ci: make CI green again - #672
Merged
Merged
Conversation
kolyshkin
force-pushed
the
ci-unshadow-runtimes
branch
2 times, most recently
from
August 16, 2026 00:34
ef01c45 to
8a2e01b
Compare
jnovy
approved these changes
Aug 16, 2026
jnovy
left a comment
jnovy
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. Great root-cause analysis and clean fix. Two minor suggestions inline, neither blocking.
kolyshkin
changed the title
The GitHub runner image ships a static podman bundle in /usr/local/bin (actions/runner-images#14412), which includes its own runc and crun. As /usr/local/bin comes first in PATH, those shadow the runtimes installed by this script: the tests were run with runc 1.4.3 rather than the pinned 1.5.1, and, worse, with a crun built without systemd support: crun version 1.28 +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +JSON_C CRI-O's test suite uses the systemd cgroup manager, so every container creation failed with "systemd not supported: Not supported", failing all cri-o jobs. Remove all the pre-installed runc and crun binaries (in addition to the bundle, docker brings its own /usr/bin/runc), and check that none is left before installing ours, so that a future image change fails loudly rather than silently testing something else. As /usr/bin/runc is now removed, install our runc there, rather than to /usr/sbin. This also means the conmon test suite, which defaults to RUNTIME_BINARY=/usr/bin/runc, now tests with the pinned runc version. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
install_critools clones cri-tools from the main branch, meaning we run whatever critest conformance tests are currently in development, against a cri-o that does not implement the corresponding features yet. Right now this results in two failures: [FAIL] [k8s.io] PodSandbox runtime should support metrics operations [It] runtime should support returning metrics descriptors [Conformance] [FAIL] [k8s.io] PodSandbox runtime should support metrics operations [It] runtime should support listing pod sandbox metrics [Conformance] as cri-o only reports the pod metric descriptors listed in its included_pod_metrics setting, which is empty by default. As we test against the cri-o main branch, there is no fixed cri-tools version to pin to. Instead, take the version from the cri-o sources we have just cloned, so the two can never get out of sync. This is done in install_testdeps, which now calls install_critools -- critest and crictl are cri-o test dependencies, just like ginkgo installed there. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
cri-o's test runner always makes two bats passes, the second one being
for serial tests:
execute bats --jobs "$JOBS" --tap "${TESTS[@]}" --filter-tags '!crio:serial'
execute bats --tap "${TESTS[@]}" --filter-tags 'crio:serial'
When critest is requested, TESTS is set to critest.bats, which has a
single test, and it is not tagged as serial. Thus, the second pass ends
up with an empty test suite, which bats v1.14.0 treats as an error:
+ bats --tap critest.bats --filter-tags crio:serial
1..0
ERROR: Found no tests. (Try `--allow-empty-suite`?)
##[error]Process completed with exit code 1.
This is a behavior change introduced in bats v1.14.0 (see "exit with
error when no tests are found" in [1]); cri-o itself is tested with
v1.12.0 and so is not affected.
Pin bats to the last version without this behavior, and remove the
renovate annotation so it won't be bumped back.
[1] https://github.com/bats-core/bats-core/releases/tag/v1.14.0
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kolyshkin
force-pushed
the
ci-unshadow-runtimes
branch
from
August 16, 2026 21:55
b64b2d3 to
5d9b5da
Compare
This was referenced Aug 16, 2026
Collaborator
|
Filed cri-o/cri-o#10244 to avoid downstream workarounds. |
jnovy
added a commit
to jnovy/cri-o
that referenced
this pull request
Aug 17, 2026
bats v1.14.0 changed behavior: an empty test suite is now a hard error. This breaks downstream consumers (e.g. conmon CI) that run the test runner with a subset of tests. When conmon runs critest, TESTS is set to critest.bats which has a single test with no tags. The serial pass (--filter-tags 'crio:serial') finds zero matching tests and fails with an empty suite error. Bump bats from v1.12.0 to v1.14.0 and add --allow-empty-suite to both bats invocations so that filtered passes with no matching tests succeed rather than error out. Ref: containers/conmon#672 Signed-off-by: Jindrich Novy <jnovy@redhat.com>
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Assorted CI fixes to make CI green again:
crunandrunc, ensuring the test is run with the ones we built.See individual commits for details.