payload-ppc64le
-    uses: ./.github/workflows/run-k8s-tests-on-ppc64le.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-metrics-tests:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/run-metrics.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-basic-amd64-tests:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/basic-ci-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-cri-containerd-tests-s390x:
-    needs: build-kata-static-tarball-s390x
-    uses: ./.github/workflows/run-cri-containerd-tests-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-cri-containerd-tests-ppc64le:
-    needs: build-kata-static-tarball-ppc64le
-    uses: ./.github/workflows/run-cri-containerd-tests-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}

.github/workflows/commit-message-check.yaml

@@ -6,50 +6,36 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 env:
   error_msg: |+
     See the document below for help on formatting commits for the project.
 
-    https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
+    https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md#patch-format
 
 jobs:
   commit-message-check:
     runs-on: ubuntu-latest
-    env:
-      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
     name: Commit Message Check
     steps:
     - name: Get PR Commits
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
       id: 'get-pr-commits'
-      uses: tim-actions/get-pr-commits@v1.2.0
+      uses: tim-actions/get-pr-commits@v1.0.0
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
-        # Filter out revert commits
-        # The format of a revert commit is as follows:
-        #
-        # Revert "<original-subject-line>"
-        #
-        filter_out_pattern: '^Revert "'
 
     - name: DCO Check
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
       uses: tim-actions/dco@2fd0504dc0d27b33f542867c300c60840c6dcb20
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
 
     - name: Commit Body Missing Check
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      if: ${{ success() || failure() }}
       uses: tim-actions/commit-body-check@v1.0.2
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
 
     - name: Check Subject Line Length
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      if: ${{ success() || failure() }}
       uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
@@ -58,7 +44,7 @@ jobs:
         post_error: ${{ env.error_msg }}
 
     - name: Check Body Line Length
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      if: ${{ success() || failure() }}
       uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
@@ -68,12 +54,8 @@ jobs:
         #   to be specified at the start of the regex as the action is passed
         #   the entire commit message.
         #
-        # - This check will pass if the commit message only contains a subject
-        #   line, as other body message properties are enforced elsewhere.
-        #
         # - Body lines *can* be longer than the maximum if they start
-        #   with a non-alphabetic character or if there is no whitespace in
-        #   the line.
+        #   with a non-alphabetic character.
         #
         #   This allows stack traces, log files snippets, emails, long URLs,
         #   etc to be specified. Some of these naturally "work" as they start
@@ -84,12 +66,23 @@ jobs:
         #
         # - A SoB comment can be any length (as it is unreasonable to penalise
         #   people with long names/email addresses :)
-        pattern: '(^[^\n]+$|^.+(\n([a-zA-Z].{0,150}|[^a-zA-Z\n].*|[^\s\n]*|Signed-off-by:.*|))+$)'
-        error: 'Body line too long (max 150)'
+        pattern: '^.+(\n([a-zA-Z].{0,149}|[^a-zA-Z\n].*|Signed-off-by:.*|))+$'
+        error: 'Body line too long (max 72)'
         post_error: ${{ env.error_msg }}
 
+    - name: Check Fixes
+      if: ${{ success() || failure() }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}
+        pattern: '\s*Fixes\s*:?\s*(#\d+|github\.com\/kata-containers\/[a-z-.]*#\d+)|^\s*release\s*:'
+        flags: 'i'
+        error: 'No "Fixes" found'
+        post_error: ${{ env.error_msg }}
+        one_pass_all_pass: 'true'
+
     - name: Check Subsystem
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      if: ${{ success() || failure() }}
       uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}

.github/workflows/darwin-tests.yaml

@@ -1,25 +0,0 @@
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-name: Darwin tests
-jobs:
-  test:
-    runs-on: macos-latest
-    steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.22.2
-    - name: Checkout code
-      uses: actions/checkout@v4
-    - name: Build utils
-      run: ./ci/darwin-test.sh

.github/workflows/docs-url-alive-check.yaml

@@ -1,37 +0,0 @@
-on:
-  schedule:
-    - cron:  '0 23 * * 0'
-
-name: Docs URL Alive Check
-jobs:
-  test:
-    runs-on: ubuntu-20.04
-    # don't run this action on forks
-    if: github.repository_owner == 'kata-containers'
-    env:
-      target_branch: ${{ github.base_ref }}
-    steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.22.2
-      env:
-        GOPATH: ${{ runner.workspace }}/kata-containers
-    - name: Set env
-      run: |
-        echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
-        echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-        path: ./src/github.com/${{ github.repository }}
-    - name: Setup
-      run: |
-        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/setup.sh
-      env:
-        GOPATH: ${{ runner.workspace }}/kata-containers
-    # docs url alive check
-    - name: Docs URL Alive Check
-      run: |
-        cd ${GOPATH}/src/github.com/${{ github.repository }} && make docs-url-alive-check

.github/workflows/kata-deploy-push.yaml

@@ -0,0 +1,58 @@
+name: kata-deploy-build
+
+on: push
+
+jobs:
+  build-asset:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        asset:
+          - kernel
+          - shim-v2
+          - qemu
+          - cloud-hypervisor
+          - firecracker
+          - rootfs-image
+          - rootfs-initrd
+    steps:
+      - uses: actions/checkout@v2
+      - name: Install docker
+        run: |
+          curl -fsSL https://test.docker.com -o test-docker.sh
+          sh test-docker.sh
+
+      - name: Build ${{ matrix.asset }}
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh --build="${KATA_ASSET}"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r --preserve=all "${build_dir}" "kata-build"
+        env:
+          KATA_ASSET: ${{ matrix.asset }}
+
+      - name: store-artifact ${{ matrix.asset }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
+
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
+    steps:
+      - uses: actions/checkout@v2
+      - name: get-artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-artifacts
+      - name: merge-artifacts
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts
+      - name: store-artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-static-tarball
+          path: kata-static.tar.xz

.github/workflows/kata-deploy-test.yaml

@@ -0,0 +1,65 @@
+on:
+  issue_comment:
+    types: [created, edited]
+
+name: test-kata-deploy
+
+jobs:
+  check_comments:
+    if: ${{ github.event.issue.pull_request }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for Command
+        id: command
+        uses: kata-containers/slash-command-action@v1
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          command: "test_kata_deploy"
+          reaction: "true"
+          reaction-type: "eyes"
+          allow-edits: "false"
+          permission-level: admin
+      - name: verify command arg is kata-deploy
+        run: |
+           echo "The command was '${{ steps.command.outputs.command-name }}' with arguments '${{ steps.command.outputs.command-arguments }}'"
+
+  create-and-test-container:
+    needs: check_comments
+    runs-on: ubuntu-latest
+    steps:
+      - name: get-PR-ref
+        id: get-PR-ref
+        run: |
+            ref=$(cat $GITHUB_EVENT_PATH | jq -r '.issue.pull_request.url' | sed  's#^.*\/pulls#refs\/pull#' | sed 's#$#\/merge#')
+            echo "reference for PR: " ${ref}
+            echo "##[set-output name=pr-ref;]${ref}"
+
+      - name: check out
+        uses: actions/checkout@v2
+        with:
+           ref: ${{ steps.get-PR-ref.outputs.pr-ref }}
+
+      - name: build-container-image
+        id: build-container-image
+        run: |
+            PR_SHA=$(git log --format=format:%H -n1)
+            VERSION="2.0.0"
+            ARTIFACT_URL="https://github.com/kata-containers/kata-containers/releases/download/${VERSION}/kata-static-${VERSION}-x86_64.tar.xz"
+            wget "${ARTIFACT_URL}" -O tools/packaging/kata-deploy/kata-static.tar.xz
+            docker build --build-arg KATA_ARTIFACTS=kata-static.tar.xz -t katadocker/kata-deploy-ci:${PR_SHA} -t quay.io/kata-containers/kata-deploy-ci:${PR_SHA} ./tools/packaging/kata-deploy
+            docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
+            docker push katadocker/kata-deploy-ci:$PR_SHA
+            docker login -u ${{ secrets.QUAY_DEPLOYER_USERNAME }} -p ${{ secrets.QUAY_DEPLOYER_PASSWORD }} quay.io
+            docker push quay.io/kata-containers/kata-deploy-ci:$PR_SHA
+            echo "##[set-output name=pr-sha;]${PR_SHA}"
+
+      - name: test-kata-deploy-ci-in-aks
+        uses: ./tools/packaging/kata-deploy/action
+        with:
+          packaging-sha: ${{ steps.build-container-image.outputs.pr-sha }}
+        env:
+          PKG_SHA: ${{ steps.build-container-image.outputs.pr-sha }}
+          AZ_APPID: ${{ secrets.AZ_APPID }}
+          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
+          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}

.github/workflows/kata-runtime-classes-sync.yaml

@@ -1,36 +0,0 @@
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-deploy-runtime-classes-check:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    - name: Ensure the split out runtime classes match the all-in-one file
-      run: |
-        pushd tools/packaging/kata-deploy/runtimeclasses/
-        echo "::group::Combine runtime classes"
-        for runtimeClass in `find . -type f \( -name "*.yaml" -and -not -name "kata-runtimeClasses.yaml" \) | sort`; do
-            echo "Adding ${runtimeClass} to the resultingRuntimeClasses.yaml"
-            cat ${runtimeClass} >> resultingRuntimeClasses.yaml;
-        done
-        echo "::endgroup::"
-        echo "::group::Displaying the content of resultingRuntimeClasses.yaml"
-        cat resultingRuntimeClasses.yaml
-        echo "::endgroup::"
-        echo ""
-        echo "::group::Displaying the content of kata-runtimeClasses.yaml"
-        cat kata-runtimeClasses.yaml
-        echo "::endgroup::"
-        echo ""
-        diff resultingRuntimeClasses.yaml kata-runtimeClasses.yaml

.github/workflows/main.yaml

@@ -0,0 +1,295 @@
+name: Publish release tarball
+on: 
+  push: 
+    tags:
+     - '1.*'
+
+jobs:
+  get-artifact-list:
+    runs-on: ubuntu-latest
+    steps:
+      - name: get the list
+        run: |
+         pushd $GITHUB_WORKSPACE
+         tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+         git checkout $tag
+         popd
+         $GITHUB_WORKSPACE/tools/packaging/artifact-list.sh > artifact-list.txt
+      - name: save-artifact-list
+        uses: actions/upload-artifact@master
+        with:
+          name: artifact-list
+          path: artifact-list.txt
+
+  build-kernel:
+    runs-on: ubuntu-16.04
+    needs: get-artifact-list
+    env:
+      buildstr: "install_kernel"
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifact-list
+        uses: actions/download-artifact@master
+        with:
+          name: artifact-list
+      - run: |
+         sudo apt-get update && sudo apt install -y flex bison libelf-dev bc iptables
+      - name: build-kernel
+        run: |
+         if grep -q $buildstr ./artifact-list/artifact-list.txt; then
+           $GITHUB_WORKSPACE/.github/workflows/generate-artifact-tarball.sh $buildstr
+           echo "artifact-built=true" >> $GITHUB_ENV
+         else
+           echo "artifact-built=false" >> $GITHUB_ENV
+         fi
+      - name: store-artifacts
+        if: ${{ env.artifact-built }} == 'true'
+        uses: actions/upload-artifact@master
+        with:
+          name: kata-artifacts
+          path: kata-static-kernel.tar.gz
+
+  build-experimental-kernel:
+    runs-on: ubuntu-16.04
+    needs: get-artifact-list
+    env:
+      buildstr: "install_experimental_kernel"
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifact-list
+        uses: actions/download-artifact@master
+        with:
+          name: artifact-list
+      - run: |
+         sudo apt-get update && sudo apt install -y flex bison libelf-dev bc iptables
+      - name: build-experimental-kernel
+        run: |
+         if grep -q $buildstr ./artifact-list/artifact-list.txt; then
+           $GITHUB_WORKSPACE/.github/workflows/generate-artifact-tarball.sh $buildstr
+           echo "artifact-built=true" >> $GITHUB_ENV
+         else
+           echo "artifact-built=false" >> $GITHUB_ENV
+         fi
+      - name: store-artifacts
+        if: ${{ env.artifact-built }} == 'true'
+        uses: actions/upload-artifact@master
+        with:
+          name: kata-artifacts
+          path: kata-static-experimental-kernel.tar.gz
+
+  build-qemu:
+    runs-on: ubuntu-16.04
+    needs: get-artifact-list
+    env:
+      buildstr: "install_qemu"
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifact-list
+        uses: actions/download-artifact@master
+        with:
+          name: artifact-list
+      - name: build-qemu
+        run: |
+         if grep -q $buildstr ./artifact-list/artifact-list.txt; then
+           $GITHUB_WORKSPACE/.github/workflows/generate-artifact-tarball.sh $buildstr
+           echo "artifact-built=true" >> $GITHUB_ENV
+         else
+           echo "artifact-built=false" >> $GITHUB_ENV
+         fi
+      - name: store-artifacts
+        if: ${{ env.artifact-built }} == 'true'
+        uses: actions/upload-artifact@master
+        with:
+          name: kata-artifacts
+          path: kata-static-qemu.tar.gz
+
+  # Job for building the image
+  build-image:
+    runs-on: ubuntu-16.04
+    needs: get-artifact-list
+    env:
+      buildstr: "install_image"
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifact-list
+        uses: actions/download-artifact@master
+        with:
+          name: artifact-list
+      - name: build-image
+        run: |
+         if grep -q $buildstr ./artifact-list/artifact-list.txt; then
+           $GITHUB_WORKSPACE/.github/workflows/generate-artifact-tarball.sh $buildstr
+           echo "artifact-built=true" >> $GITHUB_ENV
+         else
+           echo "artifact-built=false" >> $GITHUB_ENV
+         fi
+      - name: store-artifacts
+        if: ${{ env.artifact-built }} == 'true'
+        uses: actions/upload-artifact@master
+        with:
+          name: kata-artifacts
+          path: kata-static-image.tar.gz
+
+  # Job for building firecracker hypervisor
+  build-firecracker:
+    runs-on: ubuntu-16.04
+    needs: get-artifact-list
+    env:
+      buildstr: "install_firecracker"
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifact-list
+        uses: actions/download-artifact@master
+        with:
+          name: artifact-list
+      - name: build-firecracker
+        run: |
+         if grep -q $buildstr ./artifact-list/artifact-list.txt; then
+           $GITHUB_WORKSPACE/.github/workflows/generate-artifact-tarball.sh $buildstr
+           echo "artifact-built=true" >> $GITHUB_ENV
+         else
+           echo "artifact-built=false" >> $GITHUB_ENV
+         fi
+      - name: store-artifacts
+        if: ${{ env.artifact-built }} == 'true'
+        uses: actions/upload-artifact@master
+        with:
+          name: kata-artifacts
+          path: kata-static-firecracker.tar.gz
+
+  # Job for building cloud-hypervisor
+  build-clh:
+    runs-on: ubuntu-16.04
+    needs: get-artifact-list
+    env:
+      buildstr: "install_clh"
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifact-list
+        uses: actions/download-artifact@master
+        with:
+          name: artifact-list
+      - name: build-clh
+        run: |
+         if grep -q $buildstr ./artifact-list/artifact-list.txt; then
+           $GITHUB_WORKSPACE/.github/workflows/generate-artifact-tarball.sh $buildstr
+           echo "artifact-built=true" >> $GITHUB_ENV
+         else
+           echo "artifact-built=false" >> $GITHUB_ENV
+         fi
+      - name: store-artifacts
+        if: ${{ env.artifact-built }} == 'true'
+        uses: actions/upload-artifact@master
+        with:
+          name: kata-artifacts
+          path: kata-static-clh.tar.gz
+
+  # Job for building kata components
+  build-kata-components:
+    runs-on: ubuntu-16.04
+    needs: get-artifact-list
+    env:
+      buildstr: "install_kata_components"
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifact-list
+        uses: actions/download-artifact@master
+        with:
+          name: artifact-list
+      - name: build-kata-components
+        run: |
+         if grep -q $buildstr ./artifact-list/artifact-list.txt; then
+           $GITHUB_WORKSPACE/.github/workflows/generate-artifact-tarball.sh $buildstr
+           echo "artifact-built=true" >> $GITHUB_ENV
+         else
+           echo "artifact-built=false" >> $GITHUB_ENV
+         fi
+      - name: store-artifacts
+        if: ${{ env.artifact-built }} == 'true'
+        uses: actions/upload-artifact@master
+        with:
+          name: kata-artifacts
+          path: kata-static-kata-components.tar.gz
+
+  gather-artifacts:
+    runs-on: ubuntu-16.04
+    needs: [build-experimental-kernel, build-kernel, build-qemu, build-image, build-firecracker, build-kata-components, build-clh]
+    steps:
+      - uses: actions/checkout@v1
+      - name: get-artifacts
+        uses: actions/download-artifact@master
+        with:
+          name: kata-artifacts
+      - name: colate-artifacts
+        run: |
+          $GITHUB_WORKSPACE/.github/workflows/gather-artifacts.sh
+      - name: store-artifacts
+        uses: actions/upload-artifact@master
+        with:
+          name: release-candidate
+          path: kata-static.tar.xz
+
+  kata-deploy:
+    needs: gather-artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: get-artifacts
+        uses: actions/download-artifact@master
+        with:
+          name: release-candidate
+      - name: build-and-push-kata-deploy-ci
+        id: build-and-push-kata-deploy-ci
+        run: |
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          git clone https://github.com/kata-containers/packaging
+          pushd packaging
+          git checkout $tag
+          pkg_sha=$(git rev-parse HEAD)
+          popd
+          mv release-candidate/kata-static.tar.xz ./packaging/kata-deploy/kata-static.tar.xz
+          docker build --build-arg KATA_ARTIFACTS=kata-static.tar.xz -t katadocker/kata-deploy-ci:$pkg_sha -t quay.io/kata-containers/kata-deploy-ci:$pkg_sha ./packaging/kata-deploy
+          docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
+          docker push katadocker/kata-deploy-ci:$pkg_sha
+          docker login -u ${{ secrets.QUAY_DEPLOYER_USERNAME }} -p ${{ secrets.QUAY_DEPLOYER_PASSWORD }} quay.io
+          docker push quay.io/kata-containers/kata-deploy-ci:$pkg_sha
+          echo "::set-output name=PKG_SHA::${pkg_sha}"
+      - name: test-kata-deploy-ci-in-aks
+        uses: ./packaging/kata-deploy/action
+        with:
+          packaging-sha: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+        env:
+          PKG_SHA: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+          AZ_APPID: ${{ secrets.AZ_APPID }}
+          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
+          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
+      - name: push-tarball
+        run: |
+          # tag the container image we created and push to DockerHub
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          docker tag katadocker/kata-deploy-ci:${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}} katadocker/kata-deploy:${tag}
+          docker push katadocker/kata-deploy:${tag}
+
+  upload-static-tarball:
+    needs: kata-deploy
+    runs-on: ubuntu-latest
+    steps:
+      - name: download-artifacts
+        uses: actions/download-artifact@master
+        with:
+          name: release-candidate
+      - name: install hub
+        run: |
+          HUB_VER=$(curl -s "https://api.github.com/repos/github/hub/releases/latest" | jq -r .tag_name | sed 's/^v//')
+          wget -q -O- https://github.com/github/hub/releases/download/v$HUB_VER/hub-linux-amd64-$HUB_VER.tgz | \
+          tar xz --strip-components=2 --wildcards '*/bin/hub' && sudo mv hub /usr/local/bin/hub
+      - name: push static tarball to github
+        run: |
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tarball="kata-static-$tag-x86_64.tar.xz"
+          repo="https://github.com/kata-containers/runtime.git"
+          mv release-candidate/kata-static.tar.xz "release-candidate/${tarball}"
+          git clone "${repo}"
+          cd runtime
+          echo "uploading asset '${tarball}' to '${repo}' tag: ${tag}"
+          GITHUB_TOKEN=${{ secrets.GIT_UPLOAD_TOKEN }} hub release edit -m "" -a "../release-candidate/${tarball}" "${tag}"

.github/workflows/move-issues-to-in-progress.yaml

@@ -16,7 +16,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install hub
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
         run: |
           HUB_ARCH="amd64"
           HUB_VER=$(curl -sL "https://api.github.com/repos/github/hub/releases/latest" |\
@@ -27,7 +26,6 @@ jobs:
           sudo install hub /usr/local/bin
 
       - name: Install hub extension script
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
         run: |
           # Clone into a temporary directory to avoid overwriting
           # any existing github directory.
@@ -37,21 +35,9 @@ jobs:
           popd &>/dev/null
 
       - name: Checkout code to allow hub to communicate with the project
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+        uses: actions/checkout@v2
 
       - name: Move issue to "In progress"
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
         env:
           GITHUB_TOKEN: ${{ secrets.KATA_GITHUB_ACTIONS_TOKEN }}
         run: |
@@ -62,10 +48,11 @@ jobs:
             grep -v "^\#"  |\
             cut -d';' -f3 || true)
 
