ci(linux-kvm): make the lane gate-ready — changes filter, aggregator, apt retries by norrietaylor · Pull Request #698 · gominimal/minimal

norrietaylor · 2026-07-10T00:34:13Z

What

PR5 of the CI refactor (#687). Off main, independent of the mac stack.

Converts the KVM lane to the always-triggered pattern so it can become a required check after a soak:

Trigger-level path filter → changes job (dorny/paths-filter, SHA-pinned v3.0.2, pull-requests: read). Same path list, now evaluated inside the workflow; workflow_dispatch runs everything. The header documents why trigger-level paths: must never return: a required context skipped by one stays "Expected" forever and wedges the PR.
New if: always() aggregator ci-linux-kvm-success — green when the e2e passed or was path-skipped, red only on failure/cancellation. It joins the ruleset after the lane soaks green (admin step in feature: CI refactor — clear build/test phases, three gating targets #687); until then the lane stays advisory exactly as today.
Evidence-backed apt retries (scripts/ci/retry.sh, 3×10s): mining ~200 runs per VM lane found zero failures in the artifact/libkrun/gvproxy fetches but a consistent transient class in apt — the only main-branch KVM failure in the window (run 28897380911) and both of its manual re-runs died in Install build dependencies, and the mac artifacts job failed twice in Install protoc. Those three call sites (KVM deps, setup-rust protoc, mac-artifacts protoc) are now retried; fetches stay un-retried.

Verification

actionlint — no new findings (one pre-existing SC2012 carried over verbatim). This PR triggers the lane itself (always-triggered now), so its own run exercises the changes-gate, the retried apt step, and the aggregator.

🤖 Generated with Claude Code

Summary by CodeRabbit

CI Improvements
- Improved Linux/KVM test workflow efficiency by running only when relevant changes are detected.
- Added reliable status reporting for the Linux/KVM test lane.
- Enabled prebuilt test binaries to run consistently across different environments.
Bug Fixes
- Improved executable discovery for end-to-end tests when build and test paths differ.
- Improved installation reliability for required protocol-buffer tooling in CI.

… apt retries Converts the KVM lane to the always-triggered pattern (#687): the trigger-level path filter moves into a `changes` job (dorny/paths-filter, SHA-pinned, pull-requests: read), the e2e gates on its output (workflow_dispatch runs everything), and a new `if: always()` aggregator — ci-linux-kvm-success — reports success when the e2e passed OR was path-skipped and red only on failure/cancellation. The context joins the required checks after the lane soaks green; until then the lane stays advisory exactly as before. Retries apt installs, the one step class with recorded transient failures in lane history: the sole main-branch KVM failure (run 28897380911) and both of its manual re-runs died in "Install build dependencies", and the macOS artifacts job failed twice in "Install protoc". scripts/ci/retry.sh wraps those three call sites (KVM deps, setup-rust protoc, mac-artifacts protoc); fetches stay un-retried — zero recorded failures. Refs: #687 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

coderabbitai · 2026-07-10T00:34:29Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 39a2da2f-051b-4ea2-9e33-ac96f11f8903

📥 Commits

Reviewing files that changed from the base of the PR and between 90df500 and 627fb0b.

📒 Files selected for processing (3)

.github/actions/setup-rust/action.yml
.github/workflows/ci-linux-kvm.yml
.github/workflows/ci-macos.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/ci-linux-kvm.yml

📝 Walkthrough

Walkthrough

Changes

CI resilience and KVM test execution

Layer / File(s)	Summary
KVM change detection and runner setup `.github/workflows/ci-linux-kvm.yml`, `.github/actions/setup-rust/action.yml`, `.github/workflows/ci-macos.yml`	The KVM workflow moves change filtering into a `changes` job, gates build execution, and consolidates privileged package installation commands. Protobuf installation uses the same shell wrapper in shared Rust and macOS setup.
KVM build and test packaging `.github/workflows/ci-linux-kvm.yml`	The build job stages `minvmd`, initramfs, hash-suffixed test harnesses, and the linked libkrun prefix into the uploaded `testbed` artifact.
Staged harness execution `scripts/ci/run-testbin.sh`, `.github/workflows/ci-linux-kvm.yml`, `crates/minvmd/tests/*_e2e.rs`	The KVM test job resolves and executes staged harnesses from `testbins.json`; E2E tests select `minvmd` through `MINVMD_BIN` with a Cargo-path fallback.
KVM status aggregation `.github/workflows/ci-linux-kvm.yml`	An always-running aggregator combines change-detection, build, and test outcomes into the lane result.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant changes
  participant build-linux
  participant test-kvm
  participant run-testbin.sh
  participant testbins.json
  participant minvmd
  changes->>build-linux: Gate KVM build on relevant changes
  build-linux->>test-kvm: Provide uploaded testbed artifact
  test-kvm->>run-testbin.sh: Request target harness execution
  run-testbin.sh->>testbins.json: Resolve hash-suffixed binary
  run-testbin.sh->>minvmd: Execute staged E2E harness
  minvmd-->>test-kvm: Return test result

Possibly related issues

gominimal/inbox#269 — Covers the KVM CI refactor involving change filtering, artifact separation, aggregation, and runtime binary selection.
gominimal/minimal#687 — Describes the artifact-based KVM build/test pipeline and workflow gating implemented here.

