spread.yaml

project: borescope
kill-timeout: 30m
workers: 1

environment:
  CI: "$(HOST: echo $CI)"
  PEBBLE_VERSION: "${PEBBLE_VERSION:-v1.32.1}"

backends:
  lxd:
    type: adhoc
    allocate: |
      BASE="${BASE:-noble}"
      VM_NAME="${VM_NAME:-borescope-ubuntu-${BASE}-${RANDOM}}"
      DISK="${DISK:-10}"
      CPU="${CPU:-2}"
      MEM="${MEM:-4}"

      cloud_config="$(mktemp)"
      sed "s|SPREAD_PASSWORD|$SPREAD_PASSWORD|g" tests/cloud-config.yaml > "$cloud_config"

      lxc launch --vm \
        "ubuntu:${BASE}" \
        "${VM_NAME}" \
        -c user.user-data="$(cat "$cloud_config")" \
        -c limits.cpu="${CPU}" \
        -c limits.memory="${MEM}GiB" \
        -d root,size="${DISK}GiB"

      # Wait for the spread user
      while ! lxc exec "${VM_NAME}" -- id -u spread &>/dev/null; do sleep 0.5; done

      rm "$cloud_config"

      # Set the instance address for spread
      ADDRESS "$(lxc ls -f csv | grep "${VM_NAME}" | cut -d"," -f3 | cut -d" " -f1)"
    discard: |
      instance_name="$(lxc ls -f csv | grep borescope | grep $SPREAD_SYSTEM_ADDRESS | cut -f1 -d",")"
      lxc delete -f $instance_name

    systems:
      - ubuntu-24.04:
          username: spread
          workers: 1

  github-ci:
    type: adhoc
    manual: true
    allocate: |
      sudo sed -i "s|#PasswordAuthentication yes|PasswordAuthentication yes|g" /etc/ssh/sshd_config
      sudo sed -i "s|KbdInteractiveAuthentication no|KbdInteractiveAuthentication yes|g" /etc/ssh/sshd_config
      sudo rm -f /etc/ssh/sshd_config.d/60-cloudimg-settings.conf /etc/ssh/sshd_config.d/50-cloud-init.conf
      sudo systemctl daemon-reload
      sudo systemctl restart ssh

      sudo useradd spread -s /bin/bash -m
      echo "spread:$SPREAD_PASSWORD" | sudo chpasswd
      echo 'spread ALL=(ALL) NOPASSWD:ALL ' | sudo tee /etc/sudoers.d/99-spread-user

      ADDRESS "127.0.0.1"
    discard: |
      sudo userdel -f -r spread || true
      sudo rm -f /etc/sudoers.d/99-spread-user

    systems:
      - ubuntu-24.04:
          username: spread
          workers: 1

suites:
  tests/spread/:
    summary: POSIX conformance and shell-language spread tests

exclude:
  - dist/
  - .git
  - .github
  - .venv

# Spread executes tasks as root; keep the project under /root so the borescope
# venv and Pebble socket live somewhere unconfined paths can reach.
path: /root/proj

prepare: |
  snap refresh --hold
  if systemctl is-enabled unattended-upgrades.service; then
    systemctl stop unattended-upgrades.service || echo 'Self-hosted runner?'
    systemctl mask unattended-upgrades.service
  fi

  pushd "$SPREAD_PATH"

  # uv installs into /root/.local/bin; lib.sh re-exports that on PATH for
  # tasks (spread runs them in non-login shells, so /etc/profile.d/ is moot).
  if ! command -v uv >/dev/null; then
    curl -LsSf https://astral.sh/uv/install.sh | sh
  fi
  export PATH="/root/.local/bin:$PATH"

  # Sync the project venv once so tasks just run `uv run borescope`.
  uv sync --group dev

  # Install a Pebble binary on PATH. We pin a version (overridable via
  # PEBBLE_VERSION); Pebble ships release tarballs on GitHub.
  if ! command -v pebble >/dev/null; then
    arch="$(dpkg --print-architecture)"
    tarball="pebble_${PEBBLE_VERSION}_linux_${arch}.tar.gz"
    # --fail so a 4xx/5xx HTML error page never gets piped into tar, and
    # --retry to ride out transient GitHub release-asset CDN hiccups.
    curl -fL --retry 5 --retry-delay 2 --retry-all-errors \
      -o "/tmp/${tarball}" \
      "https://github.com/canonical/pebble/releases/download/${PEBBLE_VERSION}/${tarball}"
    tar -xzf "/tmp/${tarball}" -C /usr/local/bin pebble
    rm "/tmp/${tarball}"
  fi
  pebble version