-          # PR doesn't have any linked issues, handle it only if it exists
+          # PR doesn't have any linked issues
+          # (it should, but maybe a new user forgot to add a "Fixes: #XXX" commit).
           [ -z "$linked_issue_urls" ] && {
-            echo "::warning::No linked issues for PR $pr"
-            exit 0
+            echo "::error::No linked issues for PR $pr"
+            exit 1
           }
 
           project_name="Issue backlog"

.github/workflows/payload-after-push.yaml

@@ -1,107 +0,0 @@
-name: CI | Publish Kata Containers payload
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-
-jobs:
-  build-assets-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-assets-arm64:
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-assets-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-  
-  build-assets-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-amd64:
-    needs: build-assets-amd64
-    uses: ./.github/workflows/publish-kata-deploy-payload-amd64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-amd64
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-arm64:
-    needs: build-assets-arm64
-    uses: ./.github/workflows/publish-kata-deploy-payload-arm64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-arm64
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-s390x:
-    needs: build-assets-s390x
-    uses: ./.github/workflows/publish-kata-deploy-payload-s390x.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-s390x
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-ppc64le:
-    needs: build-assets-ppc64le
-    uses: ./.github/workflows/publish-kata-deploy-payload-ppc64le.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-ppc64le
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-manifest:
-    runs-on: ubuntu-latest
-    needs: [publish-kata-deploy-payload-amd64, publish-kata-deploy-payload-arm64, publish-kata-deploy-payload-s390x, publish-kata-deploy-payload-ppc64le]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Push multi-arch manifest
-        run: |
-          ./tools/packaging/release/release.sh publish-multiarch-manifest
-        env:
-          KATA_DEPLOY_IMAGE_TAGS: "kata-containers-latest"
-          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy-ci"

.github/workflows/publish-kata-deploy-payload-amd64.yaml

@@ -1,66 +0,0 @@
-name: CI | Publish kata-deploy payload for amd64
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}

.github/workflows/publish-kata-deploy-payload-arm64.yaml

@@ -1,71 +0,0 @@
-name: CI | Publish kata-deploy payload for arm64
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: arm64-builder
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-arm64${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}
-

.github/workflows/publish-kata-deploy-payload-ppc64le.yaml

@@ -1,75 +0,0 @@
-name: CI | Publish kata-deploy payload for ppc64le
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: ppc64le
-    steps:
-      - name: Prepare the self-hosted runner
-        run: |
-          ${HOME}/scripts/prepare_runner.sh
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}

.github/workflows/publish-kata-deploy-payload-s390x.yaml

@@ -1,69 +0,0 @@
-name: CI | Publish kata-deploy payload for s390x
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: s390x
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}

.github/workflows/release-amd64.yaml

@@ -1,57 +0,0 @@
-name: Publish Kata release artifacts for amd64
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      stage: release
-
-  kata-deploy:
-    needs: build-kata-static-tarball-amd64
-    runs-on: ubuntu-latest
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64
-
-      - name: build-and-push-kata-deploy-ci-amd64
-        id: build-and-push-kata-deploy-ci-amd64
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-arm64.yaml

@@ -1,57 +0,0 @@
-name: Publish Kata release artifacts for arm64
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-arm64:
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      stage: release
-
-  kata-deploy:
-    needs: build-kata-static-tarball-arm64
-    runs-on: arm64-builder
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-arm64
-
-      - name: build-and-push-kata-deploy-ci-arm64
-        id: build-and-push-kata-deploy-ci-arm64
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-ppc64le.yaml

@@ -1,62 +0,0 @@
-name: Publish Kata release artifacts for ppc64le
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      stage: release
-
-  kata-deploy:
-    needs: build-kata-static-tarball-ppc64le
-    runs-on: ppc64le
-    steps:
-      - name: Prepare the self-hosted runner
-        run: |
-          bash ${HOME}/scripts/prepare_runner.sh
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le
-
-      - name: build-and-push-kata-deploy-ci-ppc64le
-        id: build-and-push-kata-deploy-ci-ppc64le
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-s390x.yaml

@@ -1,61 +0,0 @@
-name: Publish Kata release artifacts for s390x
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-s390x
-    runs-on: s390x
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x
-
-      - name: build-and-push-kata-deploy-ci-s390x
-        id: build-and-push-kata-deploy-ci-s390x
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release.yaml

@@ -1,189 +1,151 @@
-name: Release Kata Containers
+name: Publish Kata 2.x release artifacts
 on:
-  workflow_dispatch
+  push:
+    tags:
+     - '2.*'
 
 jobs:
-  release:
+  build-asset:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        asset:
+          - cloud-hypervisor
+          - firecracker
+          - kernel
+          - qemu
+          - rootfs-image
+          - rootfs-initrd
+          - shim-v2
+    steps:
+      - uses: actions/checkout@v2
+      - name: Install docker
+        run: |
+          curl -fsSL https://test.docker.com -o test-docker.sh
+          sh test-docker.sh
+
+      - name: Build ${{ matrix.asset }}
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh --build="${KATA_ASSET}"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r "${build_dir}" "kata-build"
+        env:
+          KATA_ASSET: ${{ matrix.asset }}
+          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
+
+      - name: store-artifact ${{ matrix.asset }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
+
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
+    steps:
+      - uses: actions/checkout@v2
+      - name: get-artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-artifacts
+      - name: merge-artifacts
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts
+      - name: store-artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-static-tarball
+          path: kata-static.tar.xz
+
+  kata-deploy:
+    needs: create-kata-tarball
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v2
+      - name: get-kata-tarball
+        uses: actions/download-artifact@v2
         with:
-          fetch-depth: 0
-
-      - name: Create a new release
+          name: kata-static-tarball
+      - name: build-and-push-kata-deploy-ci
+        id: build-and-push-kata-deploy-ci
         run: |
-          ./tools/packaging/release/release.sh create-new-release
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          pushd $GITHUB_WORKSPACE
+          git checkout $tag
+          pkg_sha=$(git rev-parse HEAD)
+          popd
+          mv kata-static.tar.xz $GITHUB_WORKSPACE/tools/packaging/kata-deploy/kata-static.tar.xz
+          docker build --build-arg KATA_ARTIFACTS=kata-static.tar.xz -t katadocker/kata-deploy-ci:$pkg_sha -t quay.io/kata-containers/kata-deploy-ci:$pkg_sha $GITHUB_WORKSPACE/tools/packaging/kata-deploy
+          docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
+          docker push katadocker/kata-deploy-ci:$pkg_sha
+          docker login -u ${{ secrets.QUAY_DEPLOYER_USERNAME }} -p ${{ secrets.QUAY_DEPLOYER_PASSWORD }} quay.io
+          docker push quay.io/kata-containers/kata-deploy-ci:$pkg_sha
+          mkdir -p packaging/kata-deploy
+          ln -s $GITHUB_WORKSPACE/tools/packaging/kata-deploy/action packaging/kata-deploy/action
+          echo "::set-output name=PKG_SHA::${pkg_sha}"
+      - name: test-kata-deploy-ci-in-aks
+        uses: ./packaging/kata-deploy/action
+        with:
+          packaging-sha: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
         env:
-          GH_TOKEN: ${{ github.token }}
-
-  build-and-push-assets-amd64:
-    needs: release
-    uses: ./.github/workflows/release-amd64.yaml
-    with:
-      target-arch: amd64
-    secrets: inherit
-
-  build-and-push-assets-arm64:
-    needs: release
-    uses: ./.github/workflows/release-arm64.yaml
-    with:
-      target-arch: arm64
-    secrets: inherit
-
-  build-and-push-assets-s390x:
-    needs: release
-    uses: ./.github/workflows/release-s390x.yaml
-    with:
-      target-arch: s390x
-    secrets: inherit
-
-  build-and-push-assets-ppc64le:
-    needs: release
-    uses: ./.github/workflows/release-ppc64le.yaml
-    with:
-      target-arch: ppc64le
-    secrets: inherit
-
-  publish-multi-arch-images:
-    runs-on: ubuntu-latest
-    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Get the image tags
+          PKG_SHA: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+          AZ_APPID: ${{ secrets.AZ_APPID }}
+          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
+          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
+      - name: push-tarball
         run: |
-          release_version=$(./tools/packaging/release/release.sh release-version)
-          echo "KATA_DEPLOY_IMAGE_TAGS=$release_version latest" >> "$GITHUB_ENV"
+          # tag the container image we created and push to DockerHub
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tags=($tag)
+          tags+=($([[ "$tag" =~ "alpha"|"rc" ]] && echo "latest" || echo "stable"))
+          for tag in ${tags[@]}; do \
+            docker tag katadocker/kata-deploy-ci:${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}} katadocker/kata-deploy:${tag} && \
+            docker tag quay.io/kata-containers/kata-deploy-ci:${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}} quay.io/kata-containers/kata-deploy:${tag} && \
+            docker push katadocker/kata-deploy:${tag} && \
+            docker push quay.io/kata-containers/kata-deploy:${tag}; \
+          done
 
-      - name: Publish multi-arch manifest on docker.io and quay.io
-        run: |
-          ./tools/packaging/release/release.sh publish-multiarch-manifest
-        env:
-          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy docker.io/katadocker/kata-deploy"
-
-  upload-multi-arch-static-tarball:
-    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
+  upload-static-tarball:
+    needs: kata-deploy
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set KATA_STATIC_TARBALL env var
-        run: |
-          tarball=$(pwd)/kata-static.tar.xz
-          echo "KATA_STATIC_TARBALL=${tarball}" >> "$GITHUB_ENV"
-
-      - name: Download amd64 artifacts
-        uses: actions/download-artifact@v4
+      - uses: actions/checkout@v2
+      - name: download-artifacts
+        uses: actions/download-artifact@v2
         with:
-          name: kata-static-tarball-amd64
-
-      - name: Upload amd64 static tarball to GitHub
+          name: kata-static-tarball
+      - name: install hub
         run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: amd64
-
-      - name: Download arm64 artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-arm64
-
-      - name: Upload arm64 static tarball to GitHub
+          HUB_VER=$(curl -s "https://api.github.com/repos/github/hub/releases/latest" | jq -r .tag_name | sed 's/^v//')
+          wget -q -O- https://github.com/github/hub/releases/download/v$HUB_VER/hub-linux-amd64-$HUB_VER.tgz | \
+          tar xz --strip-components=2 --wildcards '*/bin/hub' && sudo mv hub /usr/local/bin/hub
+      - name: push static tarball to github
         run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: arm64
-
-      - name: Download s390x artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x
-
-      - name: Upload s390x static tarball to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: s390x
-
-      - name: Download ppc64le artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le
-
-      - name: Upload ppc64le static tarball to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: ppc64le
-
-  upload-versions-yaml:
-    needs: release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Upload versions.yaml to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-versions-yaml-file
-        env:
-          GH_TOKEN: ${{ github.token }}
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tarball="kata-static-$tag-x86_64.tar.xz"
+          mv kata-static.tar.xz "$GITHUB_WORKSPACE/${tarball}"
+          pushd $GITHUB_WORKSPACE
+          echo "uploading asset '${tarball}' for tag: ${tag}"
+          GITHUB_TOKEN=${{ secrets.GIT_UPLOAD_TOKEN }} hub release edit -m "" -a "${tarball}" "${tag}"
+          popd
 
   upload-cargo-vendored-tarball:
-    needs: release
+    needs: upload-static-tarball
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Generate and upload vendored code tarball
+      - uses: actions/checkout@v2
+      - name: generate-and-upload-tarball
         run: |
-          ./tools/packaging/release/release.sh upload-vendored-code-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-  upload-libseccomp-tarball:
-    needs: release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Download libseccomp tarball and upload it to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-libseccomp-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-  publish-release:
-    needs: [ build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le, publish-multi-arch-images, upload-multi-arch-static-tarball, upload-versions-yaml, upload-cargo-vendored-tarball, upload-libseccomp-tarball ]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Publish a release
-        run: |
-          ./tools/packaging/release/release.sh publish-release
-        env:
-          GH_TOKEN: ${{ github.token }}
+          pushd $GITHUB_WORKSPACE/src/agent
+          cargo vendor >> .cargo/config
+          popd
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tarball="kata-containers-$tag-vendor.tar.gz"
+          pushd $GITHUB_WORKSPACE
+          tar -cvzf "${tarball}" src/agent/.cargo/config src/agent/vendor
+          GITHUB_TOKEN=${{ secrets.GIT_UPLOAD_TOKEN }} hub release edit -m "" -a "${tarball}" "${tag}" 
+          popd

.github/workflows/require-pr-porting-labels.yaml

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+name: Ensure PR has required porting labels
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - labeled
+      - unlabeled
+   pull_request:
+     branches:
+      - main
+
+jobs:
+  check-pr-porting-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install hub
+        run: |
+          HUB_ARCH="amd64"
+          HUB_VER=$(curl -sL "https://api.github.com/repos/github/hub/releases/latest" |\
+            jq -r .tag_name | sed 's/^v//')
+          curl -sL \
+            "https://github.com/github/hub/releases/download/v${HUB_VER}/hub-linux-${HUB_ARCH}-${HUB_VER}.tgz" |\
+          tar xz --strip-components=2 --wildcards '*/bin/hub' && \
+          sudo install hub /usr/local/bin
+
+      - name: Checkout code to allow hub to communicate with the project
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.KATA_GITHUB_ACTIONS_TOKEN }}
+
+      - name: Install porting checker script
+        run: |
+          # Clone into a temporary directory to avoid overwriting
+          # any existing github directory.
+          pushd $(mktemp -d) &>/dev/null
+          git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
+          sudo install pr-porting-checks.sh /usr/local/bin
+          popd &>/dev/null
+
+      - name: Stop PR being merged unless it has a correct set of porting labels
+        env:
+          GITHUB_TOKEN: ${{ secrets.KATA_GITHUB_ACTIONS_TOKEN }}
+        run: |
+          pr=${{ github.event.number }}
+          repo=${{ github.repository }}
+
+          pr-porting-checks.sh "$pr" "$repo"

.github/workflows/run-cri-containerd-tests-ppc64le.yaml

@@ -1,67 +0,0 @@
-name: CI | Run cri-containerd tests on ppc64le
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['qemu']
-    runs-on: ppc64le
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - name: Adjust a permission for repo
-        run: sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-  
-      - name: Prepare the self-hosted runner
-        run: |
-          bash ${HOME}/scripts/prepare_runner.sh cri-containerd
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-      
-      - name: Cleanup actions for the self hosted runner
-        run: ${HOME}/scripts/cleanup_runner.sh

.github/workflows/run-cri-containerd-tests-s390x.yaml

@@ -1,63 +0,0 @@
-name: CI | Run cri-containerd tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['qemu', 'qemu-runtime-rs']
-    runs-on: s390x-large
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-      - name: Take a post-action for self-hosted runner
-        if: always()
-        run: ${HOME}/script/post_action.sh ubuntu-2204

.github/workflows/run-k8s-tests-on-aks.yaml

@@ -1,123 +0,0 @@
-name: CI | Run kubernetes tests on AKS
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        host_os:
-          - ubuntu
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - stratovirt
-          - cloud-hypervisor
-        instance-type:
-          - small
-          - normal
-        include:
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: small
-            genpolicy-pull-method: oci-distribution
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: small
-            genpolicy-pull-method: containerd
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: normal
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
-      GENPOLICY_PULL_METHOD: ${{ matrix.genpolicy-pull-method }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
-
-      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

.github/workflows/run-k8s-tests-on-garm.yaml

@@ -1,100 +0,0 @@
-name: CI | Run kubernetes tests on GARM
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh #cloud-hypervisor
-          - dragonball
-          - fc #firecracker
-          - qemu
-          - cloud-hypervisor
-        snapshotter:
-          - devmapper
-        k8s:
-          - k3s
-        instance:
-          - garm-ubuntu-2004
-          - garm-ubuntu-2004-smaller
-        include:
-          - instance: garm-ubuntu-2004
-            instance-type: normal
-          - instance: garm-ubuntu-2004-smaller
-            instance-type: small
-    runs-on: ${{ matrix.instance }}
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy ${{ matrix.k8s }}
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Configure the ${{ matrix.snapshotter }} snapshotter
-        run: bash tests/integration/kubernetes/gha-run.sh configure-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-garm
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-  
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-  
-      - name: Collect artifacts ${{ matrix.vmm }}
-        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
-
-      - name: Archive artifacts ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: k8s-tests-garm-${{ matrix.vmm }}-${{ matrix.snapshotter }}-${{ matrix.k8s }}-${{ matrix.instance }}-${{ inputs.tag }}
-          path: /tmp/artifacts
-          retention-days: 1
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-garm

.github/workflows/run-k8s-tests-on-ppc64le.yaml

@@ -1,82 +0,0 @@
-name: CI | Run kubernetes tests on Power(ppc64le)
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        k8s:
-          - kubeadm
-    runs-on: k8s-ppc64le
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      USING_NFD: "false"
-      TARGET_ARCH: "ppc64le"
-    steps:
-      - name: Prepare the self-hosted runner
-        run: | 
-          bash ${HOME}/scripts/prepare_runner.sh kubernetes
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install golang
-        run: |
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> $GITHUB_PATH
-
-      - name: Prepare the runner for k8s cluster creation
-        run: bash ${HOME}/scripts/k8s_cluster_cleanup.sh
-
-      - name: Create k8s cluster using kubeadm
-        run: bash ${HOME}/scripts/k8s_cluster_create.sh
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-kubeadm
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete cluster and post cleanup actions
-        run: bash ${HOME}/scripts/k8s_cluster_cleanup.sh

.github/workflows/run-k8s-tests-on-zvsi.yaml

@@ -1,93 +0,0 @@
-name: CI | Run kubernetes tests on IBM Cloud Z virtual server instance (zVSI)
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        snapshotter:
-          - devmapper
-          - nydus
-        k8s:
-          - k3s
-        include:
-          - snapshotter: devmapper
-            pull-type: default
-            using-nfd: true
-            deploy-cmd: configure-snapshotter
-          - snapshotter: nydus
-            pull-type: guest-pull
-            using-nfd: false
-            deploy-cmd: deploy-snapshotter
-    runs-on: s390x-large
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: "ubuntu"
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "k3s"
-      PULL_TYPE: ${{ matrix.pull-type }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: ${{ matrix.using-nfd }}
-      TARGET_ARCH: "s390x"
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy ${{ matrix.k8s }}
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Configure the ${{ matrix.snapshotter }} snapshotter
-        run: bash tests/integration/kubernetes/gha-run.sh ${{ matrix.deploy-cmd }}
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-zvsi
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Take a post-action
-        if: always()
-        run: |
-          bash tests/integration/kubernetes/gha-run.sh cleanup-zvsi || true
-          ${HOME}/script/post_action.sh ubuntu-2204

.github/workflows/run-k8s-tests-with-crio-on-garm.yaml

@@ -1,86 +0,0 @@
-name: CI | Run kubernetes tests, using CRI-O, on GARM
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        k8s:
-          - k0s
-        instance:
-          - garm-ubuntu-2204
-          - garm-ubuntu-2204-smaller
-        include:
-          - instance: garm-ubuntu-2204
-            instance-type: normal
-          - instance: garm-ubuntu-2204-smaller
-            instance-type: small
-          - k8s: k0s
-            k8s-extra-params: '--cri-socket remote:unix:///var/run/crio/crio.sock --kubelet-extra-args --cgroup-driver="systemd"'
-    runs-on: ${{ matrix.instance }}
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      KUBERNETES_EXTRA_PARAMS: ${{ matrix.k8s-extra-params }}
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Configure CRI-O
-        run: bash tests/integration/kubernetes/gha-run.sh setup-crio
-
-      - name: Deploy ${{ matrix.k8s }}
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-garm
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-  
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-  
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-garm

.github/workflows/run-kata-coco-tests.yaml

@@ -1,275 +0,0 @@
-name: CI | Run kata coco tests
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests-on-tdx:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-tdx
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: tdx
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "k3s"
-      USING_NFD: "true"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-tdx
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-tdx
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-  run-k8s-tests-on-sev:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-sev
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: sev
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBECONFIG: /home/kata/.kube/config
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-sev
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-sev
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-  run-k8s-tests-sev-snp:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-snp
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: sev-snp
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBECONFIG: /home/kata/.kube/config
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-snp
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snp
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-  # Generate jobs for testing CoCo on non-TEE environments
-  run-k8s-tests-coco-nontee:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-coco-dev
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      # Some tests rely on that variable to run (or not)
-      KBS: "true"
-      # Set the KBS ingress handler (empty string disables handling)
-      KBS_INGRESS: "aks"
-      KUBERNETES: "vanilla"
-      PULL_TYPE: ${{ matrix.pull-type }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

.github/workflows/run-kata-deploy-tests-on-aks.yaml

@@ -1,90 +0,0 @@
-name: CI | Run kata-deploy tests on AKS
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-kata-deploy-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        host_os:
-          - ubuntu
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-        include:
-          - host_os: cbl-mariner
-            vmm: clh
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Download Azure CLI
-        run: bash tests/functional/kata-deploy/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/functional/kata-deploy/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        timeout-minutes: 10
-        run: bash tests/functional/kata-deploy/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/functional/kata-deploy/gha-run.sh get-cluster-credentials
-
-      - name: Run tests
-        run: bash tests/functional/kata-deploy/gha-run.sh run-tests
-      
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/functional/kata-deploy/gha-run.sh delete-cluster

.github/workflows/run-kata-deploy-tests-on-garm.yaml

@@ -1,65 +0,0 @@
-name: CI | Run kata-deploy tests on GARM
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-kata-deploy-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - qemu
-        k8s:
-          - k0s
-          - k3s
-          - rke2
-    runs-on: garm-ubuntu-2004-smaller
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy ${{ matrix.k8s }}
-        run:  bash tests/functional/kata-deploy/gha-run.sh deploy-k8s
-
-      - name: Install `bats`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-bats
-
-      - name: Run tests
-        run: bash tests/functional/kata-deploy/gha-run.sh run-tests

.github/workflows/run-kata-monitor-tests.yaml

@@ -1,59 +0,0 @@
-name: CI | Run kata-monitor tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-monitor:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        container_engine:
-          - crio
-          - containerd
-        include:
-          - container_engine: containerd
-            containerd_version: lts
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINER_ENGINE: ${{ matrix.container_engine }}
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/kata-monitor/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/functional/kata-monitor/gha-run.sh install-kata kata-artifacts
-
-      - name: Run kata-monitor tests
-        run: bash tests/functional/kata-monitor/gha-run.sh run

.github/workflows/run-metrics.yaml

@@ -1,94 +0,0 @@
-name: CI | Run test metrics
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  setup-kata:
-    name: Kata Setup
-    runs-on: metrics
-    env:
-      GOPATH: ${{ github.workspace }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/metrics/gha-run.sh install-kata kata-artifacts
-
-  run-metrics:
-    needs: setup-kata
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm: ['clh', 'qemu', 'stratovirt']
-      max-parallel: 1
-    runs-on: metrics
-    env:
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - name: enabling the hypervisor
-        run: bash tests/metrics/gha-run.sh enabling-hypervisor
-
-      - name: run launch times test
-        run: bash tests/metrics/gha-run.sh run-test-launchtimes
-
-      - name: run memory foot print test
-        run:  bash tests/metrics/gha-run.sh run-test-memory-usage
-
-      - name: run memory usage inside container test
-        run:  bash tests/metrics/gha-run.sh run-test-memory-usage-inside-container
-
-      - name: run blogbench test
-        run:  bash tests/metrics/gha-run.sh run-test-blogbench
-
-      - name: run tensorflow test
-        run:  bash tests/metrics/gha-run.sh run-test-tensorflow
-
-      - name: run fio test
-        run:  bash tests/metrics/gha-run.sh run-test-fio
-
-      - name: run iperf test
-        run:  bash tests/metrics/gha-run.sh run-test-iperf
-
-      - name: run latency test
-        run:  bash tests/metrics/gha-run.sh run-test-latency
-
-      - name: make metrics tarball ${{ matrix.vmm }}
-        run: bash tests/metrics/gha-run.sh make-tarball-results
-
-      - name: archive metrics results ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: metrics-artifacts-${{ matrix.vmm }}
-          path: results-${{ matrix.vmm }}.tar.gz
-          retention-days: 1
-          if-no-files-found: error

.github/workflows/run-runk-tests.yaml

@@ -1,46 +0,0 @@
-name: CI | Run runk tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-runk:
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: lts
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/runk/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
-
-      - name: Run runk tests
-        run: bash tests/integration/runk/gha-run.sh run

.github/workflows/snap-release.yaml

@@ -0,0 +1,39 @@
+name: Release Kata 2.x in snapcraft store
+on:
+  push:
+    tags:
+      - '2.*'
+jobs:
+  release-snap:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install Snapcraft
+        uses: samuelmeuli/action-snapcraft@v1
+        with:
+          snapcraft_token: ${{ secrets.snapcraft_token }}
+
+      - name: Build snap
+        run: |
+          sudo apt-get install -y git git-extras
+          kata_url="https://github.com/kata-containers/kata-containers"
+          latest_version=$(git ls-remote --tags ${kata_url}  | egrep -o "refs.*" | egrep -v "\-alpha|\-rc|{}" | egrep -o "[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+" | sort -V -r | head -1)
+          current_version="$(echo ${GITHUB_REF} | cut -d/ -f3)"
+          # Check semantic versioning format (x.y.z) and if the current tag is the latest tag
+          if echo "${current_version}" | grep -q "^[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+$" && echo -e "$latest_version\n$current_version" | sort -C -V; then
+            # Current version is the latest version, build it
+            snapcraft -d snap --destructive-mode
+          fi
+
+      - name: Upload snap
+        run: |
+          snap_version="$(echo ${GITHUB_REF} | cut -d/ -f3)"
+          snap_file="kata-containers_${snap_version}_amd64.snap"
+          # Upload the snap if it exists
+          if [ -f ${snap_file} ]; then
+            snapcraft upload --release=stable ${snap_file}
+          fi

.github/workflows/snap.yaml

@@ -0,0 +1,17 @@
+name: snap CI
+on: ["pull_request"]
+jobs:
+  test:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Check out
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install Snapcraft
+        uses: samuelmeuli/action-snapcraft@v1
+
+      - name: Build snap
+        run: |
+          snapcraft -d snap --destructive-mode

.github/workflows/stale.yaml

@@ -1,17 +0,0 @@
-name: 'Automatically close stale PRs'
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v9
-        with:
-          stale-pr-message: 'This PR has been opened without with no activity for 180 days. Comment on the issue otherwise it will be closed in 7 days'
-          days-before-pr-stale: 180
-          days-before-pr-close: 7
-          days-before-issue-stale: -1
-          days-before-issue-close: -1

.github/workflows/static-checks-self-hosted.yaml

@@ -1,26 +0,0 @@
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - labeled # a workflow runs only when the 'ok-to-test' label is added
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-name: Static checks self-hosted
-jobs:
-  build-checks:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}
-    strategy:
-      fail-fast: false
-      matrix:
-        instance:
-          - "arm-no-k8s"
-          - "s390x"
-          - "ppc64le"
-    uses: ./.github/workflows/build-checks.yaml
-    with:
-      instance: ${{ matrix.instance }}

.github/workflows/static-checks.yaml

@@ -5,107 +5,82 @@ on:
       - edited
       - reopened
       - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+      - labeled
+      - unlabeled
 
 name: Static checks
 jobs:
-  check-kernel-config-version:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Ensure the kernel config version has been updated
-        run: |
-          kernel_dir="tools/packaging/kernel/"
-          kernel_version_file="${kernel_dir}kata_config_version"
-          modified_files=$(git diff --name-only origin/$GITHUB_BASE_REF..HEAD)
-          if git diff --name-only origin/$GITHUB_BASE_REF..HEAD "${kernel_dir}" | grep "${kernel_dir}"; then
-            echo "Kernel directory has changed, checking if $kernel_version_file has been updated"
-            if echo "$modified_files" | grep -v "README.md" | grep "${kernel_dir}" >>"/dev/null"; then
-              echo "$modified_files" | grep "$kernel_version_file" >>/dev/null || ( echo "Please bump version in $kernel_version_file" && exit 1)
-            else
-              echo "Readme file changed, no need for kernel config version update."
-            fi
-            echo "Check passed"
-          fi
-
-  build-checks:
-    uses: ./.github/workflows/build-checks.yaml
-    with:
-      instance: ubuntu-20.04
-
-  build-checks-depending-on-kvm:
-    runs-on: garm-ubuntu-2004-smaller
+  test:
     strategy:
-      fail-fast: false
       matrix:
-        component:
-          - runtime-rs
-        include:
-          - component: runtime-rs
-            command: "sudo -E env PATH=$PATH LIBC=gnu SUPPORT_VIRTUALIZATION=true make test"
-          - component: runtime-rs
-            component-path: src/dragonball
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Install system deps
-        run: |
-          sudo apt-get install -y build-essential musl-tools
-      - name: Install yq
-        run: |
-          sudo -E ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install rust
-        run: |
-          export PATH="$PATH:/usr/local/bin"
-          ./tests/install_rust.sh
-      - name: Running `${{ matrix.command }}` for ${{ matrix.component }}
-        run: |
-          export PATH="$PATH:${HOME}/.cargo/bin"
-          cd ${{ matrix.component-path }}
-          ${{ matrix.command }}
-        env:
-          RUST_BACKTRACE: "1"
-
-  static-checks:
-    runs-on: ubuntu-20.04
-    strategy:
-      fail-fast: false
-      matrix:
-        cmd:
-          - "make static-checks"
+        go-version: [1.15.x, 1.16.x]
+        os: [ubuntu-20.04]
+    runs-on: ${{ matrix.os }}
     env:
-      GOPATH: ${{ github.workspace }}
+      TRAVIS: "true"
+      TRAVIS_BRANCH: ${{ github.base_ref }}
+      TRAVIS_PULL_REQUEST_BRANCH: ${{ github.head_ref }}
+      TRAVIS_PULL_REQUEST_SHA : ${{ github.event.pull_request.head.sha }}
+      RUST_BACKTRACE: "1"
+      target_branch: ${{ github.base_ref }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          path: ./src/github.com/${{ github.repository }}
-      - name: Install yq
-        run: |
-          cd ${GOPATH}/src/github.com/${{ github.repository }}
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install golang
-        run: |
-          cd ${GOPATH}/src/github.com/${{ github.repository }}
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> $GITHUB_PATH
-      - name: Install system dependencies
-        run: |
-          sudo apt-get -y install moreutils hunspell hunspell-en-gb hunspell-en-us pandoc
-      - name: Run check
-        run: |
-          export PATH=${PATH}:${GOPATH}/bin
-          cd ${GOPATH}/src/github.com/${{ github.repository }} && ${{ matrix.cmd }}
+    - name: Install Go
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go-version }}
+      env:
+        GOPATH: ${{ runner.workspace }}/kata-containers
+    - name: Setup GOPATH
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "TRAVIS_BRANCH: ${TRAVIS_BRANCH}"
+        echo "TRAVIS_PULL_REQUEST_BRANCH: ${TRAVIS_PULL_REQUEST_BRANCH}"
+        echo "TRAVIS_PULL_REQUEST_SHA: ${TRAVIS_PULL_REQUEST_SHA}"
+        echo "TRAVIS: ${TRAVIS}"
+    - name: Set env
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
+        echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+    - name: Checkout code
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+        path: ./src/github.com/${{ github.repository }}
+    - name: Setup travis references
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "TRAVIS_BRANCH=${TRAVIS_BRANCH:-$(echo $GITHUB_REF | awk 'BEGIN { FS = \"/\" } ; { print $3 }')}"
+        target_branch=${TRAVIS_BRANCH}
+    - name: Setup
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/setup.sh
+      env:
+        GOPATH: ${{ runner.workspace }}/kata-containers
+    - name: Building rust
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/install_rust.sh
+        PATH=$PATH:"$HOME/.cargo/bin"
+        rustup target add x86_64-unknown-linux-musl
+        rustup component add rustfmt clippy
+    # Check whether the vendored code is up-to-date & working as the first thing
+    - name: Check vendored code
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make vendor
+    - name: Static Checks
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make static-checks
+    - name: Run Compiler Checks
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make check
+    - name: Run Unit Tests
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make test

.gitignore

@@ -4,15 +4,9 @@
 **/*.rej
 **/target
 **/.vscode
-**/.idea
-**/.fleet
-**/*.swp
-**/*.swo
 pkg/logging/Cargo.lock
 src/agent/src/version.rs
 src/agent/kata-agent.service
 src/agent/protocols/src/*.rs
 !src/agent/protocols/src/lib.rs
-build
-src/tools/log-parser/kata-log-parser
-tools/packaging/static-build/agent/install_libseccomp.sh
+

CODEOWNERS

@@ -1,4 +1,4 @@
-# Copyright (c) 2019-2023 Intel Corporation
+# Copyright (c) 2019 Intel Corporation
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -9,83 +9,4 @@
 # Order in this file is important. Only the last match will be
 # used. See https://help.github.com/articles/about-code-owners/
 
-/CODEOWNERS			@kata-containers/codeowners
-
-VERSION				@kata-containers/release
-
-# The versions database needs careful handling
-versions.yaml			@kata-containers/release @kata-containers/ci @kata-containers/tests
-
-Makefile*			@kata-containers/build
-*.mak				@kata-containers/build
-*.mk				@kata-containers/build
-
-# Documentation related files could also appear anywhere
-# else in the repo.
-*.md				@kata-containers/documentation
-*.drawio			@kata-containers/documentation
-*.jpg				@kata-containers/documentation
-*.png				@kata-containers/documentation
-*.svg				@kata-containers/documentation
-
-*.bash				@kata-containers/shell
-*.sh				@kata-containers/shell
-**/completions/			@kata-containers/shell
-
-Dockerfile*			@kata-containers/docker
-
-/ci/				@kata-containers/ci
-
-*.bats				@kata-containers/tests
-/tests/				@kata-containers/tests
-
-*.rs				@kata-containers/rust
-*.go				@kata-containers/golang
-
-/utils/				@kata-containers/utils
-
-# FIXME: Maybe a new "protocol" team would be better?
-#
-# All protocol changes must be reviewed.
-# Note, we include all subdirs, including the vendor dir, as at present there are no .proto files
-# in the vendor dir. Later we may have to extend this matching rule if that changes.
-/src/libs/protocols/*.proto	@kata-containers/architecture-committee @kata-containers/builder @kata-containers/packaging
-
-# GitHub Actions
-/.github/workflows/		@kata-containers/action-admins @kata-containers/ci
-
-/ci/				@kata-containers/ci @kata-containers/tests
-/docs/				@kata-containers/documentation
-
-/src/agent/			@kata-containers/agent
-
-/src/runtime*/			@kata-containers/runtime
-
-/src/runtime/			@kata-containers/golang
-
-src/runtime-rs/			@kata-containers/rust
-src/libs/			@kata-containers/rust
-
-src/dragonball/			@kata-containers/dragonball
-
-/tools/osbuilder/		@kata-containers/builder
-/tools/packaging/		@kata-containers/packaging
-/tools/packaging/kernel/	@kata-containers/kernel
-/tools/packaging/kata-deploy/	@kata-containers/kata-deploy
-/tools/packaging/qemu/		@kata-containers/qemu
-/tools/packaging/release/	@kata-containers/release
-
-**/vendor/			@kata-containers/vendoring
-
-# Handle arch specific files last so they match more specifically than
-# the kernel packaging files.
-**/*aarch64*			@kata-containers/arch-aarch64
-**/*arm64*			@kata-containers/arch-aarch64
-
-**/*amd64*			@kata-containers/arch-amd64
-**/*x86-64*			@kata-containers/arch-amd64
-**/*x86_64*			@kata-containers/arch-amd64
-
-**/*ppc64*			@kata-containers/arch-ppc64le
-
-**/*s390x*			@kata-containers/arch-s390x
+*.md    @kata-containers/documentation

CONTRIBUTING.md

@@ -2,4 +2,4 @@
 
 ## This repo is part of [Kata Containers](https://katacontainers.io)
 
-For details on how to contribute to the Kata Containers project, please see the main [contributing document](https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md).
+For details on how to contribute to the Kata Containers project, please see the main [contributing document](https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md).

Glossary.md

@@ -1,3 +1,94 @@
 # Glossary
 
-See the [project glossary hosted in the wiki](https://github.com/kata-containers/kata-containers/wiki/Glossary).
+[A](#a), [B](#b), [C](#c), [D](#d), [E](#e), [F](#f), [G](#g), [H](#h), [I](#i), [J](#j), [K](#k), [L](#l), [M](#m), [N](#n), [O](#o), [P](#p), [Q](#q), [R](#r), [S](#s), [T](#t), [U](#u), [V](#v), [W](#w), [X](#x), [Y](#y), [Z](#z)
+
+## A
+
+### Auto Scaling
+a method used in cloud computing, whereby the amount of computational resources in a server farm, typically measured in terms of the number of active servers, which vary automatically based on the load on the farm.
+
+## B
+
+## C
+
+### Container Security Solutions
+The process of implementing security tools and policies that will give you the assurance that everything in your container is running as intended, and only as intended.
+
+### Container Software
+A standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another.
+
+### Container Runtime Interface
+A plugin interface which enables Kubelet to use a wide variety of container runtimes, without the need to recompile.
+
+### Container Virtualization
+A container is a virtual runtime environment that runs on top of a single operating system (OS) kernel and emulates an operating system rather than the underlying hardware.
+
+## D
+
+## E
+
+## F
+
+## G
+
+## H
+
+## I
+
+### Infrastructure Architecture
+A structured and modern approach for supporting an organization and facilitating innovation within an enterprise.
+
+## J
+
+## K
+
+### Kata Containers
+Kata containers is an open source project delivering increased container security and Workload isolation through an implementation of lightweight virtual machines.
+
+## L
+
+## M
+
+## N
+
+## O
+
+## P
+
+### Pod Containers
+A Group of one or more containers , with shared storage/network, and a specification for how to run the containers.
+
+### Private Cloud
+A computing model that offers a proprietary environment dedicated to a single business entity.
+
+### Public Cloud
+Computing services offered by third-party providers over the public Internet, making them available to anyone who wants to use or purchase them.
+
+## Q
+
+## R
+
+## S
+
+### Serverless Containers
+An architecture in which code is executed on-demand. Serverless workloads are typically in the cloud, but on-premises serverless platforms exist, too.
+
+## T
+
+## U
+
+## V
+
+### Virtual Machine Monitor
+Computer software, firmware or hardware that creates and runs virtual machines.
+
+### Virtual Machine Software
+A software program or operating system that not only exhibits the behavior of a separate computer, but is also capable of performing tasks such as running applications and programs like a separate computer.
+
+## W
+
+## X
+
+## Y
+
+## Z

Makefile

@@ -1,4 +1,4 @@
-# Copyright (c) 2020-2023 Intel Corporation
+# Copyright (c) 2020 Intel Corporation
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -6,31 +6,20 @@
 # List of available components
 COMPONENTS =
 
-COMPONENTS += libs
 COMPONENTS += agent
-COMPONENTS += dragonball
 COMPONENTS += runtime
-COMPONENTS += runtime-rs
+COMPONENTS += trace-forwarder
 
 # List of available tools
 TOOLS =
 
 TOOLS += agent-ctl
-TOOLS += kata-ctl
-TOOLS += log-parser
-TOOLS += runk
-TOOLS += trace-forwarder
 
-STANDARD_TARGETS = build check clean install static-checks-build test vendor
-
-# Variables for the build-and-publish-kata-debug target
-KATA_DEBUG_REGISTRY ?= ""
-KATA_DEBUG_TAG ?= ""
-
-default: all
+STANDARD_TARGETS = build check clean install test vendor
 
 include utils.mk
-include ./tools/packaging/kata-deploy/local-build/Makefile
+
+all: build
 
 # Create the rules
 $(eval $(call create_all_rules,$(COMPONENTS),$(TOOLS),$(STANDARD_TARGETS)))
@@ -41,19 +30,13 @@ generate-protocols:
 	make -C src/agent generate-protocols
 
 # Some static checks rely on generated source files of components.
-static-checks: static-checks-build
-	bash tests/static-checks.sh github.com/kata-containers/kata-containers
+static-checks: build
+	bash ci/static-checks.sh
 
-docs-url-alive-check:
-	bash ci/docs-url-alive-check.sh
+binary-tarball:
+	make -f ./tools/packaging/kata-deploy/local-build/Makefile
 
-build-and-publish-kata-debug:
-	bash tools/packaging/kata-debug/kata-debug-build-and-upload-payload.sh ${KATA_DEBUG_REGISTRY} ${KATA_DEBUG_TAG} 
+install-binary-tarball:
+	make -f ./tools/packaging/kata-deploy/local-build/Makefile install
 
-.PHONY: \
-	all \
-	kata-tarball \
-	install-tarball \
-	default \
-	static-checks \
-	docs-url-alive-check
+.PHONY: all default static-checks binary-tarball install-binary-tarball

README.md

@@ -1,6 +1,4 @@
-<img src="https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/kata/SVG/kata-1.svg" width="900">
-
-[![CI | Publish Kata Containers payload](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml) [![Kata Containers Nightly CI](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml)
+<img src="https://www.openstack.org/assets/kata/kata-vertical-on-white.png" width="150">
 
 # Kata Containers
 
@@ -19,74 +17,16 @@ standard implementation of lightweight Virtual Machines (VMs) that feel and
 perform like containers, but provide the workload isolation and security
 advantages of VMs.
 