Possibly related PRs

gominimal/webapp#145 — Uses a similar dorny/paths-filter changes job to gate downstream CI work.
gominimal/minimal#466 — Also changes the KVM pipeline around libkrun prefix handling.
gominimal/minimal#685 — Introduces the shared Rust setup action updated here.

Suggested labels: github_actions

Suggested reviewers: twitchyliquid64, jtnkminimal, bryan-minimal

Poem

I hop through workflows, tidy and bright,
Staging test binaries just right.
With minvmd paths found at runtime,
KVM tests march in perfect time.
Green aggregator, carrots in view—
CI leaves a happy trail for you! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately points to the Linux KVM CI lane refactor, including the changes filter and success aggregator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

Remove scripts/ci/retry.sh and unwrap its three call sites (KVM build deps, setup-rust protoc, ci-macos artifacts protoc). One recorded apt transient in lane history does not justify carrying retry machinery; if apt flakes recur we can reintroduce it with fresh evidence. Refs: #687 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

norrietaylor · 2026-07-10T04:53:10Z

Dropped the apt retry wrapper per review discussion (627fb0b): scripts/ci/retry.sh deleted, its three call sites (KVM build deps, setup-rust protoc, artifacts protoc) unwrapped to plain installs. One recorded apt transient doesn't justify carrying the machinery — we'll cross that bridge with fresh evidence if flakes recur.

…e toolchain pin Two fallouts from this PR's own run: - clippy 1.97 flags for_kv_map at checkouts/src/lib.rs:287 - iterate git_remotes.values_mut() instead of discarding the key. The one-time lint surfacing is the point of pinning. - the native lane's changes filter and the mac lane's trigger paths did not include rust-toolchain.toml, so this PR's own lanes skipped: a toolchain bump must re-run every Rust lane. The KVM lane's filter gains the same entry on the #698 branch (its trigger section is rewritten there; touching main's copy would conflict). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

rust-toolchain.toml joins the KVM changes filter: a rustc bump must re-run every Rust lane. Applied here post-#698-merge (the filter's file was rewritten there). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

norrietaylor mentioned this pull request Jul 10, 2026

feature: CI refactor — clear build/test phases, three gating targets #687

Open

19 tasks

norrietaylor added 3 commits July 9, 2026 18:23

Merge branch 'main' into ci/kvm-gate-ready

39775ce

ci(linux-kvm): split the monolith into build and test phases (#699)

62ae1aa

Merge branch 'main' into ci/kvm-gate-ready

90df500

norrietaylor mentioned this pull request Jul 10, 2026

ci: adopt nextest profiles; reshape the KVM lane to its end state #702

Merged

twitchyliquid64 approved these changes Jul 10, 2026

View reviewed changes

norrietaylor enabled auto-merge (squash) July 10, 2026 05:00

norrietaylor merged commit 58cc3d3 into main Jul 10, 2026
18 checks passed

norrietaylor deleted the ci/kvm-gate-ready branch July 10, 2026 05:01

norrietaylor added a commit that referenced this pull request Jul 10, 2026

Merge origin/main (post-#698) into ci/kvm-lane-reshape

de795f1

This was referenced Jul 10, 2026

fix(ci): run the path filter only on pull_request events #706

Merged

ci: flip every lane to always-trigger with in-workflow gates #712

Merged

build(deps): bump the github-actions group across 1 directory with 3 updates #725

Closed

norrietaylor mentioned this pull request Jul 16, 2026

ci(macos): darwin testbed — the mini stops compiling #779

Merged

gominimal-aw-bot Bot mentioned this pull request Jul 22, 2026

CI: macOS lane doesn't trigger on .minimal/minimal.toml, so guest-kernel bumps merge without a VM boot #897

Closed

Navigation Menu

Uh oh!

ci(linux-kvm): make the lane gate-ready — changes filter, aggregator, apt retries - #698

ci(linux-kvm): make the lane gate-ready — changes filter, aggregator, apt retries#698
norrietaylor merged 5 commits into
mainfrom
ci/kvm-gate-ready

norrietaylor commented Jul 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

norrietaylor commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

norrietaylor commented Jul 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

norrietaylor commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

norrietaylor commented Jul 10, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading