latest-kernel-compatibility.yml

name: latest-kernel-compatibility

# Scheduled compatibility sweep for moving distro-kernel targets on a hosted
# KVM runner, so the supported campaign does not depend on an intermittently
# available self-hosted fleet. True
# upstream kernel.org validation is handled separately by
# upstream-kernel-compatibility.yml through the virtme-ng backend.

on:
  schedule:
    - cron: "21 3 * * 1"
  workflow_dispatch:
    inputs:
      matrix:
        description: Matrix to prefetch and run.
        required: false
        default: matrices/latest-kernel-sweep.yaml
      timeout:
        description: Per-target timeout.
        required: false
        default: 12m
      concurrency:
        description: VM concurrency.
        required: false
        default: "2"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  latest-kernel-sweep:
    name: Latest distro-kernel sweep
    runs-on: ubuntu-latest
    timeout-minutes: 120
    env:
      MATRIX: ${{ github.event.inputs.matrix || 'matrices/latest-kernel-sweep.yaml' }}
      TIMEOUT: ${{ github.event.inputs.timeout || '12m' }}
      VM_CONCURRENCY: ${{ github.event.inputs.concurrency || '2' }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.25.12"
          cache: true
      - name: Install VM dependencies
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            qemu-system-x86 qemu-utils cloud-image-utils clang llvm \
            libbpf-dev libelf-dev zlib1g-dev pkg-config jq
          if [[ -e /dev/kvm ]]; then
            sudo chmod 0666 /dev/kvm
          fi
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: vm/cache
          key: latest-kernel-images-${{ runner.os }}-${{ hashFiles('matrices/latest-kernel-sweep.yaml', 'vm/profiles/*.yaml') }}

      - name: Verify KVM availability
        shell: bash
        run: |
          set -euo pipefail
          test -e /dev/kvm || (echo "::error::/dev/kvm not found" && exit 1)
          command -v qemu-system-x86_64 >/dev/null || (echo "::error::missing qemu-system-x86_64" && exit 1)

      - name: Build validator and fixture artifacts
        shell: bash
        run: |
          set -euo pipefail
          make build
          make validator-static
          make examples

      - name: Prefetch latest-kernel images
        shell: bash
        run: |
          set -euo pipefail
          BPFCOMPAT_MATRIX="$MATRIX" bash scripts/fetch-matrix-images.sh

      - name: Generate runnable latest-kernel matrix
        shell: bash
        run: |
          set -euo pipefail
          BPFCOMPAT_MATRIX="$MATRIX" \
          BPFCOMPAT_OUT_MATRIX=matrices/latest-kernel-runnable.yaml \
          bash scripts/generate-runnable-matrix.sh

      - name: Run functional latest-kernel compatibility gate
        uses: ./
        with:
          artifact: examples/functional-execve/functional_execve.bpf.o
          manifest: examples/functional-execve/manifest-latest-kernel.yaml
          matrix: matrices/latest-kernel-runnable.yaml
          out: reports/functional-execve-latest-kernel.json
          markdown: reports/functional-execve-latest-kernel.md
          timeout: ${{ env.TIMEOUT }}
          concurrency: ${{ env.VM_CONCURRENCY }}
          build: "false"

      - name: Record scheduled campaign identity
        shell: bash
        run: |
          set -euo pipefail
          report="reports/functional-execve-latest-kernel.json"
          test -s "$report"
          jq -e '
            .summary.status == "pass" and
            ([.targets[] | select(.required and .status != "pass")] | length == 0) and
            ([.targets[] | select(.status == "infra_error")] | length == 0)
          ' "$report" >/dev/null
          jq -n \
            --arg schema_version "v0.1" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg workflow "$GITHUB_WORKFLOW_REF" \
            --arg event "$GITHUB_EVENT_NAME" \
            --argjson run_id "$GITHUB_RUN_ID" \
            --argjson run_attempt "$GITHUB_RUN_ATTEMPT" \
            --arg commit_sha "$GITHUB_SHA" \
            --arg report "functional-execve-latest-kernel.json" \
            --arg report_sha256 "$(sha256sum "$report" | awk '{print $1}')" \
            --arg started_at "$(jq -r '.run.started_at' "$report")" \
            '{
              schema_version: $schema_version,
              repository: $repository,
              workflow: $workflow,
              event: $event,
              workflow_run_id: $run_id,
              workflow_run_attempt: $run_attempt,
              commit_sha: $commit_sha,
              report: $report,
              report_sha256: $report_sha256,
              started_at: $started_at
            }' >reports/production-campaign.json

      - name: Generate compatibility site snapshot
        if: always()
        shell: bash
        run: |
          set -euo pipefail
          BPFCOMPAT_COMPATIBILITY_VERSION="latest-kernel-${GITHUB_RUN_ID}" \
          bash scripts/publish-compatibility-site.sh reports public/compatibility

      - name: Upload latest-kernel evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: bpfcompat-latest-kernel-${{ github.run_id }}
          if-no-files-found: warn
          path: |
            reports/functional-execve-latest-kernel.json
            reports/functional-execve-latest-kernel.md
            reports/production-campaign.json
            matrices/latest-kernel-runnable.yaml
            public/compatibility/**
            .bpfcompat/runs/**/targets/**/serial.log
            .bpfcompat/runs/**/targets/**/libbpf.log
            .bpfcompat/runs/**/targets/**/validator-result.json
            .bpfcompat/runs/**/targets/**/validator.stderr