-## License
-
-The code is licensed under the Apache 2.0 license.
-See [the license file](LICENSE) for further details.
-
-## Platform support
-
-Kata Containers currently runs on 64-bit systems supporting the following
-technologies:
-
-| Architecture | Virtualization technology |
-|-|-|
-| `x86_64`, `amd64` | [Intel](https://www.intel.com) VT-x, AMD SVM |
-| `aarch64` ("`arm64`")| [ARM](https://www.arm.com) Hyp |
-| `ppc64le` | [IBM](https://www.ibm.com) Power |
-| `s390x` | [IBM](https://www.ibm.com) Z & LinuxONE SIE |
-
-### Hardware requirements
-
-The [Kata Containers runtime](src/runtime) provides a command to
-determine if your host system is capable of running and creating a
-Kata Container:
-
-```bash
-$ kata-runtime check
-```
-
-> **Notes:**
->
-> - This command runs a number of checks including connecting to the
->   network to determine if a newer release of Kata Containers is
->   available on GitHub. If you do not wish this to check to run, add
->   the `--no-network-checks` option.
->
-> - By default, only a brief success / failure message is printed.
->   If more details are needed, the `--verbose` flag can be used to display the
->   list of all the checks performed.
->
-> - If the command is run as the `root` user additional checks are
->   run (including checking if another incompatible hypervisor is running).
->   When running as `root`, network checks are automatically disabled.
-
 ## Getting started
 
 See the [installation documentation](docs/install).
 
 ## Documentation
 
-See the [official documentation](docs) including:
-
-- [Installation guides](docs/install)
-- [Developer guide](docs/Developer-Guide.md)
-- [Design documents](docs/design)
-  - [Architecture overview](docs/design/architecture)
-  - [Architecture 3.0 overview](docs/design/architecture_3.0/)
-
-## Configuration
-
-Kata Containers uses a single
-[configuration file](src/runtime/README.md#configuration)
-which contains a number of sections for various parts of the Kata
-Containers system including the [runtime](src/runtime), the
-[agent](src/agent) and the [hypervisor](#hypervisors).
-
-## Hypervisors
-
-See the [hypervisors document](docs/hypervisors.md) and the
-[Hypervisor specific configuration details](src/runtime/README.md#hypervisor-specific-configuration).
+See the [official documentation](docs)
+(including [installation guides](docs/install),
+[the developer guide](docs/Developer-Guide.md),
+[design documents](docs/design) and more).
 
 ## Community
 
@@ -108,8 +48,6 @@ Please raise an issue
 
 ## Developers
 
-See the [developer guide](docs/Developer-Guide.md).
-
 ### Components
 
 ### Main components
@@ -119,11 +57,9 @@ The table below lists the core parts of the project:
 | Component | Type | Description |
 |-|-|-|
 | [runtime](src/runtime) | core | Main component run by a container manager and providing a containerd shimv2 runtime implementation. |
-| [runtime-rs](src/runtime-rs) | core | The Rust version runtime. |
 | [agent](src/agent) | core | Management process running inside the virtual machine / POD that sets up the container environment. |
-| [`dragonball`](src/dragonball) | core | An optional built-in VMM brings out-of-the-box Kata Containers experience with optimizations on container workloads |
 | [documentation](docs) | documentation | Documentation common to all components (such as design and install documentation). |
-| [tests](tests) | tests | Excludes unit tests which live with the main code. |
+| [tests](https://github.com/kata-containers/tests) | tests | Excludes unit tests which live with the main code. |
 
 ### Additional components
 
@@ -134,28 +70,22 @@ The table below lists the remaining parts of the project:
 | [packaging](tools/packaging) | infrastructure | Scripts and metadata for producing packaged binaries<br/>(components, hypervisors, kernel and rootfs). |
 | [kernel](https://www.kernel.org) | kernel | Linux kernel used by the hypervisor to boot the guest image. Patches are stored [here](tools/packaging/kernel). |
 | [osbuilder](tools/osbuilder) | infrastructure | Tool to create "mini O/S" rootfs and initrd images and kernel for the hypervisor. |
-| [kata-debug](tools/packaging/kata-debug/README.md) | infrastructure | Utility tool to gather Kata Containers debug information from Kubernetes clusters. |
-| [`agent-ctl`](src/tools/agent-ctl) | utility | Tool that provides low-level access for testing the agent. |
-| [`kata-ctl`](src/tools/kata-ctl) | utility | Tool that provides advanced commands and debug facilities. |
-| [`trace-forwarder`](src/tools/trace-forwarder) | utility | Agent tracing helper. |
-| [`runk`](src/tools/runk) | utility | Standard OCI container runtime based on the agent. |
-| [`ci`](.github/workflows) | CI | Continuous Integration configuration files and scripts. |
+| [`agent-ctl`](tools/agent-ctl) | utility | Tool that provides low-level access for testing the agent. |
+| [`trace-forwarder`](src/trace-forwarder) | utility | Agent tracing helper. |
+| [`ci`](https://github.com/kata-containers/ci) | CI | Continuous Integration configuration files and scripts. |
 | [`katacontainers.io`](https://github.com/kata-containers/www.katacontainers.io) | Source for the [`katacontainers.io`](https://www.katacontainers.io) site. |
-| [`Webhook`](tools/testing/kata-webhook/README.md) | utility | Example of a simple admission controller webhook to annotate pods with the Kata runtime class |
 
 ### Packaging and releases
 
 Kata Containers is now
 [available natively for most distributions](docs/install/README.md#packaged-installation-methods).
-
-## General tests
-
-See the [tests documentation](tests/README.md).
-
-## Metrics tests
-
-See the [metrics documentation](tests/metrics/README.md).
+However, packaging scripts and metadata are still used to generate snap and GitHub releases. See
+the [components](#components) section for further details.
 
 ## Glossary of Terms
 
-See the [glossary of terms](https://github.com/kata-containers/kata-containers/wiki/Glossary) related to Kata Containers.
+See the [glossary of terms](Glossary.md) related to Kata Containers.
+---
+
+[kernel]: https://www.kernel.org
+[github-katacontainers.io]: https://github.com/kata-containers/www.katacontainers.io

VERSION

@@ -1 +1 @@
-3.5.0
+2.2.1

ci/README.md

@@ -1,343 +0,0 @@
-# Kata Containers CI
-
-> [!WARNING]
-> While this project's CI has several areas for improvement, it is constantly
-> evolving. This document attempts to describe its current state, but due to
-> ongoing changes, you may notice some outdated information here. Feel free to
-> modify/improve this document as you use the CI and notice anything odd. The
-> community appreciates it!
-
-## Introduction
-
-The Kata Containers CI relies on [GitHub Actions][gh-actions], where the actions
-themselves can be found in the `.github/workflows` directory, and they may call
-helper scripts, which are located under the `tests` directory, to actually
-perform the tasks required for each test case.
-
-## The different workflows
-
-There are a few different sets of workflows that are running as part of our CI,
-and here we're going to cover the ones that are less likely to get rotten.  With
-this said, it's fair to advise that if the reader finds something that got
-rotten, opening an issue to the project pointing to the problem is a nice way to
-help, and providing a fix for the issue is a very encouraging way to help.
-
-### Jobs that run automatically when a PR is raised
-
-These are a bunch of tests that will automatically run as soon as a PR is
-opened, they're mostly running on "cost free" runners, and they do some
-pre-checks to evaluate that your PR may be okay to start getting reviewed.
-
-Mind, though, that the community expects the contributors to, at least, build
-their code before submitting a PR, which the community sees as a very fair
-request.
-
-Without getting into the weeds with details on this, those jobs are the ones
-responsible for ensuring that:
-
-- The commit message is in the expected format
-- There's no missing Developer's Certificate of Origin
-- Static checks are passing
-
-### Jobs that require a maintainer's approval to run
-
-These are the required tests, and our so-called "CI".  These require a
-maintainer's approval to run as parts of those jobs will be running on "paid
-runners", which are currently using Azure infrastructure.
-
-Once a maintainer of the project gives "the green light" (currently by adding an
-`ok-to-test` label to the PR, soon to be changed to commenting "/test" as part
-of a PR review), the following tests will be executed:
-
-- Build all the components (runs on free cost runners, or bare-metal depending on the architecture)
-- Create a tarball with all the components (runs on free cost runners, or bare-metal depending on the architecture)
-- Create a kata-deploy payload with the tarball generated in the previous step (runs on free costs runner, or bare-metal depending on the architecture)
-- Run the following tests:
-  - Tests depending on the generated tarball
-    - Metrics (runs on bare-metal)
-    - `docker` (runs on Azure small instances)
-    - `nerdctl` (runs on Azure small instances)
-    - `kata-monitor` (runs on Azure small instances)
-    - `cri-containerd` (runs on Azure small instances)
-    - `nydus` (runs on Azure small instances)
-    - `vfio` (runs on Azure normal instances)
-  - Tests depending on the generated kata-deploy payload
-    - kata-deploy (runs on Azure small instances)
-      - Tests are performed using different "Kubernetes flavors", such as k0s, k3s, rke2, and Azure Kubernetes Service (AKS).
-    - Kubernetes (runs in Azure small and medium instances depending on what's required by each test, and on TEE bare-metal machines)
-      - Tests are performed with different runtime engines, such as CRI-O and containerd.
-      - Tests are performed with different snapshotters for containerd, namely OverlayFS and devmapper.
-      - Tests are performed with all the supported hypervisors, which are Cloud Hypervisor, Dragonball, Firecracker, and QEMU.
-
-For all the tests relying on Azure instances, real money is being spent, so the
-community asks for the maintainers to be mindful about those, and avoid abusing
-them to merely debug issues.
-
-## The different runners
-
-In the previous section we've mentioned using different runners, now in this section we'll go through each type of runner used.
-
-- Cost free runners:  Those are the runners provided by GIthub itself, and
-  those are fairly small machines with no virtualization capabilities enabled - 
-- Azure small instances: Those are runners which have virtualization
-  capabilities enabled, 2 CPUs, and 8GB of RAM.  These runners have a "-smaller"
-  suffix to their name. 
-- Azure normal instances: Those are runners which have virtualization
-  capabilities enabled, 4 CPUs, and 16GB of RAM.  These runners are usually
-  `garm` ones with no "-smaller" suffix.
-- Bare-metal runners: Those are runners provided by community contributors,
-  and they may vary in architecture, size and virtualization capabilities.
-  Builder runners don't actually require any virtualization capabilities, while
-  runners which will be actually performing the tests must have virtualization
-  capabilities and a reasonable amount for CPU and RAM available (at least
-  matching the Azure normal instances).
-  
-## Adding new tests
-
-Before someone decides to add a new test, we strongly recommend them to go
-through [GitHub Actions Documentation][gh-actions],
-which will provide you a very sensible background on how to read and understand
-current tests we have, and also become familiar with how to write a new test.
-
-On the Kata Containers land, there are basically two sets of tests: "standalone"
-and "part of something bigger".
-
-The "standalone" tests, for example the commit message check, won't be covered
-here as they're better covered by the GitHub Actions documentation pasted above.
-
-The "part of something bigger" is the more complicated one and not so
-straightforward to add, so we'll be focusing our efforts on describing the
-addition of those.
-
-> [!NOTE]
-> TODO: Currently, this document refers to "tests" when it actually means the
-> jobs (or workflows) of GitHub. In an ideal world, except in some specific cases,
-> new tests should be added without the need to add new workflows. In the
-> not-too-distant future (hopefully), we will improve the workflows to support
-> this.
-
-### Adding a new test that's "part of something bigger"
-
-The first important thing here is to align expectations, and we must say that
-the community strongly prefers receiving tests that already come with:
-
-- Instructions how to run them
-- A proven run where it's passing
-
-There are several ways to achieve those two requirements, and an example of that
-can be seen in PR #8115.
-
-With the expectations aligned, adding a test consists in:
-
-- Adding a new yaml file for your test, and ensure it's called from the
-  "bigger" yaml. See the [Kata Monitor test example][monitor-ex01].
-
-- Adding the helper scripts needed for your test to run. Again, use the [Kata Monitor script as example][monitor-ex02].
-
-Following those examples, the community advice during the review, and even
-asking the community directly on Slack are the best ways to get your test
-accepted.
-
-## Running tests
-
-### Running the tests as part of the CI
-
-If you're a maintainer of the project, you'll be able to kick in the tests by
-yourself.  With the current approach, you just need to add the `ok-to-test`
-label and the tests will automatically start.  We're moving, though, to use a
-`/test` command as part of a GitHub review comment, which will simplify this
-process.
-
-If you're not a maintainer, please, send a message on Slack or wait till one of
-the maintainers reviews your PR.  Maintainers will then kick in the tests on
-your behalf.
-
-In case a test fails and there's the suspicion it happens due to flakiness in
-the test itself, please, create an issue for us, and then re-run (or asks
-maintainers to re-run) the tests following these steps:
-
-- Locate which tests is failing
-- Click in "details"
-- In the top right corner, click in "Re-run jobs"
-- And then in "Re-run failed jobs"
-- And finally click in the green "Re-run jobs" button
-
-> [!NOTE]
-> TODO: We need figures here
-
-### Running the tests locally
-
-In this section, aligning expectations is also something very important, as one
-will not be able to run the tests exactly in the same way the tests are running
-in the CI, as one most likely won't have access to an Azure subscription.
-However, we're trying our best here to provide you with instructions on how to
-run the tests in an environment that's "close enough" and will help you to debug
-issues you find with the current tests, or even provide a proof-of-concept to
-the new test you're trying to add.
-
-The basic steps, which we will cover in details down below are:
-
- 1. Create a VM matching the configuration of the target runner
- 2. Generate the artifacts you'll need for the test, or download them from a
-    current failed run
- 3. Follow the steps provided in the action itself to run the tests.
-
-Although the general overview looks easy, we know that some tricks need to be
-shared, and we'll go through the general process of debugging one non-Kubernetes
-and one Kubernetes specific test for educational purposes.
-
-One important thing to note is that "Create a VM" can be done in innumerable
-different ways, using the tools of your choice.  For the sake of simplicity on
-this guide, we'll be using `kcli`, which we strongly recommend in case you're a
-non-experienced user, and happen to be developing on a Linux box.
-
-For both non-Kubernetes and Kubernetes cases, we'll be using PR #8070 as an
-example, which at the time this document is being written serves us very well
-the purpose, as you can see that we have `nerdctl` and Kubernetes tests failing.
-
-## Debugging tests
-
-### Debugging a non Kubernetes test
-
-As shown above, the `nerdctl` test is failing.
-
-As a developer you can go ahead to the details of the job, and expand the job
-that's failing in order to gather more information.
-
-But when that doesn't help, we need to set up our own environment to debug
-what's going on.
-
-Taking a look at the `nerdctl` test, which is located here, you can easily see
-that it runs-on a `garm-ubuntu-2304-smaller` virtual machine.
-
-The important parts to understand are `ubuntu-2304`, which is the OS where the
-test is running on; and "smaller", which means we're running it on a machine
-with 2 CPUs and 8GB of RAM.
-
-With this information, we can go ahead and create a similar VM locally using `kcli`.
-
-```bash
-$ sudo kcli create vm -i ubuntu2304 -P disks=[60] -P numcpus=2 -P memory=8192 -P cpumodel=host-passthrough debug-nerdctl-pr8070
-```
-
-In order to run the tests, you'll need the "kata-tarball" artifacts, which you
-can build your own using "make kata-tarball" (see below), or simply get them
-from the PR where the tests failed.  To download them, click on the "Summary"
-button that's on the top left corner, and then scroll down till you see the
-artifacts, as shown below.
-
-Unfortunately GitHub doesn't give us a link that we can download those from
-inside the VM, but we can download them on our local box, and then `scp` the
-tarball to the newly created VM that will be used for debugging purposes.
-
-> [!NOTE]
-> Those artifacts are only available (for 15 days) when all jobs are finished.
-
-Once you have the `kata-static.tar.xz` in your VM, you can login to the VM with
-`kcli ssh debug-nerdctl-pr8070`, go ahead and then clone your development branch
-
-```bash
-$ git clone --branch feat_add-fc-runtime-rs https://github.com/nubificus/kata-containers
-```
-
-Add the upstream as a remote, set up your git, and rebase your branch atop of the upstream main one
-
-```bash
-$ git remote add upstream https://github.com/kata-containers/kata-containers
-$ git remote update
-$ git config --global user.email "you@example.com"
-$ git config --global user.name "Your Name"
-$ git rebase upstream/main 
-```
-
-Now copy the `kata-static.tar.xz` into your `kata-containers/kata-artifacts` directory
-
-```bash
-$ mkdir kata-artifacts
-$ cp ../kata-static.tar.xz kata-artifacts/
-```
-
-> [!NOTE]
-> If you downloaded the .zip from GitHub you need to uncompress first to see `kata-static.tar.xz`
-
-And finally run the tests following what's in the yaml file for the test you're
-debugging. 
-
-In our case, the `run-nerdctl-tests-on-garm.yaml`.
-
-When looking at the file you'll notice that some environment variables are set,
-such as `KATA_HYPERVISOR`, and should be aware that, for this particular example,
-the important steps to follow are:
-
-Install the dependencies
-Install kata
-Run the tests
-
-Let's now run the steps mentioned above exporting the expected environment variables
-
-```bash
-$ export KATA_HYPERVISOR=dragonball
-$ bash ./tests/integration/nerdctl/gha-run.sh install-dependencies
-$ bash ./tests/integration/nerdctl/gha-run.sh install-kata
-$ bash tests/integration/nerdctl/gha-run.sh run
-```
-
-And with this you should've been able to reproduce exactly the same issue found
-in the CI, and from now on you can build your own code, use your own binaries,
-and have fun debugging and hacking! 
-
-### Debugging a Kubernetes test
-
-Steps for debugging the Kubernetes tests are very similar to the ones for
-debugging non-Kubernetes tests, with the caveat that what you'll need, this
-time, is not the `kata-static.tar.xz` tarball, but rather a payload to be used
-with kata-deploy.
-
-In order to generate your own kata-deploy image you can generate your own
-`kata-static.tar.xz` and then take advantage of the following script.  Be aware
-that the image generated and uploaded must be accessible by the VM where you'll
-be performing your tests.
-
-In case you want to take advantage of the payload that was already generated
-when you faced the CI failure, which is considerably easier, take a look at the
-failed job, then click in "Deploy Kata" and expand the "Final kata-deploy.yaml
-that is used in the test" section.  From there you can see exactly what you'll
-have to use when deploying kata-deploy in your local cluster.
-
-> [!NOTE]
-> TODO: WAINER TO FINISH THIS PART BASED ON HIS PR TO RUN A LOCAL CI
-
-## Adding new runners
-
-Any admin of the project is able to add or remove GitHub runners, and those are
-the folks you should rely on.
-
-If you need a new runner added, please, tag @ac in the Kata Containers slack,
-and someone from that group will be able to help you.
-
-If you're part of that group and you're looking for information on how to help
-someone, this is simple, and must be done in private. Basically what you have to
-do is:
-
-- Go to the kata-containers/kata-containers repo
-- Click on the Settings button, located in the top right corner
-- On the left panel, under "Code and automation", click on "Actions"
-- Click on "Runners"
-
-If you want to add a new self-hosted runner:
-
-- In the top right corner there's a green button called "New self-hosted runner"
-
-If you want to remove a current self-hosted runner:
-
-- For each runner there's a "..." menu, where you can just click and the
-  "Remove runner" option will show up
-  
-## Known limitations
-
-As the GitHub actions are structured right now we cannot: Test the addition of a
-GitHub action that's not triggered by a pull_request event as part of the PR.
-
-[gh-actions]: https://docs.github.com/en/actions
-[monitor-ex01]: https://github.com/kata-containers/kata-containers/commit/a3fb067f1bccde0cbd3fd4d5de12dfb3d8c28b60
-[monitor-ex02]: https://github.com/kata-containers/kata-containers/commit/489caf1ad0fae27cfd00ba3c9ed40e3d512fa492

ci/darwin-test.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright (c) 2022 Apple Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-
-set -e
-
-cidir=$(dirname "$0")
-runtimedir=$cidir/../src/runtime
-
-build_working_packages() {
-	# working packages:
-	device_api=$runtimedir/pkg/device/api
-	device_config=$runtimedir/pkg/device/config
-	device_drivers=$runtimedir/pkg/device/drivers
-	device_manager=$runtimedir/pkg/device/manager
-	rc_pkg_dir=$runtimedir/pkg/resourcecontrol/
-	utils_pkg_dir=$runtimedir/virtcontainers/utils
-
-	# broken packages :( :
-	#katautils=$runtimedir/pkg/katautils
-	#oci=$runtimedir/pkg/oci
-	#vc=$runtimedir/virtcontainers
-
-	pkgs=(
-		"$device_api"
-		"$device_config"
-		"$device_drivers"
-		"$device_manager"
-		"$utils_pkg_dir"
-		"$rc_pkg_dir")
-	for pkg in "${pkgs[@]}"; do
-		echo building "$pkg"
-		pushd "$pkg" &>/dev/null
-		go build
-		go test
-		popd &>/dev/null
-	done
-}
-
-build_working_packages

ci/docs-url-alive-check.sh

@@ -1,12 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2021 Easystack Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-
-set -e
-
-cidir=$(dirname "$0")
-source "${cidir}/lib.sh"
-
-run_docs_url_alive_check

