build-kernel.yaml

name: Build Kernel

on:
  workflow_dispatch:
    inputs:
      kernel_version:
        description: 'Kernel version to build'
        required: false
        default: '6.18.32'
  push:
    branches:
      - main

permissions:
  id-token: write
  # contents: write lets each build push a per-artifact source tag (GPL
  # complete-corresponding-source correspondence).
  contents: write

env:
  KERNEL_VERSION: ${{ inputs.kernel_version || '6.18.32' }}

jobs:
  build-kernel:
    name: Build Kernel (${{ matrix.arch }} / ${{ matrix.flavor }})
    runs-on:
      group: Default Larger Runners
    strategy:
      fail-fast: false
      matrix:
        arch: [x86_64, arm64]
        # base = pre-eBPF kernel; ebpf = eBPF tracing stack + BTF (for Tetragon).
        flavor: [base, ebpf]
        include:
          - arch: x86_64
            build_arch: x86_64
            cross_compile_pkgs: ""
          - arch: arm64
            build_arch: aarch64
            cross_compile_pkgs: gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu
          - flavor: base
            build_type_arg: ""
            tarball_suffix: ""
          - flavor: ebpf
            build_type_arg: "-b ebpf"
            tarball_suffix: "-ebpf"

    steps:
      - name: Checkout
        uses: runloopai/checkout@main

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            bc \
            bison \
            build-essential \
            cpio \
            curl \
            dwarves \
            flex \
            git \
            libelf-dev \
            libssl-dev \
            python3 \
            rsync \
            ${{ matrix.cross_compile_pkgs }}

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod a+x /usr/local/bin/yq

      - name: Generate version string
        id: version
        run: |
          DATE=$(date +%Y%m%d)
          SHORT_SHA=$(git rev-parse --short=7 HEAD)
          VERSION_STRING="linux-${{ env.KERNEL_VERSION }}-runloop-${DATE}-${SHORT_SHA}"
          echo "version_string=${VERSION_STRING}" >> $GITHUB_OUTPUT
          echo "Generated version: ${VERSION_STRING}"

      - name: Setup kernel source
        working-directory: packaging/kernel
        run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} -f -s setup

      - name: Build kernel
        working-directory: packaging/kernel
        run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} build

      - name: Verify BTF symbols are present
        if: matrix.flavor == 'ebpf'
        working-directory: packaging/kernel
        run: |
          # setup runs with -s (skip config checks), so a dropped BTF option
          # would not fail the build — it would silently ship a BTF-less kernel
          # that crashes Tetragon and other CO-RE agents at startup. Guard both
          # the config and the generated .BTF section in vmlinux.
          kernel_dir=$(find . -maxdepth 1 -type d -name 'kata-linux-*' | head -n1)
          [ -n "${kernel_dir}" ] || { echo "ERROR: kernel build dir not found" >&2; exit 1; }
          echo "Checking BTF in ${kernel_dir}"
          if ! grep -q '^CONFIG_DEBUG_INFO_BTF=y' "${kernel_dir}/.config"; then
            echo "ERROR: CONFIG_DEBUG_INFO_BTF was dropped from .config" >&2
            echo "--- DEBUG_KERNEL / DEBUG_INFO / PAHOLE / BTF state ---" >&2
            grep -E 'DEBUG_KERNEL|DEBUG_INFO|PAHOLE|BTF' "${kernel_dir}/.config" >&2 || true
            exit 1
          fi
          if ! readelf -S "${kernel_dir}/vmlinux" | grep -q '\.BTF'; then
            echo "ERROR: vmlinux has no .BTF section; BTF symbols were not generated" >&2
            exit 1
          fi
          echo "OK: BTF symbols present in vmlinux"

      - name: Install kernel artifacts
        working-directory: packaging/kernel
        run: |
          mkdir -p ${{ github.workspace }}/artifacts
          DESTDIR=${{ github.workspace }}/artifacts ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} install

      - name: Create tarball
        id: tarball
        run: |
          TARBALL_NAME="${{ steps.version.outputs.version_string }}-${{ matrix.arch }}${{ matrix.tarball_suffix }}.tar.gz"
          echo "tarball_name=${TARBALL_NAME}" >> $GITHUB_OUTPUT
          cd ${{ github.workspace }}/artifacts/usr/share/kata-containers
          echo "Creating tarball with:"
          ls -la
          tar -cvzf ${{ github.workspace }}/${TARBALL_NAME} .
          echo "Tarball created: ${TARBALL_NAME}"
          ls -lh ${{ github.workspace }}/${TARBALL_NAME}

      - name: Configure AWS credentials
        uses: runloopai/configure-aws-credentials@main
        with:
          role-to-assume: arn:aws:iam::992382648534:role/Github-OIDC-Deploy-Role
          aws-region: us-east-2

      - name: Upload to S3
        run: |
          S3_PATH="s3://runloop-apt-prod-us-east-2/microvm-kernel/${{ steps.tarball.outputs.tarball_name }}"
          echo "Uploading to: ${S3_PATH}"
          aws s3 cp ${{ github.workspace }}/${{ steps.tarball.outputs.tarball_name }} "${S3_PATH}"
          echo "Upload complete"

      - name: Upload artifacts to GitHub
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: kernel-${{ matrix.arch }}-${{ matrix.flavor }}-${{ steps.version.outputs.version_string }}
          path: ${{ github.workspace }}/${{ steps.tarball.outputs.tarball_name }}
          retention-days: 7

      - name: Tag source for this artifact
        # Push a git tag named after the tarball (sans extension) so every
        # shipped kernel binary maps to the exact source commit that built it.
        # Idempotent: re-runs of a commit skip the push if the tag exists.
        env:
          TARBALL_NAME: ${{ steps.tarball.outputs.tarball_name }}
        run: |
          TAG_NAME="${TARBALL_NAME%.tar.gz}"
          if git ls-remote --exit-code origin "refs/tags/${TAG_NAME}" >/dev/null 2>&1; then
            echo "Tag ${TAG_NAME} already exists; skipping"
          else
            git tag "${TAG_NAME}" HEAD
            git push origin "refs/tags/${TAG_NAME}"
            echo "Pushed tag ${TAG_NAME}"
          fi

  upload-summary:
    name: Upload Summary
    runs-on: ubuntu-slim
    needs: build-kernel
    if: always() && needs.build-kernel.result == 'success'
    steps:
      - name: Checkout
        uses: runloopai/checkout@main

      - name: Generate version string
        id: version
        run: |
          DATE=$(date +%Y%m%d)
          SHORT_SHA=$(git rev-parse --short=7 HEAD)
          KERNEL_VERSION="${{ inputs.kernel_version || '6.18.32' }}"
          VERSION_STRING="linux-${KERNEL_VERSION}-runloop-${DATE}-${SHORT_SHA}"
          echo "version_string=${VERSION_STRING}" >> $GITHUB_OUTPUT

      - name: Configure AWS credentials
        uses: runloopai/configure-aws-credentials@main
        with:
          role-to-assume: arn:aws:iam::992382648534:role/Github-OIDC-Deploy-Role
          aws-region: us-east-2

      - name: List uploaded artifacts
        run: |
          echo "### === S3 Upload Summary ===" >> $GITHUB_STEP_SUMMARY
          echo "Version: ${{ steps.version.outputs.version_string }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Uploaded files:" >> $GITHUB_STEP_SUMMARY
          aws s3 ls "s3://runloop-apt-prod-us-east-2/microvm-kernel/" | grep "${{ steps.version.outputs.version_string }}" >> $GITHUB_STEP_SUMMARY