ci/gh-util.sh

@@ -1,182 +0,0 @@
-#!/bin/bash
-
-# Copyright (c) 2020 Intel Corporation
-# Copyright (c) 2024 IBM Corporation
-#
-# SPDX-License-Identifier: Apache-2.0
-
-set -o errexit
-set -o errtrace
-set -o nounset
-set -o pipefail
-
-[ -n "${DEBUG:-}" ] && set -o xtrace
-
-script_name=${0##*/}
-
-#---------------------------------------------------------------------
-
-die()
-{
-    echo >&2 "$*"
-    exit 1
-}
-
-usage()
-{
-    cat <<EOF
-Usage: $script_name [OPTIONS] [command] [arguments]
-
-Description: Utility to expand the abilities of the GitHub CLI tool, gh.
-
-Command descriptions:
-
-  list-issues-for-pr     List issues linked to a PR.
-  list-labels-for-issue  List labels, in json format for an issue
-
-Commands and arguments:
-
-  list-issues-for-pr <pr>
-  list-labels-for-issue <issue>
-
-Options:
-
- -h                 Show this help statement.
- -r <owner/repo>    Optional <org/repo> specification. Default: 'kata-containers/kata-containers'
-
-Examples:
-
-- List issues for a Pull Request 123 in kata-containers/kata-containers repo
-
-  $ $script_name list-issues-for-pr 123
-EOF
-}
-
-list_issues_for_pr()
-{
-    local pr="${1:-}"
-    local repo="${2:-kata-containers/kata-containers}"
-
-    [ -z "$pr" ] && die "need PR"
-
-    local commits=$(gh pr view ${pr} --repo ${repo} --json commits --jq .commits[].messageBody)
-
-    [ -z "$commits" ] && die "cannot determine commits for PR $pr"
-
-    # Extract the issue number(s) from the commits.
-    #
-    # This needs to be careful to take account of lines like this:
-    #
-    # fixes 99
-    # fixes: 77
-    # fixes #123.
-    # Fixes: #1, #234, #5678.
-    #
-    # Note the exclusion of lines starting with whitespace which is
-    # specifically to ignore vendored git log comments, which are whitespace
-    # indented and in the format:
-    #
-    #     "<git-commit> <git-commit-msg>"
-    #
-    local issues=$(echo "$commits" |\
-        egrep -v "^( |	)" |\
-        egrep -i "fixes:* *(#*[0-9][0-9]*)" |\
-        tr ' ' '\n' |\
-        grep "[0-9][0-9]*" |\
-        sed 's/[.,\#]//g' |\
-        sort -nu || true)
-
-    [ -z "$issues" ] && die "cannot determine issues for PR $pr"
-
-    echo "# Issues linked to PR"
-    echo "#"
-    echo "# Fields: issue_number"
-
-    local issue
-    echo "$issues"|while read issue
-    do
-        printf "%s\n" "$issue"
-    done
-}
-
-list_labels_for_issue()
-{
-    local issue="${1:-}"
-
-    [ -z "$issue" ] && die "need issue number"
-
-    local labels=$(gh issue view ${issue} --repo kata-containers/kata-containers --json labels)
-
-    [ -z "$labels" ] && die "cannot determine labels for issue $issue"
-
-    printf "$labels"
-}
-
-setup()
-{
-    for cmd in gh jq
-    do
-        command -v "$cmd" &>/dev/null || die "need command: $cmd"
-    done
-}
-
-handle_args()
-{
-    setup
-
-    local show_all="false"
-    local opt
-
-    while getopts "ahr:" opt "$@"
-    do
-        case "$opt" in
-            a) show_all="true" ;;
-            h) usage && exit 0 ;;
-            r) repo="${OPTARG}" ;;
-        esac
-    done
-
-    shift $(($OPTIND - 1))
-
-    local repo="${repo:-kata-containers/kata-containers}"
-    local cmd="${1:-}"
-
-    case "$cmd" in
-        list-issues-for-pr) ;;
-        list-labels-for-issue) ;;
-
-        "") usage && exit 0 ;;
-        *) die "invalid command: '$cmd'" ;;
-    esac
-
-    # Consume the command name
-    shift
-
-    local issue=""
-    local pr=""
-
-    case "$cmd" in
-        list-issues-for-pr)
-            pr="${1:-}"
-
-            list_issues_for_pr "$pr" "${repo}"
-            ;;
-
-        list-labels-for-issue)
-            issue="${1:-}"
-
-            list_labels_for_issue "$issue"
-            ;;
-
-        *) die "impossible situation: cmd: '$cmd'" ;;
-    esac
-
-    exit 0
-}
-
-main()
-{
-    handle_args "$@"
-}
-
-main "$@"

ci/go-no-os-exit.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Copyright (c) 2018 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Check there are no os.Exit() calls creeping into the code
+# We don't use that exit path in the Kata codebase.
+
+# Allow the path to check to be over-ridden.
+# Default to the current directory.
+go_packages=${1:-.}
+
+echo "Checking for no os.Exit() calls for package [${go_packages}]"
+
+candidates=`go list -f '{{.Dir}}/*.go' $go_packages`
+for f in $candidates; do
+	filename=`basename $f`
+	# skip all go test files
+	[[ $filename == *_test.go ]] && continue
+	# skip exit.go where, the only file we should call os.Exit() from.
+	[[ $filename == "exit.go" ]] && continue
+	files="$f $files"
+done
+
+[ -z "$files" ] && echo "No files to check, skipping" && exit 0
+
+if egrep -n '\<os\.Exit\>' $files; then
+	echo "Direct calls to os.Exit() are forbidden, please use exit() so atexit() works"
+	exit 1
+fi

ci/go-test.sh

@@ -0,0 +1,11 @@
+#
+# Copyright (c) 2020 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+cidir=$(dirname "$0")
+source "${cidir}/lib.sh"
+
+run_go_test

ci/install_go.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 #
 # Copyright (c) 2019 Intel Corporation
 #

ci/install_libseccomp.sh

@@ -1,111 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright 2021 Sony Group Corporation
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-set -o errexit
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-script_name="$(basename "${BASH_SOURCE[0]}")"
-
-source "${script_dir}/../tests/common.bash"
-
-# The following variables if set on the environment will change the behavior
-# of gperf and libseccomp configure scripts, that may lead this script to
-# fail. So let's ensure they are unset here.
-unset PREFIX DESTDIR
-
-arch=${ARCH:-$(uname -m)}
-workdir="$(mktemp -d --tmpdir build-libseccomp.XXXXX)"
-
-# Variables for libseccomp
-libseccomp_version="${LIBSECCOMP_VERSION:-""}"
-if [ -z "${libseccomp_version}" ]; then
-    libseccomp_version=$(get_from_kata_deps "externals.libseccomp.version")
-fi
-libseccomp_url="${LIBSECCOMP_URL:-""}"
-if [ -z "${libseccomp_url}" ]; then
-    libseccomp_url=$(get_from_kata_deps "externals.libseccomp.url")
-fi
-libseccomp_tarball="libseccomp-${libseccomp_version}.tar.gz"
-libseccomp_tarball_url="${libseccomp_url}/releases/download/v${libseccomp_version}/${libseccomp_tarball}"
-cflags="-O2"
-
-# Variables for gperf
-gperf_version="${GPERF_VERSION:-""}"
-if [ -z "${gperf_version}" ]; then
-    gperf_version=$(get_from_kata_deps "externals.gperf.version")
-fi
-gperf_url="${GPERF_URL:-""}"
-if [ -z "${gperf_url}" ]; then
-    gperf_url=$(get_from_kata_deps "externals.gperf.url")
-fi
-gperf_tarball="gperf-${gperf_version}.tar.gz"
-gperf_tarball_url="${gperf_url}/${gperf_tarball}"
-
-# We need to build the libseccomp library from sources to create a static library for the musl libc.
-# However, ppc64le and s390x have no musl targets in Rust. Hence, we do not set cflags for the musl libc.
-if ([ "${arch}" != "ppc64le" ] && [ "${arch}" != "s390x" ]); then
-    # Set FORTIFY_SOURCE=1 because the musl-libc does not have some functions about FORTIFY_SOURCE=2
-    cflags="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1 -O2"
-fi
-
-die() {
-    msg="$*"
-    echo "[Error] ${msg}" >&2
-    exit 1
-}
-
-finish() {
-    rm -rf "${workdir}"
-}
-
-trap finish EXIT
-
-build_and_install_gperf() {
-    echo "Build and install gperf version ${gperf_version}"
-    mkdir -p "${gperf_install_dir}"
-    curl -sLO "${gperf_tarball_url}"
-    tar -xf "${gperf_tarball}"
-    pushd "gperf-${gperf_version}"
-    # Unset $CC for configure, we will always use native for gperf
-    CC= ./configure --prefix="${gperf_install_dir}"
-    make
-    make install
-    export PATH=$PATH:"${gperf_install_dir}"/bin
-    popd
-    echo "Gperf installed successfully"
-}
-
-build_and_install_libseccomp() {
-    echo "Build and install libseccomp version ${libseccomp_version}"
-    mkdir -p "${libseccomp_install_dir}"
-    curl -sLO "${libseccomp_tarball_url}"
-    tar -xf "${libseccomp_tarball}"
-    pushd "libseccomp-${libseccomp_version}"
-    [ "${arch}" == $(uname -m) ] && cc_name="" || cc_name="${arch}-linux-gnu-gcc"
-    CC=${cc_name} ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static --host="${arch}"
-    make
-    make install
-    popd
-    echo "Libseccomp installed successfully"
-}
-
-main() {
-    local libseccomp_install_dir="${1:-}"
-    local gperf_install_dir="${2:-}"
-
-    if [ -z "${libseccomp_install_dir}" ] || [ -z "${gperf_install_dir}" ]; then
-        die "Usage: ${0} <libseccomp-install-dir> <gperf-install-dir>"
-    fi
-
-    pushd "$workdir"
-    # gperf is required for building the libseccomp.
-    build_and_install_gperf
-    build_and_install_libseccomp
-    popd
-}
-
-main "$@"

ci/install_musl.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Copyright (c) 2020 Ant Group
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+set -e
+
+install_aarch64_musl() {
+	local arch=$(uname -m)
+	if [ "${arch}" == "aarch64" ]; then
+		local musl_tar="${arch}-linux-musl-native.tgz"
+		local musl_dir="${arch}-linux-musl-native"
+		pushd /tmp
+		if curl -sLO --fail https://musl.cc/${musl_tar}; then
+			tar -zxf ${musl_tar}
+			mkdir -p /usr/local/musl/
+			cp -r ${musl_dir}/* /usr/local/musl/
+		fi
+		popd
+	fi
+}
+
+install_aarch64_musl

ci/install_rust.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 # Copyright (c) 2019 Ant Financial
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -12,5 +12,5 @@ source "${cidir}/lib.sh"
 clone_tests_repo
 
 pushd ${tests_repo_dir}
-.ci/install_rust.sh ${1:-}
+.ci/install_rust.sh
 popd

ci/install_vc.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 #
 # Copyright (c) 2018 Intel Corporation
 #

ci/install_yq.sh

@@ -17,7 +17,6 @@ die() {
 function install_yq() {
 	local yq_pkg="github.com/mikefarah/yq"
 	local yq_version=3.4.1
-	local precmd=""
 	INSTALL_IN_GOPATH=${INSTALL_IN_GOPATH:-true}
 
 	if [ "${INSTALL_IN_GOPATH}"  == "true" ];then
@@ -26,15 +25,6 @@ function install_yq() {
 		local yq_path="${GOPATH}/bin/yq"
 	else
 		yq_path="/usr/local/bin/yq"
-		# Check if we need sudo to install yq
-		if [ ! -w "/usr/local/bin" ]; then
-			# Check if we have sudo privileges
-			if ! sudo -n true 2>/dev/null; then
-				die "Please provide sudo privileges to install yq"
-			else
-				precmd="sudo"
-			fi
-		fi
 	fi
 	[ -x  "${yq_path}" ] && [ "`${yq_path} --version`"X == "yq version ${yq_version}"X ] && return
 
@@ -53,16 +43,6 @@ function install_yq() {
 	"aarch64")
 		goarch=arm64
 		;;
-	"arm64")
-		# If we're on an apple silicon machine, just assign amd64. 
-		# The version of yq we use doesn't have a darwin arm build, 
-		# but Rosetta can come to the rescue here.
-		if [ $goos == "Darwin" ]; then 
-			goarch=amd64
-		else 
-			goarch=arm64
-		fi
-		;;
 	"ppc64le")
 		goarch=ppc64le
 		;;
@@ -84,10 +64,10 @@ function install_yq() {
 	fi
 
 	## NOTE: ${var,,} => gives lowercase value of var
-	local yq_url="https://${yq_pkg}/releases/download/${yq_version}/yq_${goos}_${goarch}"
-	${precmd} curl -o "${yq_path}" -LSsf "${yq_url}"
+	local yq_url="https://${yq_pkg}/releases/download/${yq_version}/yq_${goos,,}_${goarch}"
+	curl -o "${yq_path}" -LSsf "${yq_url}"
 	[ $? -ne 0 ] && die "Download ${yq_url} failed"
-	${precmd} chmod +x "${yq_path}"
+	chmod +x "${yq_path}"
 
 	if ! command -v "${yq_path}" >/dev/null; then
 		die "Cannot not get ${yq_path} executable"

ci/lib.sh

@@ -5,9 +5,6 @@
 
 set -o nounset
 
-GOPATH=${GOPATH:-${HOME}/go}
-export kata_repo="github.com/kata-containers/kata-containers"
-export kata_repo_dir="$GOPATH/src/$kata_repo"
 export tests_repo="${tests_repo:-github.com/kata-containers/tests}"
 export tests_repo_dir="$GOPATH/src/$tests_repo"
 export branch="${target_branch:-main}"
@@ -21,13 +18,6 @@ clone_tests_repo()
 {
 	if [ -d "$tests_repo_dir" ]; then
 		[ -n "${CI:-}" ] && return
-		# git config --global --add safe.directory will always append
-		# the target to .gitconfig without checking the existence of
-		# the target, so it's better to check it before adding the target repo.
-		local sd="$(git config --global --get safe.directory ${tests_repo_dir} || true)"
-		if [ -z "${sd}" ]; then
-			git config --global --add safe.directory ${tests_repo_dir}
-		fi
 		pushd "${tests_repo_dir}"
 		git checkout "${branch}"
 		git pull
@@ -42,46 +32,15 @@ clone_tests_repo()
 
 run_static_checks()
 {
+	clone_tests_repo
 	# Make sure we have the targeting branch
 	git remote set-branches --add origin "${branch}"
 	git fetch -a
-	bash "$kata_repo_dir/tests/static-checks.sh" "$@"
+	bash "$tests_repo_dir/.ci/static-checks.sh" "github.com/kata-containers/kata-containers"
 }
 
-run_docs_url_alive_check()
+run_go_test()
 {
-	# Make sure we have the targeting branch
-	git remote set-branches --add origin "${branch}"
-	git fetch -a
-	bash "$kata_repo_dir/tests/static-checks.sh" --docs --all "$kata_repo"
-}
-
-run_get_pr_changed_file_details()
-{
-	# Make sure we have the targeting branch
-	git remote set-branches --add origin "${branch}"
-	git fetch -a
-	source "$kata_repo_dir/tests/common.bash"
-	get_pr_changed_file_details
-}
-
-# Check if the 1st argument version is greater than and equal to 2nd one
-# Version format: [0-9]+ separated by period (e.g. 2.4.6, 1.11.3 and etc.)
-#
-# Parameters:
-#	$1	- a version to be tested
-#	$2	- a target version
-#
-# Return:
-# 	0 if $1 is greater than and equal to $2
-#	1 otherwise
-version_greater_than_equal() {
-	local current_version=$1
-	local target_version=$2
-	smaller_version=$(echo -e "$current_version\n$target_version" | sort -V | head -1)
-	if [ "${smaller_version}" = "${target_version}" ]; then
-		return 0
-	else
-		return 1
-	fi
+	clone_tests_repo
+	bash "$tests_repo_dir/.ci/go-test.sh"
 }

ci/openshift-ci/cleanup.sh

@@ -1,55 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2024 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script tries to removes most of the resources added by `test.sh` script
-# from the cluster.
-
-scripts_dir=$(dirname $0)
-deployments_dir=${scripts_dir}/cluster/deployments
-configs_dir=${scripts_dir}/configs
-
-source ${scripts_dir}/lib.sh
-
-# Set to 'yes' if you want to configure SELinux to permissive on the cluster
-# workers.
-#
-SELINUX_PERMISSIVE=${SELINUX_PERMISSIVE:-no}
-
-# Enable workaround for OCP 4.13 https://github.com/kata-containers/kata-containers/pull/9206
-#
-WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
-
-# Ignore errors as we want best-effort-approach here
-trap - ERR
-
-# Delete potential smoke-test resources
-oc delete -f "${scripts_dir}/smoke/service.yaml"
-oc delete -f "${scripts_dir}/smoke/service_kubernetes.yaml"
-oc delete -f "${scripts_dir}/smoke/http-server.yaml"
-
-# Delete test.sh resources
-oc delete -f "${deployments_dir}/relabel_selinux.yaml"
-if [[ "$WORKAROUND_9206_CRIO" == "yes" ]]; then
-	oc delete -f "${deployments_dir}/workaround-9206-crio-ds.yaml"
-	oc delete -f "${deployments_dir}/workaround-9206-crio.yaml"
-fi
-[ ${SELINUX_PERMISSIVE} == "yes" ] && oc delete -f "${deployments_dir}/machineconfig_selinux.yaml.in"
-
-# Delete kata-containers
-pushd "$katacontainers_repo_dir/tools/packaging/kata-deploy"
-oc delete -f kata-deploy/base/kata-deploy.yaml
-oc -n kube-system wait --timeout=10m --for=delete -l name=kata-deploy pod
-oc apply -f kata-cleanup/base/kata-cleanup.yaml
-echo "Wait for all related pods to be gone"
-( repeats=1; for i in $(seq 1 600); do
-  oc get pods -l name="kubelet-kata-cleanup" --no-headers=true -n kube-system 2>&1 | grep "No resources found" -q && ((repeats++)) || repeats=1
-  [ "$repeats" -gt 5 ] && echo kata-cleanup finished && break
-  sleep 1
-done) || { echo "There are still some kata-cleanup related pods after 600 iterations"; oc get all -n kube-system; exit -1; }
-oc delete -f kata-cleanup/base/kata-cleanup.yaml
-oc delete -f kata-rbac/base/kata-rbac.yaml
-oc delete -f runtimeclasses/kata-runtimeClasses.yaml
-

ci/openshift-ci/cluster/configs/selinux.conf

@@ -1,6 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-SELINUX=permissive
-SELINUXTYPE=targeted

ci/openshift-ci/cluster/deploy_webhook.sh

@@ -1,35 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script builds the kata-webhook and deploys it in the test cluster.
-#
-# You should export the KATA_RUNTIME variable with the runtimeclass name
-# configured in your cluster in case it is not the default "kata-ci".
-#
-set -e
-set -o nounset
-set -o pipefail
-
-script_dir="$(dirname $0)"
-webhook_dir="${script_dir}/../../../tools/testing/kata-webhook"
-source "${script_dir}/../lib.sh"
-KATA_RUNTIME=${KATA_RUNTIME:-kata-ci}
-
-info "Creates the kata-webhook ConfigMap"
-RUNTIME_CLASS="${KATA_RUNTIME}" \
-	envsubst < "${script_dir}/deployments/configmap_kata-webhook.yaml.in" \
-	| oc apply -f -
-
-pushd "${webhook_dir}" >/dev/null
-# Build and deploy the webhook
-#
-info "Builds the kata-webhook"
-./create-certs.sh
-info "Deploys the kata-webhook"
-oc apply -f deploy/
-# Check the webhook was deployed and is working.
-RUNTIME_CLASS="${KATA_RUNTIME}" ./webhook-check.sh
-popd >/dev/null

ci/openshift-ci/cluster/deployments/configmap_installer_kernel.yaml

@@ -1,13 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Instruct the daemonset installer to configure Kata Containers to use the
-# host kernel.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ci.kata.installer.kernel
-data:
-  host_kernel: "yes"

ci/openshift-ci/cluster/deployments/configmap_installer_qemu.yaml

@@ -1,14 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Instruct the daemonset installer to configure Kata Containers to use the
-# system QEMU.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ci.kata.installer.qemu
-data:
-  qemu_path: /usr/libexec/qemu-kvm
-  host_kernel: "yes"

ci/openshift-ci/cluster/deployments/configmap_kata-webhook.yaml.in

@@ -1,12 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Apply customizations to the kata-webhook.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kata-webhook
-data:
-  runtime_class: ${RUNTIME_CLASS}

ci/openshift-ci/cluster/deployments/machineconfig_sandboxedcontainers_extension.yaml

@@ -1,9 +0,0 @@
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 50-enable-sandboxed-containers-extension
-spec:
-  extensions:
-  - sandboxed-containers

ci/openshift-ci/cluster/deployments/machineconfig_selinux.yaml.in

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Configure SELinux on worker nodes.
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 51-kata-selinux
-spec:
-  config:
-    ignition:
-      version: 2.2.0
-    storage:
-      files:
-      - contents:
-              source: data:text/plain;charset=utf-8;base64,${SELINUX_CONF_BASE64}
-        filesystem: root
-        mode: 0644
-        path: /etc/selinux/config

ci/openshift-ci/cluster/deployments/relabel_selinux.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: relabel-selinux-daemonset
-  namespace: kube-system
-spec:
-  selector:
-    matchLabels:
-      app: restorecon
-  template:
-    metadata:
-      labels:
-        app: restorecon
-    spec:
-      serviceAccountName: kata-deploy-sa
-      hostPID: true
-      containers:
-        - name: relabel-selinux-container
-          image: alpine
-          securityContext:
-            privileged: true
-          command: ["/bin/sh", "-c", "
-            set -e;
-            echo Starting the relabel;
-            nsenter --target 1 --mount bash -xc '
-                command -v semanage &>/dev/null || { echo Does not look like a SELINUX cluster, skipping; exit 0; };
-                for ENTRY in \
-                    \"/(.*/)?opt/kata/bin(/.*)?\" \
-                    \"/(.*/)?opt/kata/runtime-rs/bin(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/kata-.*(/.*)?(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/ovmf(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/tdvf(/.*)?\" \
-                    \"/(.*/)?opt/kata/libexec(/.*)?\";
-                do
-                    semanage fcontext -a -t qemu_exec_t \"$ENTRY\" || semanage fcontext -m -t qemu_exec_t \"$ENTRY\" || { echo \"Error in semanage command\"; exit 1; }
-                done;
-                restorecon -v -R /opt/kata || { echo \"Error in restorecon command\"; exit 1; }
-            ';
-            echo NSENTER_FINISHED_WITH: $?;
-            sleep infinity"]

ci/openshift-ci/cluster/deployments/workaround-9206-crio-ds.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: workaround-9206-crio-ds
-spec:
-  selector:
-    matchLabels:
-      app: workaround-9206-crio-ds
-  template:
-    metadata:
-      labels:
-        app: workaround-9206-crio-ds
-    spec:
-      containers:
-      - name: workaround-9206-crio-ds
-        image: alpine
-        volumeMounts:
-        - name: host-dir
-          mountPath: /tmp/config
-        securityContext:
-          runAsUser: 0
-          privileged: true
-        command: ["/bin/sh", "-c", "while [ ! -f '/tmp/config/10-workaround-9206-crio' ]; do sleep 1; done; echo 'Config file present'; sleep infinity"]
-      volumes:
-      - name: host-dir
-        hostPath:
-          path: /etc/crio/crio.conf.d/

ci/openshift-ci/cluster/deployments/workaround-9206-crio.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 10-workaround-9206-crio
-spec:
-  config:
-    ignition:
-      version: 2.2.0
-    storage:
-      files:
-      - contents:
-              source: data:text/plain;charset=utf-8;base64,W2NyaW9dCnN0b3JhZ2Vfb3B0aW9uID0gWwoJIm92ZXJsYXkuc2tpcF9tb3VudF9ob21lPXRydWUiLApdCg==
-        filesystem: root
-        mode: 0644
-        path: /etc/crio/crio.conf.d/10-workaround-9206-crio

ci/openshift-ci/cluster/install_kata.sh

@@ -1,245 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script installs the built kata-containers in the test cluster,
-# and configure a runtime.
-
-scripts_dir=$(dirname $0)
-deployments_dir=${scripts_dir}/deployments
-configs_dir=${scripts_dir}/configs
-
-source ${scripts_dir}/../lib.sh
-
-# Set to 'yes' if you want to configure SELinux to permissive on the cluster
-# workers.
-#
-SELINUX_PERMISSIVE=${SELINUX_PERMISSIVE:-no}
-
-# Set to 'yes' if you want to configure Kata Containers to use the system's
-# QEMU (from the RHCOS extension).
-#
-KATA_WITH_SYSTEM_QEMU=${KATA_WITH_SYSTEM_QEMU:-no}
-
-# Set to 'yes' if you want to configure Kata Containers to use the host kernel.
-#
-KATA_WITH_HOST_KERNEL=${KATA_WITH_HOST_KERNEL:-no}
-
-# kata-deploy image to be used to deploy the kata (by default use CI image
-# that is built for each pull request)
-#
-KATA_DEPLOY_IMAGE=${KATA_DEPLOY_IMAGE:-quay.io/kata-containers/kata-deploy-ci:kata-containers-latest}
-
-# Enable workaround for OCP 4.13 https://github.com/kata-containers/kata-containers/pull/9206
-#
-WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
-
-# Leverage kata-deploy to install Kata Containers in the cluster.
-#
-apply_kata_deploy() {
-	local deploy_file="tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml"
-	pushd "$katacontainers_repo_dir"
-	sed -ri "s#(\s+image:) .*#\1 ${KATA_DEPLOY_IMAGE}#" "$deploy_file"
-
-	info "Applying kata-deploy"
-	oc apply -f tools/packaging/kata-deploy/kata-rbac/base/kata-rbac.yaml
-	oc label --overwrite ns kube-system pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-	oc apply -f "$deploy_file"
-	oc -n kube-system wait --timeout=10m --for=condition=Ready -l name=kata-deploy pod
-
-	info "Adding the kata runtime classes"
-	oc apply -f tools/packaging/kata-deploy/runtimeclasses/kata-runtimeClasses.yaml
-	popd
-}
-
-
-# Wait all worker nodes reboot.
-#
-# Params:
-#   $1 - timeout in seconds (default to 900).
-#
-wait_for_reboot() {
-	local delta="${1:-900}"
-	local sleep_time=60
-	declare -A BOOTIDS
-	local workers=($(oc get nodes | \
-		awk '{if ($3 == "worker") { print $1 } }'))
-	# Get the boot ID to compared it changed over time.
-	for node in ${workers[@]}; do
-		BOOTIDS[$node]=$(oc get -o jsonpath='{.status.nodeInfo.bootID}'\
-			node/$node)
-		echo "Wait $node reboot"
-	done
-
-	echo "Set timeout to $delta seconds"
-	timer_start=$(date +%s)
-	while [ ${#workers[@]} -gt 0 ]; do
-		sleep $sleep_time
-		now=$(date +%s)
-		if [ $(($timer_start + $delta)) -lt $now ]; then
-			echo "Timeout: not all workers rebooted"
-			return 1
-		fi
-		echo "Checking after $(($now - $timer_start)) seconds"
-		for i in ${!workers[@]}; do
-			current_id=$(oc get \
-				-o jsonpath='{.status.nodeInfo.bootID}' \
-				node/${workers[i]})
-			if [ "$current_id" != ${BOOTIDS[${workers[i]}]} ]; then
-				echo "${workers[i]} rebooted"
-				unset workers[i]
-			fi
-		done
-	done
-}
-
-wait_mcp_update() {
-	local delta="${1:-3600}"
-	local sleep_time=30
-	# The machineconfigpool is fine when all the workers updated and are ready,
-	# and none are degraded.
-	local ready_count=0
-	local degraded_count=0
-	local machine_count=$(oc get mcp worker -o jsonpath='{.status.machineCount}')
-
-	if [[ -z "$machine_count" && "$machine_count" -lt 1 ]]; then
-		warn "Unabled to obtain the machine count"
-		return 1
-	fi
-
-	echo "Set timeout to $delta seconds"
-	local deadline=$(($(date +%s) + $delta))
-	# The ready count might not have changed yet, so wait a little.
-	while [[ "$ready_count" != "$machine_count" && \
-		"$degraded_count" == 0 ]]; do
-		# Let's check it hit the timeout (or not).
-		local now=$(date +%s)
-		if [ $deadline -lt $now ]; then
-			echo "Timeout: not all workers updated" >&2
-			return 1
-		fi
-		sleep $sleep_time
-		ready_count=$(oc get mcp worker \
-			-o jsonpath='{.status.readyMachineCount}')
-		degraded_count=$(oc get mcp worker \
-			-o jsonpath='{.status.degradedMachineCount}')
-		echo "check machineconfigpool - ready_count: $ready_count degraded_count: $degraded_count"
-	done
-	[ $degraded_count -eq 0 ]
-}
-
-# Enable the RHCOS extension for the Sandboxed Containers.
-#
-enable_sandboxedcontainers_extension() {
-	info "Enabling the RHCOS extension for Sandboxed Containers"
-	local deployment_file="${deployments_dir}/machineconfig_sandboxedcontainers_extension.yaml"
-	oc apply -f ${deployment_file}
-	oc get -f ${deployment_file} || \
-		die "Sandboxed Containers extension machineconfig not found"
-	wait_mcp_update || die "Failed to update the machineconfigpool"
-}
-
-# Print useful information for debugging.
-#
-# Params:
-#   $1 - the pod name
-debug_pod() {
-	local pod="$1"
-	info "Debug pod: ${pod}"
-	oc describe pods "$pod"
-        oc logs "$pod"
-}
-
-# Wait for all pods of the app label to contain expected message
-#
-# Params:
-#   $1 - app labela
-#   $2 - expected pods count (>=1)
-#   $3 - message to be present in the logs
-#   $4 - timeout (60)
-#   $5 - namespace (the current one)
-wait_for_app_pods_message() {
-	local app="$1"
-	local pod_count="$2"
-	local message="$3"
-	local timeout="$4"
-	local namespace="$5"
-	[ -z "$pod_count" ] && pod_count=1
-	[ -z "$timeout" ] && timeout=60
-	[ -n "$namespace" ] && namespace=" -n $namespace "
-	local pod
-	local pods
-	local i
-	SECONDS=0
-	while :; do
-		pods=($(oc get pods -l app="$app" --no-headers=true $namespace | awk '{print $1}'))
-		[ "${#pods}" -ge "$pod_count" ] && break
-		if [ "$SECONDS" -gt "$timeout" ]; then
-			echo "Unable to find ${pod_count} pods for '-l app=\"$app\"' in ${SECONDS}s (${pods[@]})"
-			return -1
-		fi
-	done
-	for pod in "${pods[@]}"; do
-		while :; do
-			local log=$(oc logs $namespace "$pod")
-			echo "$log" | grep "$message" -q && echo "Found $(echo "$log" | grep "$message") in $pod's log ($SECONDS)" && break;
-			if [ "$SECONDS" -gt "$timeout" ]; then
-				echo -n "Message '$message' not present in '${pod}' pod of the '-l app=\"$app\"' "
-				echo "pods after ${SECONDS}s (${pods[@]})"
-				echo "Pod $pod's output so far:"
-				echo "$log"
-				return -1
-			fi
-			sleep 1;
-		done
-	done
-}
-
-oc config set-context --current --namespace=default
-
-worker_nodes=$(oc get nodes |  awk '{if ($3 == "worker") { print $1 } }')
-num_nodes=$(echo $worker_nodes | wc -w)
-[ $num_nodes -ne 0 ] || \
-	die "No worker nodes detected. Something is wrong with the cluster"
-
-if [ "${KATA_WITH_SYSTEM_QEMU}" == "yes" ]; then
-	# QEMU is deployed on the workers via RCHOS extension.
-	enable_sandboxedcontainers_extension
-	oc apply -f ${deployments_dir}/configmap_installer_qemu.yaml
-fi
-
-if [ "${KATA_WITH_HOST_KERNEL}" == "yes" ]; then
-	oc apply -f ${deployments_dir}/configmap_installer_kernel.yaml
-fi
-
-apply_kata_deploy
-
-# Set SELinux to permissive mode
-if [ ${SELINUX_PERMISSIVE} == "yes" ]; then
-	info "Configuring SELinux"
-	if [ -z "$SELINUX_CONF_BASE64" ]; then
-		export SELINUX_CONF_BASE64=$(echo \
-			$(cat $configs_dir/selinux.conf|base64) | \
-			sed -e 's/\s//g')
-	fi
-	envsubst < ${deployments_dir}/machineconfig_selinux.yaml.in | \
-		oc apply -f -
-	oc get machineconfig/51-kata-selinux || \
-		die "SELinux machineconfig not found"
-	# The new SELinux configuration will trigger another reboot.
-	wait_for_reboot
-fi
-
-if [[ "$WORKAROUND_9206_CRIO" == "yes" ]]; then
-	info "Applying workaround to enable skip_mount_home in crio on OCP 4.13"
-	oc apply -f "${deployments_dir}/workaround-9206-crio.yaml"
-	oc apply -f "${deployments_dir}/workaround-9206-crio-ds.yaml"
-	wait_for_app_pods_message workaround-9206-crio-ds "$num_nodes" "Config file present" 1200 || echo "Failed to apply the workaround, proceeding anyway..."
-fi
-
-# FIXME: Remove when https://github.com/kata-containers/kata-containers/pull/8417 is resolved
-# Selinux context is currently not handled by kata-deploy
-oc apply -f ${deployments_dir}/relabel_selinux.yaml
-wait_for_app_pods_message restorecon "$num_nodes" "NSENTER_FINISHED_WITH:" 120 "kube-system" || echo "Failed to treat selinux, proceeding anyway..."

ci/openshift-ci/images/Dockerfile.buildroot

@@ -4,11 +4,6 @@
 #
 # This is the build root image for Kata Containers on OpenShift CI.
 #
-FROM quay.io/centos/centos:stream8
+FROM centos:8
 
-RUN yum -y update && \
-    yum -y install \
-    git \
-    sudo \
-    wget && \
-    yum clean all
+RUN yum -y update && yum -y install git sudo wget

ci/openshift-ci/lib.sh

@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright (c) 2023 Red Hat
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-# Ensure GOPATH set
-if command -v go > /dev/null; then
-    export GOPATH=${GOPATH:-$(go env GOPATH)}
-else
-    # if go isn't installed, set default location for GOPATH
-    export GOPATH="${GOPATH:-$HOME/go}"
-fi
-
-lib_dir=$(dirname "${BASH_SOURCE[0]}")
-source "$lib_dir/../../tests/common.bash"
-
-export katacontainers_repo=${katacontainers_repo:="github.com/kata-containers/kata-containers"}
-export katacontainers_repo_dir="${GOPATH}/src/${katacontainers_repo}"

ci/openshift-ci/run_smoke_test.sh

@@ -1,92 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Run a smoke test.
-#
-
-script_dir=$(dirname $0)
-source ${script_dir}/lib.sh
-
-pod='http-server'
-
-# Create a pod.
-#
-info "Creating the ${pod} pod"
-oc apply -f ${script_dir}/smoke/${pod}.yaml || \
-	die "failed to create ${pod} pod"
-
-# Check it eventually goes to 'running'
-#
-wait_time=600
-sleep_time=5
-cmd="oc get pod/${pod} -o jsonpath='{.status.containerStatuses[0].state}' | \
-	grep running > /dev/null"
-info "Wait until the pod gets running"
-waitForProcess $wait_time $sleep_time "$cmd" || timed_out=$?
-if [ -n "$timed_out" ]; then
-	oc describe pod/${pod}
-	oc delete pod/${pod}
-	die "${pod} not running"
-fi
-info "${pod} is running"
-
-# Add a file with the hello message
-#
-hello_file=/tmp/hello
-hello_msg='Hello World'
-oc exec ${pod} -- sh -c "echo $hello_msg > $hello_file"
-
-info "Creating the service and route"
-if oc apply -f ${script_dir}/smoke/service.yaml; then
-    # Likely on OCP, use service
-    is_ocp=1
-    host=$(oc get route/http-server-route -o jsonpath={.spec.host})
-    port=80
-else
-    # Likely on plain kubernetes, test using another container
-    is_ocp=0
-    info "Failed to create service, likely not on OCP, trying via NodePort"
-    oc apply -f "${script_dir}/smoke/service_kubernetes.yaml"
-    # For some reason kcli's cluster lists external IP as internal IP, try both
-    host=$(oc get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="ExternalIP")].address}')
-    [ -z "$host"] && host=$(oc get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
-    port=$(oc get service/http-server-service -o jsonpath='{.spec.ports[0].nodePort}')
-fi
-
-info "Wait for the HTTP server to respond"
-tempfile=$(mktemp)
-check_cmd="curl -vvv '${host}:${port}${hello_file}' 2>&1 | tee -a '$tempfile' | grep -q '$hello_msg'"
-if waitForProcess 60 1 "${check_cmd}"; then
-    test_status=0
-    info "HTTP server is working"
-else
-    test_status=1
-    echo "::error:: HTTP server not working"
-    echo "::group::Output of the \"curl -vvv '${host}:${port}${hello_file}'\""
-    cat "${tempfile}"
-    echo "::endgroup::"
-    echo "::group::Describe kube-system namespace"
-    oc describe -n kube-system all
-    echo "::endgroup::"
-    echo "::group::Descibe current namespace"
-    oc describe all
-    echo "::endgroup::"
-    info "HTTP server is unreachable"
-fi
-rm -f "$tempfile"
-
-# Delete the resources.
-#
-info "Deleting the service/route"
-if [ "$is_ocp" -eq 0 ]; then
-    oc delete -f ${script_dir}/smoke/service_kubernetes.yaml
-else
-    oc delete -f ${script_dir}/smoke/service.yaml
-fi
-info "Deleting the ${pod} pod"
-oc delete pod/${pod} || test_status=$?
-
-exit $test_status

ci/openshift-ci/smoke/http-server.yaml

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Define the pod for a http server app.
----
-apiVersion: v1
-kind: Pod
-metadata:
-  name: http-server
-  labels:
-    app: http-server-app
-spec:
-  containers:
-    - name: http-server
-      image: registry.fedoraproject.org/fedora
-      ports:
-        - containerPort: 8080
-      command: ["python3"]
-      args: [ "-m", "http.server", "8080"]
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-            - ALL
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-  runtimeClassName: kata-qemu

ci/openshift-ci/smoke/service.yaml

@@ -1,28 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Create the service on port 80 for the http-server app.
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: http-server-service
-spec:
-  selector:
-    app: http-server-app
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-# Create the route to the app's service '/'.
----
-apiVersion: route.openshift.io/v1
-kind: Route
-metadata:
-  name: http-server-route
-spec:
-  path: "/"
-  to:
-    kind: Service
-    name: http-server-service

ci/openshift-ci/smoke/service_kubernetes.yaml

@@ -1,18 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Create the service on port 80 for the http-server app.
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: http-server-service
-spec:
-  selector:
-    app: http-server-app
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-  type: NodePort

ci/openshift-ci/test.sh

@@ -1,29 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-script_dir=$(dirname $0)
-source ${script_dir}/lib.sh
-
-suite=$1
-if [ -z "$1" ]; then
-	suite='smoke'
-fi
-
-# Make oc and kubectl visible
-export PATH=/tmp/shared:$PATH
-
-oc version || die "Test cluster is unreachable"
-
-info "Install and configure kata into the test cluster"
-export SELINUX_PERMISSIVE="no"
-${script_dir}/cluster/install_kata.sh || die "Failed to install kata-containers"
-
-info "Run test suite: $suite"
-test_status='PASS'
-${script_dir}/run_${suite}_test.sh || test_status='FAIL'
-info "Test suite: $suite: $test_status"
-[ "$test_status" == "PASS" ]

ci/run.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 #
 # Copyright (c) 2019 Ant Financial
 #

ci/setup.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 #
 # Copyright (c) 2018 Intel Corporation
 #

ci/static-checks.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 #
 # Copyright (c) 2017-2018 Intel Corporation
 #
@@ -9,4 +9,4 @@ set -e
 cidir=$(dirname "$0")
 source "${cidir}/lib.sh"
 
-run_static_checks "${@:-github.com/kata-containers/kata-containers}"
+run_static_checks

deny.toml

@@ -1,33 +0,0 @@
-targets = [
-    { triple = "x86_64-apple-darwin" },
-    { triple = "x86_64-unknown-linux-gnu" },
-    { triple = "x86_64-unknown-linux-musl" },
-]
-
-[advisories]
-vulnerability = "deny"
-unsound = "deny"
-unmaintained = "deny"
-ignore = ["RUSTSEC-2020-0071"]
-
-[bans]
-multiple-versions = "allow"
-deny = [
-    { name = "cmake" },
-    { name = "openssl-sys" },
-]
-
-[licenses]
-unlicensed = "deny"
-allow-osi-fsf-free = "neither"
-copyleft = "allow"
-# We want really high confidence when inferring licenses from text
-confidence-threshold = 0.93
-allow = ["0BSD", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0", "ISC", "MIT", "MPL-2.0"]
-private = { ignore = true}
-
-exceptions = []
-
-[sources]
-unknown-registry = "allow"
-unknown-git = "allow"

docs/Debug-shim-guide.md

@@ -1,185 +0,0 @@
-# Using a debugger with the runtime
-
-Setting up a debugger for the runtime is pretty complex: the shim is a server
-process that is run by the runtime manager (containerd/CRI-O), and controlled by
-sending gRPC requests to it.
-Starting the shim with a debugger then just gives you a process that waits for
-commands on its socket, and if the runtime manager doesn't start it, it won't
-send request to it.
-
-A first method is to attach a debugger to the process that was started by the
-runtime manager.
-If the issue you're trying to debug is not located at container creation, this
-is probably the easiest method.
-
-The other method involves a script that is placed in between the runtime manager
-and the actual shim binary. This allows to start the shim with a debugger, and
-wait for a client debugger connection before execution, allowing debugging of the
-kata runtime from the very beginning.
-
-## Prerequisite
-
-At the time of writing, a debugger was used only with the go shim, but a similar
-process should be doable with runtime-rs. This documentation will be enhanced
-with rust-specific instructions later on.
-
-In order to debug the go runtime, you need to use the [Delve debugger](https://github.com/go-delve/delve).
-
-You will also need to build the shim binary with debug flags to make sure symbols
-are available to the debugger.
-Typically, the flags should be: `-gcflags=all=-N -l`
-
-## Attach to the running process
-
-To attach the debugger to the running process, all you need is to let the container
-start as usual, then use the following command with `dlv`:
-
-`$ dlv attach [pid of your kata shim]`
-
-If you need to use your debugger remotely, you can use the following on your target
-machine:
-
-`$ dlv attach [pid of your kata shim] --headless --listen=[IP:port]`
-
-then from your client computer:
-
-`$ dlv connect [IP:port]`
-
-## Make CRI-O/containerd start the shim with the debugger
-
-You can use the [this script](../tools/containerd-shim-katadbg-v2) to make the
-shim binary executed through a debugger, and make the debugger wait for a client
-connection before running the shim.
-This allows starting your container, connecting your debugger, and controlling the
-shim execution from the beginning.
-
-### Adapt the script to your setup
-
-You need to edit the script itself to give it the actual binary
-to execute.
-Locate the following line in the script, and set the path accordingly.
-
-```bash
-SHIM_BINARY=
-```
-
-You may also need to edit the `PATH` variable set within the script,
-to make sure that the `dlv` binary is accessible.
-
-### Configure your runtime manager to use the script
-
-Using either containerd or CRI-O, you will need to have a runtime class that
-uses the script in place of the actual runtime binary.
-To do that, we will create a separate runtime class dedicated to debugging.
-
-- **For containerd**:
-Make sure that the `containerd-shim-katadbg-v2` script is available to containerd
-(putting it in the same folder as your regular kata shim typically).
-Then edit the containerd configuration, and add the following runtime configuration,.
-
-```toml
-[plugins]
-  [plugins."io.containerd.grpc.v1.cri"]
-    [plugins."io.containerd.grpc.v1.cri".containerd]
-      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.katadbg]
-          runtime_type = "io.containerd.katadbg.v2"
-```
-
-- **For CRI-O**:
-Copy your existing kata runtime configuration from `/etc/crio/crio.conf.d/`, and
-make a new one with the name `katadbg`, and the runtime_path set to the location
-of the script.
-
-E.g:
-
-```toml
-[crio.runtime.runtimes.katadbg]
-  runtime_path = "/usr/local/bin/containerd-shim-katadbg-v2"
-  runtime_root = "/run/vc"
-  runtime_type = "vm"
-  privileged_without_host_devices = true
-  runtime_config_path = "/usr/share/defaults/kata-containers/configuration.toml"
- ```
-
-NOTE: for CRI-O, the name of the runtime class doesn't need to match the name of the
-script. But for consistency, we're using `katadbg` here too.
-
-### Start your container and connect to the debugger
-
-Once the above configuration is in place, you can start your container, using
-your `katadbg` runtime class.
-
-E.g: `$ crictl runp --runtime=katadbg sandbox.json`
-
-The command will hang, and you can see that a `dlv` process is started
-
-```
-$ ps aux | grep dlv
-root        9137  1.4  6.8 6231104 273980 pts/10 Sl   15:04   0:02 dlv exec /go/src/github.com/kata-containers/kata-containers/src/runtime/__debug_bin --headless --listen=:12345 --accept-multiclient -r stdout:/tmp/shim_output_oMC6Jo -r stderr:/tmp/shim_output_oMC6Jo -- -namespace default -address  -publish-binary /usr/local/bin/crio -id 0bc23d2208d4ff8c407a80cd5635610e772cae36c73d512824490ef671be9293 -debug start
-```
-
-Then you can use the `dlv` debugger to connect to it:
-
-```
-$ dlv connect localhost:12345
-Type 'help' for list of commands.
-(dlv)
-```
-
-Before doing anything else, you need to to enable `follow-exec` mode in delve.
-This is because the first thing that the shim will do is to daemonize itself,
-i.e: start itself as a subprocess, and exit. So you really want the debugger
-to attach to the child process.
-
-```
-(dlv) target follow-exec -on .*/__debug_bin
-```
-
-Note that we are providing a regular expression to filter the name of the binary.
-This is to make sure that the debugger attaches to the runtime shim, and not
-to other subprocesses (hypervisor typically).
-
-To ease this process, we recommand the use of an init file containing the above
-command.
-
-```
-$ cat dlv.ini
-target follow-exec -on .*/__debug_bin
-$ dlv connect localhost:12345 --init=dlv.ini
-Type 'help' for list of commands.
-(dlv)
-```
-
-Once this is done, you can set breakpoints, and use the `continue` keyword to
-start the execution of the shim.
-
-You can also use a different client, like VSCode, to connect to it.
-A typical `launch.json` configuration for VSCode would look like:
-
-```yaml
-[...]
-{
-    "name": "Connect to the debugger",
-    "type": "go",
-    "request": "attach",
-    "mode": "remote",
-    "port": 12345,
-    "host": "127.0.0.1",
-}
-[...]
-```
-
-NOTE: VSCode's go extension doesn't seem to support the `follow-exec` mode from
-Delve. So if you want to use VScode, you'll still need to use a commandline
-`dlv` client to set the `follow-exec` flag.
-
-## Caveats
-
-Debugging takes time, and there are a lot of timeouts going on in a Kubernetes
-environments. It is very possible that while you're debugging, some processes
-will timeout and cancel the container execution, possibly breaking your debugging
-session.
-
-You can mitigate that by increasing the timeouts in the different components
-involved in your environment.

docs/Developer-Guide.md

@@ -2,8 +2,6 @@
 
 This document is written **specifically for developers**: it is not intended for end users.
 
-If you want to contribute changes that you have made, please read the [community guidelines](https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md) for information about our processes.
-
 # Assumptions
 
 - You are working on a non-critical test or development system.
@@ -15,22 +13,11 @@ The recommended way to create a development environment is to first
 to create a working system.
 
 The installation guide instructions will install all required Kata Containers
-components, plus a container manager, the hypervisor, and the Kata
-Containers image and guest kernel.
-
-Alternatively, you can perform a
-[manual installation](install/container-manager/containerd/containerd-install.md),
-or continue with [the instructions below](#requirements-to-build-individual-components)
-to build the Kata Containers components from source.
+components, plus *Docker*, the hypervisor, and the Kata Containers image and
+guest kernel.
 
 # Requirements to build individual components
 
-> **Note:**
->
-> If you decide to build from sources, you should be aware of the
-> implications of using an unpackaged system which will not be automatically
-> updated as new [releases](https://github.com/kata-containers/kata-containers/releases) are made available.
-
 You need to install the following to build Kata Containers components:
 
 - [golang](https://golang.org/dl)
@@ -46,41 +33,51 @@ You need to install the following to build Kata Containers components:
 - `make`.
 - `gcc` (required for building the shim and runtime).
 
-# Build and install Kata Containers
-## Build and install the Kata Containers runtime
+# Build and install the Kata Containers runtime
 
-```bash
-$ git clone https://github.com/kata-containers/kata-containers.git
-$ pushd kata-containers/src/runtime
-$ make && sudo -E "PATH=$PATH" make install
-$ sudo mkdir -p /etc/kata-containers/
-$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
-$ popd
+```
+$ go get -d -u github.com/kata-containers/kata-containers
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/src/runtime
+$ make && sudo -E PATH=$PATH make install
 ```
 
 The build will create the following:
 
 - runtime binary: `/usr/local/bin/kata-runtime` and `/usr/local/bin/containerd-shim-kata-v2`
-- configuration file: `/usr/share/defaults/kata-containers/configuration.toml` and `/etc/kata-containers/configuration.toml`
+- configuration file: `/usr/share/defaults/kata-containers/configuration.toml`
+
+# Check hardware requirements
+
+You can check if your system is capable of creating a Kata Container by running the following:
+
+```
+$ sudo kata-runtime check
+```
+
+If your system is *not* able to run Kata Containers, the previous command will error out and explain why.
 
 ## Configure to use initrd or rootfs image
 
 Kata containers can run with either an initrd image or a rootfs image.
 
-If you want to test with `initrd`, make sure you have uncommented `initrd = /usr/share/kata-containers/kata-containers-initrd.img`
-in your configuration file, commenting out the `image` line in
-`/etc/kata-containers/configuration.toml`. For example:
+If you want to test with `initrd`, make sure you have `initrd = /usr/share/kata-containers/kata-containers-initrd.img`
+in your configuration file, commenting out the `image` line:
 
-```bash
+`/usr/share/defaults/kata-containers/configuration.toml` and comment out the `image` line with the following. For example:
+
+```
+$ sudo mkdir -p /etc/kata-containers/
+$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
 $ sudo sed -i 's/^\(image =.*\)/# \1/g' /etc/kata-containers/configuration.toml
-$ sudo sed -i 's/^# \(initrd =.*\)/\1/g' /etc/kata-containers/configuration.toml
 ```
 You can create the initrd image as shown in the [create an initrd image](#create-an-initrd-image---optional) section.
 
-If you want to test with a rootfs `image`, make sure you have uncommented `image = /usr/share/kata-containers/kata-containers.img`
+If you want to test with a rootfs `image`, make sure you have `image = /usr/share/kata-containers/kata-containers.img`
 in your configuration file, commenting out the `initrd` line. For example:
 
-```bash
+```
+$ sudo mkdir -p /etc/kata-containers/
+$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
 $ sudo sed -i 's/^\(initrd =.*\)/# \1/g' /etc/kata-containers/configuration.toml
 ```
 The rootfs image is created as shown in the [create a rootfs image](#create-a-rootfs-image) section.
@@ -89,42 +86,13 @@ One of the `initrd` and `image` options in Kata runtime config file **MUST** be
 The main difference between the options is that the size of `initrd`(10MB+) is significantly smaller than
 rootfs `image`(100MB+).
 
-## Enable seccomp
-
-Enable seccomp as follows:
-
-```bash
-$ sudo sed -i '/^disable_guest_seccomp/ s/true/false/' /etc/kata-containers/configuration.toml
-```
-
-This will pass container seccomp profiles to the kata agent.
-
-## Enable SELinux on the guest
-
-> **Note:**
->
-> - To enable SELinux on the guest, SELinux MUST be also enabled on the host.
-> - You MUST create and build a rootfs image for SELinux in advance.
->   See [Create a rootfs image](#create-a-rootfs-image) and [Build a rootfs image](#build-a-rootfs-image).
-> - SELinux on the guest is supported in only a rootfs image currently, so
->   you cannot enable SELinux with the agent init (`AGENT_INIT=yes`) yet.
-
-Enable guest SELinux in Enforcing mode as follows:
-
-```
-$ sudo sed -i '/^disable_guest_selinux/ s/true/false/g' /etc/kata-containers/configuration.toml
-```
-
-The runtime automatically will set `selinux=1` to the kernel parameters and `xattr` option to
-`virtiofsd` when `disable_guest_selinux` is set to `false`.
-
-If you want to enable SELinux in Permissive mode, add `enforcing=0` to the kernel parameters.
-
 ## Enable full debug
 
 Enable full debug as follows:
 
-```bash
+```
+$ sudo mkdir -p /etc/kata-containers/
+$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
 $ sudo sed -i -e 's/^# *\(enable_debug\).*=.*$/\1 = true/g' /etc/kata-containers/configuration.toml
 $ sudo sed -i -e 's/^kernel_params = "\(.*\)"/kernel_params = "\1 agent.log=debug initcall_debug"/g' /etc/kata-containers/configuration.toml
 ```
@@ -138,7 +106,7 @@ detailed below.
 The Kata logs appear in the `containerd` log files, along with logs from `containerd` itself.
 
 For more information about `containerd` debug, please see the
-[`containerd` documentation](https://github.com/containerd/containerd/blob/main/docs/getting-started.md).
+[`containerd` documentation](https://github.com/containerd/containerd/blob/master/docs/getting-started.md).
 
 #### Enabling full `containerd` debug
 
@@ -197,7 +165,7 @@ and offers possible workarounds and fixes.
 it stores. When messages are suppressed, it is noted in the logs. This can be checked
 for by looking for those notifications, such as:
 
-```bash
+```sh
 $ sudo journalctl --since today | fgrep Suppressed
 Jun 29 14:51:17 mymachine systemd-journald[346]: Suppressed 4150 messages from /system.slice/docker.service
 ```
@@ -222,7 +190,7 @@ RateLimitBurst=0
 
 Restart `systemd-journald` for the changes to take effect:
 
-```bash
+```sh
 $ sudo systemctl restart systemd-journald
 ```
 
@@ -234,56 +202,27 @@ $ sudo systemctl restart systemd-journald
 >
 > - You should only do this step if you are testing with the latest version of the agent.
 
-The agent is built with a statically linked `musl.` The default `libc` used is `musl`, but on `ppc64le` and `s390x`, `gnu` should be used. To configure this:
+The rust-agent is built with a static linked `musl.` To configure this:
 
-```bash
-$ export ARCH="$(uname -m)"
-$ if [ "$ARCH" = "ppc64le" -o "$ARCH" = "s390x" ]; then export LIBC=gnu; else export LIBC=musl; fi
-$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64le
-$ rustup target add "${ARCH}-unknown-linux-${LIBC}"
+```
+rustup target add x86_64-unknown-linux-musl
+sudo ln -s /usr/bin/g++ /bin/musl-g++
 ```
 
 To build the agent:
 
-The agent is built with seccomp capability by default.
-If you want to build the agent without the seccomp capability, you need to run `make` with `SECCOMP=no` as follows.
-
-```bash
-$ make -C kata-containers/src/agent SECCOMP=no
+```
+$ go get -d -u github.com/kata-containers/kata-containers
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/src/agent && make
 ```
 
-For building the agent with seccomp support using `musl`, set the environment
-variables for the [`libseccomp` crate](https://github.com/libseccomp-rs/libseccomp-rs).
+## Get the osbuilder
 
-```bash
-$ export LIBSECCOMP_LINK_TYPE=static
-$ export LIBSECCOMP_LIB_PATH="the path of the directory containing libseccomp.a"
-$ make -C kata-containers/src/agent
 ```
-
-If the compilation fails when the agent tries to link the `libseccomp` library statically
-against `musl`, you will need to build `libseccomp` manually with `-U_FORTIFY_SOURCE`.
-You can use [our script](https://github.com/kata-containers/kata-containers/blob/main/ci/install_libseccomp.sh)
-to install `libseccomp` for the agent.
-
-```bash
-$ mkdir -p ${seccomp_install_path} ${gperf_install_path}
-$ pushd kata-containers/ci 
-$ script -fec 'sudo -E ./install_libseccomp.sh ${seccomp_install_path} ${gperf_install_path}"'
-$ export LIBSECCOMP_LIB_PATH="${seccomp_install_path}/lib"
-$ popd
+$ go get -d -u github.com/kata-containers/kata-containers
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder
 ```
 
-On `ppc64le` and `s390x`, `glibc` is used. You will need to install the `libseccomp` library
-provided by your distribution.
-
-> e.g. `libseccomp-dev` for Ubuntu, or `libseccomp-devel` for CentOS
-
-> **Note:**
->
-> - If you enable seccomp in the main configuration file but build the agent without seccomp capability,
->   the runtime exits conservatively with an error message.
-
 ## Create a rootfs image
 ### Create a local rootfs
 
@@ -291,33 +230,13 @@ As a prerequisite, you need to install Docker. Otherwise, you will not be
 able to run the `rootfs.sh` script with `USE_DOCKER=true` as expected in
 the following example.
 
-```bash
-$ export distro="ubuntu" # example
-$ export ROOTFS_DIR="$(realpath kata-containers/tools/osbuilder/rootfs-builder/rootfs)"
-$ sudo rm -rf "${ROOTFS_DIR}"
-$ pushd kata-containers/tools/osbuilder/rootfs-builder
-$ script -fec 'sudo -E USE_DOCKER=true ./rootfs.sh "${distro}"'
-$ popd
 ```
-
-You MUST choose a distribution (e.g., `ubuntu`) for `${distro}`.
-You can get a supported distributions list in the Kata Containers by running the following.
-
-```bash
-$ ./kata-containers/tools/osbuilder/rootfs-builder/rootfs.sh -l
-```
-
-If you want to build the agent without seccomp capability, you need to run the `rootfs.sh` script with `SECCOMP=no` as follows.
-
-```bash
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh "${distro}"'
-```
-
-If you want to enable SELinux on the guest, you MUST choose `centos` and run the `rootfs.sh` script with `SELINUX=yes` as follows.
-
-```
-$ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true SELINUX=yes ./rootfs.sh centos'
+$ export ROOTFS_DIR=${GOPATH}/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder/rootfs
+$ sudo rm -rf ${ROOTFS_DIR}
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder
+$ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true SECCOMP=no ./rootfs.sh ${distro}'
 ```
+You MUST choose one of `alpine`, `centos`, `clearlinux`, `debian`, `euleros`, `fedora`, `suse`, and `ubuntu` for `${distro}`. By default `seccomp` packages are not included in the rootfs image. Set `SECCOMP` to `yes` to include them.
 
 > **Note:**
 >
@@ -332,32 +251,18 @@ $ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true SELINUX=yes ./rootfs.sh ce
 >
 > - You should only do this step if you are testing with the latest version of the agent.
 
-```bash
-$ sudo install -o root -g root -m 0550 -t "${ROOTFS_DIR}/usr/bin" "${ROOTFS_DIR}/../../../../src/agent/target/x86_64-unknown-linux-musl/release/kata-agent"
-$ sudo install -o root -g root -m 0440 "${ROOTFS_DIR}/../../../../src/agent/kata-agent.service" "${ROOTFS_DIR}/usr/lib/systemd/system/"
-$ sudo install -o root -g root -m 0440 "${ROOTFS_DIR}/../../../../src/agent/kata-containers.target" "${ROOTFS_DIR}/usr/lib/systemd/system/"
+```
+$ sudo install -o root -g root -m 0550 -t ${ROOTFS_DIR}/usr/bin ../../../src/agent/target/x86_64-unknown-linux-musl/release/kata-agent
+$ sudo install -o root -g root -m 0440 ../../../src/agent/kata-agent.service ${ROOTFS_DIR}/usr/lib/systemd/system/
+$ sudo install -o root -g root -m 0440 ../../../src/agent/kata-containers.target ${ROOTFS_DIR}/usr/lib/systemd/system/
 ```
 
 ### Build a rootfs image
 
-```bash
-$ pushd  kata-containers/tools/osbuilder/image-builder
-$ script -fec 'sudo -E USE_DOCKER=true ./image_builder.sh "${ROOTFS_DIR}"'
-$ popd
 ```
-
-If you want to enable SELinux on the guest, you MUST run the `image_builder.sh` script with `SELINUX=yes`
-to label the guest image as follows.
-To label the image on the host, you need to make sure that SELinux is enabled (`selinuxfs` is mounted) on the host
-and the rootfs MUST be created by running the `rootfs.sh` with `SELINUX=yes`.
-
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/image-builder
+$ script -fec 'sudo -E USE_DOCKER=true ./image_builder.sh ${ROOTFS_DIR}'
 ```
-$ script -fec 'sudo -E USE_DOCKER=true SELINUX=yes ./image_builder.sh ${ROOTFS_DIR}'
-```
-
-Currently, the `image_builder.sh` uses `chcon` as an interim solution in order to apply `container_runtime_exec_t`
-to the `kata-agent`. Hence, if you run `restorecon` to the guest image after running the `image_builder.sh`,
-the `kata-agent` needs to be labeled `container_runtime_exec_t` again by yourself.
 
 > **Notes:**
 >
@@ -367,48 +272,30 @@ the `kata-agent` needs to be labeled `container_runtime_exec_t` again by yoursel
 > - If you do *not* wish to build under Docker, remove the `USE_DOCKER`
 >   variable in the previous command and ensure the `qemu-img` command is
 >   available on your system.
->   - If `qemu-img` is not installed, you will likely see errors such as `ERROR: File /dev/loop19p1 is not a block device` and `losetup: /tmp/tmp.bHz11oY851: Warning: file is smaller than 512 bytes; the loop device may be useless or invisible for system tools`. These can be mitigated by installing the `qemu-img` command (available in the `qemu-img` package on Fedora or the `qemu-utils` package on Debian).
-> - If `loop` module is not probed, you will likely see errors such as `losetup: cannot find an unused loop device`. Execute `modprobe loop` could resolve it.
 
 
 ### Install the rootfs image
 
-```bash
-$ pushd kata-containers/tools/osbuilder/image-builder
-$ commit="$(git log --format=%h -1 HEAD)"
-$ date="$(date +%Y-%m-%d-%T.%N%z)"
+```
+$ commit=$(git log --format=%h -1 HEAD)
+$ date=$(date +%Y-%m-%d-%T.%N%z)
 $ image="kata-containers-${date}-${commit}"
 $ sudo install -o root -g root -m 0640 -D kata-containers.img "/usr/share/kata-containers/${image}"
 $ (cd /usr/share/kata-containers && sudo ln -sf "$image" kata-containers.img)
-$ popd
 ```
 
 ## Create an initrd image - OPTIONAL
 ### Create a local rootfs for initrd image
-
-```bash
-$ export distro="ubuntu" # example
-$ export ROOTFS_DIR="$(realpath kata-containers/tools/osbuilder/rootfs-builder/rootfs)"
-$ sudo rm -rf "${ROOTFS_DIR}"
-$ pushd kata-containers/tools/osbuilder/rootfs-builder/
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true ./rootfs.sh "${distro}"'
-$ popd
+```
+$ export ROOTFS_DIR="${GOPATH}/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder/rootfs"
+$ sudo rm -rf ${ROOTFS_DIR}
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder
+$ script -fec 'sudo -E GOPATH=$GOPATH AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh ${distro}'
 ```
 `AGENT_INIT` controls if the guest image uses the Kata agent as the guest `init` process. When you create an initrd image,
-always set `AGENT_INIT` to `yes`.
+always set `AGENT_INIT` to `yes`. By default `seccomp` packages are not included in the initrd image. Set `SECCOMP` to `yes` to include them.
 
-You MUST choose a distribution (e.g., `ubuntu`) for `${distro}`.
-You can get a supported distributions list in the Kata Containers by running the following.
-
-```bash
-$ ./kata-containers/tools/osbuilder/rootfs-builder/rootfs.sh -l
-```
-
-If you want to build the agent without seccomp capability, you need to run the `rootfs.sh` script with `SECCOMP=no` as follows.
-
-```bash
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh "${distro}"'
-```
+You MUST choose one of `alpine`, `centos`, `clearlinux`, `euleros`, and `fedora` for `${distro}`.
 
 > **Note:**
 >
@@ -416,31 +303,28 @@ $ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh "${
 
 Optionally, add your custom agent binary to the rootfs with the following commands. The default `$LIBC` used
 is `musl`, but on ppc64le and s390x, `gnu` should be used. Also, Rust refers to ppc64le as `powerpc64le`:
-```bash
-$ export ARCH="$(uname -m)"
-$ [ "${ARCH}" == "ppc64le" ] || [ "${ARCH}" == "s390x" ] && export LIBC=gnu || export LIBC=musl
-$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64le
-$ sudo install -o root -g root -m 0550 -T "${ROOTFS_DIR}/../../../../src/agent/target/${ARCH}-unknown-linux-${LIBC}/release/kata-agent" "${ROOTFS_DIR}/sbin/init"
+```
+$ export ARCH=$(uname -m)
+$ [ ${ARCH} == "ppc64le" ] || [ ${ARCH} == "s390x" ] && export LIBC=gnu || export LIBC=musl
+$ [ ${ARCH} == "ppc64le" ] && export ARCH=powerpc64le
+$ sudo install -o root -g root -m 0550 -T ../../../src/agent/target/${ARCH}-unknown-linux-${LIBC}/release/kata-agent ${ROOTFS_DIR}/sbin/init
 ```
 
 ### Build an initrd image
 
-```bash
-$ pushd kata-containers/tools/osbuilder/initrd-builder
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true ./initrd_builder.sh "${ROOTFS_DIR}"'
-$ popd
+```
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/initrd-builder
+$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true ./initrd_builder.sh ${ROOTFS_DIR}'
 ```
 
 ### Install the initrd image
 
-```bash
-$ pushd kata-containers/tools/osbuilder/initrd-builder
-$ commit="$(git log --format=%h -1 HEAD)"
-$ date="$(date +%Y-%m-%d-%T.%N%z)"
+```
+$ commit=$(git log --format=%h -1 HEAD)
+$ date=$(date +%Y-%m-%d-%T.%N%z)
 $ image="kata-containers-initrd-${date}-${commit}"
 $ sudo install -o root -g root -m 0640 -D kata-containers-initrd.img "/usr/share/kata-containers/${image}"
 $ (cd /usr/share/kata-containers && sudo ln -sf "$image" kata-containers-initrd.img)
-$ popd
 ```
 
 # Install guest kernel images
@@ -450,7 +334,7 @@ You can build and install the guest kernel image as shown [here](../tools/packag
 # Install a hypervisor
 
 When setting up Kata using a [packaged installation method](install/README.md#installing-on-a-linux-system), the
-`QEMU` VMM is installed automatically. Cloud-Hypervisor, Firecracker and StratoVirt VMMs are available from the [release tarballs](https://github.com/kata-containers/kata-containers/releases), as well as through [`kata-deploy`](../tools/packaging/kata-deploy/README.md).
+`QEMU` VMM is installed automatically. Cloud-Hypervisor and Firecracker VMMs are available from the [release tarballs](https://github.com/kata-containers/kata-containers/releases), as well as through [`kata-deploy`](../tools/packaging/kata-deploy/README.md).
 You may choose to manually build your VMM/hypervisor.
 
 ## Build a custom QEMU
@@ -459,43 +343,43 @@ Kata Containers makes use of upstream QEMU branch. The exact version
 and repository utilized can be found by looking at the [versions file](../versions.yaml).
 
 Find the correct version of QEMU from the versions file:
-```bash
-$ source kata-containers/tools/packaging/scripts/lib.sh
-$ qemu_version="$(get_from_kata_deps "assets.hypervisor.qemu.version")"
-$ echo "${qemu_version}"
+```
+$ source ${GOPATH}/src/github.com/kata-containers/kata-containers/tools/packaging/scripts/lib.sh
+$ qemu_version=$(get_from_kata_deps "assets.hypervisor.qemu.version")
+$ echo ${qemu_version}
 ```
 Get source from the matching branch of QEMU:
-```bash
-$ git clone -b "${qemu_version}" https://github.com/qemu/qemu.git
-$ your_qemu_directory="$(realpath qemu)"
+```
+$ go get -d github.com/qemu/qemu
+$ cd ${GOPATH}/src/github.com/qemu/qemu
+$ git checkout ${qemu_version}
+$ your_qemu_directory=${GOPATH}/src/github.com/qemu/qemu
 ```
 
 There are scripts to manage the build and packaging of QEMU. For the examples below, set your
 environment as:
-```bash
-$ packaging_dir="$(realpath kata-containers/tools/packaging)"
+```
+$ go get -d github.com/kata-containers/kata-containers
+$ packaging_dir="${GOPATH}/src/github.com/kata-containers/kata-containers/tools/packaging"
 ```
 
 Kata often utilizes patches for not-yet-upstream and/or backported fixes for components,
 including QEMU. These can be found in the [packaging/QEMU directory](../tools/packaging/qemu/patches),
 and it's *recommended* that you apply them. For example, suppose that you are going to build QEMU
 version 5.2.0, do:
-```bash
-$ "$packaging_dir/scripts/apply_patches.sh" "$packaging_dir/qemu/patches/5.2.x/"
+```
+$ cd $your_qemu_directory
+$ $packaging_dir/scripts/apply_patches.sh $packaging_dir/qemu/patches/5.2.x/
 ```
 
 To build utilizing the same options as Kata, you should make use of the `configure-hypervisor.sh` script. For example:
-```bash
-$ pushd "$your_qemu_directory"
-$ "$packaging_dir/scripts/configure-hypervisor.sh" kata-qemu > kata.cfg
-$ eval ./configure "$(cat kata.cfg)"
-$ make -j $(nproc --ignore=1)
-# Optional
-$ sudo -E make install
-$ popd
 ```
-
-If you do not want to install the respective QEMU version, the configuration file can be modified to point to the correct binary. In `/etc/kata-containers/configuration.toml`, change `path = "/path/to/qemu/build/qemu-system-x86_64"` to point to the correct QEMU binary.
+$ cd $your_qemu_directory
+$ $packaging_dir/scripts/configure-hypervisor.sh kata-qemu > kata.cfg
+$ eval ./configure "$(cat kata.cfg)"
+$ make -j $(nproc)
+$ sudo -E make install
+```
 
 See the [static-build script for QEMU](../tools/packaging/static-build/qemu/build-static-qemu.sh) for a reference on how to get, setup, configure and build QEMU for Kata.
 
@@ -507,33 +391,11 @@ See the [static-build script for QEMU](../tools/packaging/static-build/qemu/buil
 >   under upstream review for supporting NVDIMM on aarch64.
 >
 You could build the custom `qemu-system-aarch64` as required with the following command:
-```bash
-$ git clone https://github.com/kata-containers/tests.git
-$ script -fec 'sudo -E tests/.ci/install_qemu.sh'
 ```
-
-## Build `virtiofsd`
-
-When using the file system type virtio-fs (default), `virtiofsd` is required
-
-```bash
-$ pushd kata-containers/tools/packaging/static-build/virtiofsd
-$ ./build.sh
-$ popd
+$ go get -d github.com/kata-containers/tests
+$ script -fec 'sudo -E ${GOPATH}/src/github.com/kata-containers/tests/.ci/install_qemu.sh'
 ```
 
-Modify `/etc/kata-containers/configuration.toml` and update value `virtio_fs_daemon = "/path/to/kata-containers/tools/packaging/static-build/virtiofsd/virtiofsd/virtiofsd"` to point to the binary.
-
-# Check hardware requirements
-
-You can check if your system is capable of creating a Kata Container by running the following:
-
-```bash
-$ sudo kata-runtime check
-```
-
-If your system is *not* able to run Kata Containers, the previous command will error out and explain why.
-
 # Run Kata Containers with Containerd
 Refer to the [How to use Kata Containers and Containerd](how-to/containerd-kata.md) how-to guide.
 
@@ -555,7 +417,7 @@ script and paste its output directly into a
 > [runtime](../src/runtime) repository.
 
 To perform analysis on Kata logs, use the
-[`kata-log-parser`](../src/tools/log-parser)
+[`kata-log-parser`](https://github.com/kata-containers/tests/tree/main/cmd/log-parser)
 tool, which can convert the logs into formats (e.g. JSON, TOML, XML, and YAML).
 
 See [Set up a debug console](#set-up-a-debug-console).
@@ -564,7 +426,7 @@ See [Set up a debug console](#set-up-a-debug-console).
 
 ## Checking Docker default runtime
 
-```bash
+```
 $ sudo docker info 2>/dev/null | grep -i "default runtime" | cut -d: -f2- | grep -q runc  && echo "SUCCESS" || echo "ERROR: Incorrect default Docker runtime"
 ```
 ## Set up a debug console
@@ -581,7 +443,7 @@ contain either `/bin/sh` or `/bin/bash`.
 
 Enable debug_console_enabled in the `configuration.toml` configuration file:
 
-```toml
+```
 [agent.kata]
 debug_console_enabled = true
 ```
@@ -592,7 +454,7 @@ This will pass `agent.debug_console agent.debug_console_vport=1026` to agent as
 
 For Kata Containers `2.0.x` releases, the `kata-runtime exec` command depends on the`kata-monitor` running, in order to get the sandbox's `vsock` address to connect to. Thus, first start the `kata-monitor` process.
 
-```bash
+```
 $ sudo kata-monitor
 ```
 
@@ -600,15 +462,10 @@ $ sudo kata-monitor
 
 #### Connect to debug console
 
-You need to start a container for example:
-```bash
-$ sudo ctr run  --runtime io.containerd.kata.v2 -d docker.io/library/ubuntu:latest testdebug
-```
-
-Then, you can use the command `kata-runtime exec <sandbox id>` to connect to the debug console.
+Command `kata-runtime exec` is used to connect to the debug console.
 
 ```
-$ kata-runtime exec testdebug
+$ kata-runtime exec 1a9ab65be63b8b03dfd0c75036d27f0ed09eab38abb45337fea83acd3cd7bacd
 bash-4.2# id
 uid=0(root) gid=0(root) groups=0(root)
 bash-4.2# pwd
@@ -617,7 +474,7 @@ bash-4.2# exit
 exit
 ```
 
-`kata-runtime exec` has a command-line option `runtime-namespace`, which is used to specify under which [runtime namespace](https://github.com/containerd/containerd/blob/main/docs/namespaces.md) the particular pod was created. By default, it is set to `k8s.io` and works for containerd when configured
+`kata-runtime exec` has a command-line option `runtime-namespace`, which is used to specify under which [runtime namespace](https://github.com/containerd/containerd/blob/master/docs/namespaces.md) the particular pod was created. By default, it is set to `k8s.io` and works for containerd when configured
  with Kubernetes. For CRI-O, the namespace should set to `default` explicitly. This should not be confused with [Kubernetes namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).
 For other CRI-runtimes and configurations, you may need to set the namespace utilizing the `runtime-namespace` option.
 
@@ -659,10 +516,10 @@ an additional `coreutils` package.
 
 For example using CentOS:
 
-```bash
-$ pushd kata-containers/tools/osbuilder/rootfs-builder
-$ export ROOTFS_DIR="$(realpath ./rootfs)"
-$ script -fec 'sudo -E USE_DOCKER=true EXTRA_PKGS="bash coreutils" ./rootfs.sh centos'
+```
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder
+$ export ROOTFS_DIR=${GOPATH}/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder/rootfs
+$ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true EXTRA_PKGS="bash coreutils" ./rootfs.sh centos'
 ```
 
 #### Build the debug image
@@ -674,13 +531,12 @@ section when using rootfs, or when using initrd, complete the steps in the [Buil
 
 Install the image:
 
->**Note**: When using an initrd image, replace the below rootfs image name `kata-containers.img`
+>**Note**: When using an initrd image, replace the below rootfs image name `kata-containers.img` 
 >with the initrd image name `kata-containers-initrd.img`.
 
-```bash
+```
 $ name="kata-containers-centos-with-debug-console.img"
 $ sudo install -o root -g root -m 0640 kata-containers.img "/usr/share/kata-containers/${name}"
-$ popd
 ```
 
 Next, modify the `image=` values in the `[hypervisor.qemu]` section of the
@@ -689,7 +545,7 @@ to specify the full path to the image name specified in the previous code
 section. Alternatively, recreate the symbolic link so it points to
 the new debug image:
 
-```bash
+```
 $ (cd /usr/share/kata-containers && sudo ln -sf "$name" kata-containers.img)
 ```
 
@@ -700,7 +556,7 @@ to avoid all subsequently created containers from using the debug image.
 
 Create a container as normal. For example using `crictl`:
 
-```bash
+```
 $ sudo crictl run -r kata container.yaml pod.yaml
 ```
 
@@ -708,25 +564,25 @@ $ sudo crictl run -r kata container.yaml pod.yaml
 
 The steps required to enable debug console for QEMU slightly differ with
 those for firecracker / cloud-hypervisor.
-
+ 
 ##### Enabling debug console for QEMU
 
-Add `agent.debug_console` to the guest kernel command line to allow the agent process to start a debug console.
+Add `agent.debug_console` to the guest kernel command line to allow the agent process to start a debug console. 
 
-```bash
+```
 $ sudo sed -i -e 's/^kernel_params = "\(.*\)"/kernel_params = "\1 agent.debug_console"/g' "${kata_configuration_file}"
 ```
 
-Here `kata_configuration_file` could point to `/etc/kata-containers/configuration.toml`
+Here `kata_configuration_file` could point to `/etc/kata-containers/configuration.toml` 
 or `/usr/share/defaults/kata-containers/configuration.toml`
 or `/opt/kata/share/defaults/kata-containers/configuration-{hypervisor}.toml`, if
 you installed Kata Containers using `kata-deploy`.
 
 ##### Enabling debug console for cloud-hypervisor / firecracker
 
-Slightly different configuration is required in case of firecracker and cloud hypervisor.
-Firecracker and cloud-hypervisor don't have a UNIX socket connected to `/dev/console`.
-Hence, the kernel command line option `agent.debug_console` will not work for them.
+Slightly different configuration is required in case of firecracker and cloud hypervisor. 
+Firecracker and cloud-hypervisor don't have a UNIX socket connected to `/dev/console`. 
+Hence, the kernel command line option `agent.debug_console` will not work for them. 
 These hypervisors support `hybrid vsocks`,  which can be used for communication
 between the host and the guest. The kernel command line option `agent.debug_console_vport`
  was added to allow developers specify on which `vsock` port the debugging console should be connected.
@@ -734,12 +590,12 @@ between the host and the guest. The kernel command line option `agent.debug_cons
 
 Add the parameter `agent.debug_console_vport=1026` to the kernel command line
 as shown below:
-```bash
+```
 sudo sed -i -e 's/^kernel_params = "\(.*\)"/kernel_params = "\1 agent.debug_console_vport=1026"/g' "${kata_configuration_file}"
 ```
 
 > **Note** Ports 1024 and 1025 are reserved for communication with the agent
-> and gathering of agent logs respectively.
+> and gathering of agent logs respectively. 
 
 ##### Connecting to the debug console
 
@@ -747,7 +603,7 @@ Next, connect to the debug console. The VSOCKS paths vary slightly between each
 VMM solution.
 
 In case of cloud-hypervisor, connect to the `vsock` as shown:
-```bash
+```
 $ sudo su -c 'cd /var/run/vc/vm/${sandbox_id}/root/ && socat stdin unix-connect:clh.sock'
 CONNECT 1026
 ```
@@ -755,7 +611,7 @@ CONNECT 1026
 **Note**: You need to type `CONNECT 1026` and press `RETURN` key after entering the `socat` command.
 
 For firecracker, connect to the `hvsock` as shown:
-```bash
+```
 $ sudo su -c 'cd /var/run/vc/firecracker/${sandbox_id}/root/ && socat stdin unix-connect:kata.hvsock'
 CONNECT 1026
 ```
@@ -764,25 +620,20 @@ CONNECT 1026
 
 
 For QEMU, connect to the `vsock` as shown:
-```bash
+```
 $ sudo su -c 'cd /var/run/vc/vm/${sandbox_id} && socat "stdin,raw,echo=0,escape=0x11" "unix-connect:console.sock"'
 ```
 
 To disconnect from the virtual machine, type `CONTROL+q` (hold down the
 `CONTROL` key and press `q`).
 
-## Use a debugger with the runtime
-
-For developers interested in using a debugger with the runtime, please
-look at [this document](Debug-shim-guide.md).
-
 ## Obtain details of the image
 
 If the image is created using
 [osbuilder](../tools/osbuilder), the following YAML
 file exists and contains details of the image and how it was created:
 
-```bash
+```
 $ cat /var/lib/osbuilder/osbuilder.yaml
 ```
 
@@ -801,11 +652,11 @@ options to have the kernel boot messages logged into the system journal.
 For generic information on enabling debug in the configuration file, see the
 [Enable full debug](#enable-full-debug) section.
 
-The kernel boot messages will appear in the `kata` logs (and in the `containerd` or `CRI-O` log appropriately).
+The kernel boot messages will appear in the `containerd` or `CRI-O` log appropriately,
 such as:
 
 ```bash
-$ sudo journalctl -t kata
+$ sudo journalctl -t containerd
 -- Logs begin at Thu 2020-02-13 16:20:40 UTC, end at Thu 2020-02-13 16:30:23 UTC. --
 ...
 time="2020-09-15T14:56:23.095113803+08:00" level=debug msg="reading guest console" console-protocol=unix console-url=/run/vc/vm/ab9f633385d4987828d342e47554fc6442445b32039023eeddaa971c1bb56791/console.sock pid=107642 sandbox=ab9f633385d4987828d342e47554fc6442445b32039023eeddaa971c1bb56791 source=virtcontainers subsystem=sandbox vmconsole="[    0.395399] brd: module loaded"
@@ -815,4 +666,3 @@ time="2020-09-15T14:56:23.105268162+08:00" level=debug msg="reading guest consol
 time="2020-09-15T14:56:23.121121598+08:00" level=debug msg="reading guest console" console-protocol=unix console-url=/run/vc/vm/ab9f633385d4987828d342e47554fc6442445b32039023eeddaa971c1bb56791/console.sock pid=107642 sandbox=ab9f633385d4987828d342e47554fc6442445b32039023eeddaa971c1bb56791 source=virtcontainers subsystem=sandbox vmconsole="[    0.421324] memmap_init_zone_device initialised 32768 pages in 12ms"
 ...
 ```
-Refer to the [kata-log-parser documentation](../src/tools/log-parser/README.md) which is useful to fetch these.

docs/Documentation-Requirements.md

@@ -105,7 +105,7 @@ This section lists requirements for displaying commands and command output.
 The requirements must be adhered to since documentation containing code blocks
 is validated by the CI system, which executes the command blocks with the help
 of the
-[doc-to-script](https://github.com/kata-containers/kata-containers/blob/main/tests/kata-doc-to-script.sh)
+[doc-to-script](https://github.com/kata-containers/tests/tree/main/.ci/kata-doc-to-script.sh)
 utility.
 
 - If a document includes commands the user should run, they **MUST** be shown
@@ -189,7 +189,7 @@ and compare them with standard tools (e.g. `diff(1)`).
 
 Since this project uses a number of terms not found in conventional
 dictionaries, we have a
-[spell checking tool](https://github.com/kata-containers/kata-containers/tree/main/tests/cmd/check-spelling)
+[spell checking tool](https://github.com/kata-containers/tests/tree/main/cmd/check-spelling)
 that checks both dictionary words and the additional terms we use.
 
 Run the spell checking tool on your document before raising a PR to ensure it