Repository navigation
Expose versions.json as Github Actions test matrix - #96
Merged
Merged
Conversation
…on fields This makes the process a little more readable and understandable. Add a 'channel' field to versions.json to be used in a follow-up commit. Rename static_tag to image_tag since it felt a little confusing. AIL:3 Signed-off-by: Timo Beckers <timo@isovalent.com>
When testing locally, it can be a pain to figure out where the images are again, especially after not having touched the repo in a few months. This change puts it front and center and makes sure it stays updated. AIL:3 Signed-off-by: Timo Beckers <timo@isovalent.com>
Since ae9bece, build_arm64 has been true on all call sites. Make it baseline. Signed-off-by: Timo Beckers <timo@isovalent.com>
ti-mo
force-pushed
the
tb/expose-matrix
branch
4 times, most recently
from
September 27, 2026 19:16
b86cee1 to
758c8d4
Compare
…mption Signed-off-by: Timo Beckers <timo@isovalent.com>
Signed-off-by: Timo Beckers <timo@isovalent.com>
build-and-push was starting to show its age, and the workflow yaml was starting to absorb a lot of logic as bash-in-yaml, which wasn't super robust. The root directory was also getting crowded, which made it difficult to establish which files were affecting the build output and which weren't. I ended up splitting things into three directories: - build/: for all files involved in the live build process: (kernel) configs, scripts and the Dockerfile. - toolchain/: for building and configuring the GCC and LLVM toolchain involved in building kernels. - scripts/: automation for managing versions.json and scripts invoked by GHA workflows. As a result, we can now hash the contents of build/, which, paired with the versions described in versions.json, can be used to drive an idempotent build pipeline saving us a lot of CI and iteration time, and even allows for local builds + pushes if necessary. The logic for making this all happen has been extracted into local-friendly shell scripts that can be linted and run locally. We can now make changes to scripts/ without letting CI spend an hour rebuilding the world. AIL:3 since I was and still am clueless about GHA. Signed-off-by: Timo Beckers <timo@isovalent.com>
ti-mo
force-pushed
the
tb/expose-matrix
branch
2 times, most recently
from
September 27, 2026 20:04
a35cd75 to
0d3bb8e
Compare
ti-mo
marked this pull request as ready for review
September 27, 2026 20:18
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Critical publishing and promotion issues, plus ordering and release-tag collision issues, remain unresolved.
Review effort: Lite
Findings: 2
Open (3)
What changed in this PR
This pull request reorganizes kernel image builds and exposes supported versions through a reusable GitHub Actions matrix.
Changes:
- Adds generated version metadata and matrix filtering.
- Reorganizes build, toolchain, and operational scripts.
- Adds candidate image builds, testing, promotion, tagging, and documentation.
Review findings include unresolved publishing and promotion risks, matrix ordering and release-tag collision issues, plus a documentation typo.
| File | Description |
|---|---|
versions.json |
Removes legacy version metadata. |
update-versions.sh |
Replaced by the Python updater. |
toolchain/VERSION |
Updates the builder version. |
toolchain/Makefile |
Builds the toolchain. |
toolchain/llvm.pref |
Adds LLVM package pinning. |
toolchain/llvm.list |
Adds LLVM repositories. |
toolchain/llvm-snapshot.gpg.key |
Adds the repository signing key. |
toolchain/Dockerfile |
Defines the builder image. |
scripts/update-versions.py |
Generates version metadata and README tables. |
scripts/test-kernel.sh |
Adds kernel smoke testing. |
scripts/tag.sh |
Creates release tags; collision handling requires changes. |
scripts/promote.sh |
Promotes candidate images; debug candidate handling requires changes. |
scripts/image-exists.sh |
Checks registry manifests. |
scripts/candidate-tag.sh |
Generates content-addressed tags. |
scripts/buildx.sh |
Provides a local build helper. |
README.md |
Documents versions, images, and matrix usage. |
matrix/versions.json |
Publishes supported kernel versions. |
matrix/action.yml |
Provides the reusable filtered matrix action. |
buildx.sh |
Replaced by the scripts helper. |
build/README.md |
Documents build inputs and hashing. |
build/filter-debug.awk |
Extracts referenced debug sources. |
build/env.sh |
Configures build architecture variables. |
build/download.sh |
Downloads kernel sources. |
build/Dockerfile |
Defines kernel build stages. |
build/copy-selftests.sh |
Packages BPF selftests. |
build/copy-debug.sh |
Packages debug artifacts. |
build/configure-vmlinux.sh |
Merges and validates kernel configuration. |
build/config-x86_64 |
Adds x86-64 configuration. |
build/config-arm64 |
Adds ARM64 configuration. |
build/config |
Adds common kernel configuration. |
build/ccache.conf |
Configures compiler caching. |
build/build-vmlinux.sh |
Builds the kernel image. |
build/build-selftests.sh |
Builds BPF selftests. |
build-selftests.sh |
Replaced by the build-directory helper. |
.github/workflows/tidy.yml |
Updates checkout action usage. |
.github/workflows/images.yml |
Uses the matrix action and release tagging. |
.github/workflows/build-and-push.yml |
Adds candidate builds and promotion; PR publishing permissions require changes. |
.github/dependabot.yml |
Enables GitHub Actions dependency updates. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: Timo Beckers <timo@isovalent.com>
Signed-off-by: Timo Beckers <timo@isovalent.com>
GHA's warnings about Node 20 deprecations were piling up and cluttering our build summaries. Signed-off-by: Timo Beckers <timo@isovalent.com>
To allow importers to follow along at their own pace, give the repository tags automatically on merges to main when any changes are made to ./matrix. Three tag tiers are maintained: - v7.3.202609271941 as a unique, non-floating tag - v7.3 floating tag to follow along with the current minor version - v7 floating tag to follow along with the major version Signed-off-by: Timo Beckers <timo@isovalent.com>
ti-mo
force-pushed
the
tb/expose-matrix
branch
from
September 29, 2026 12:43
0d3bb8e to
e759c3b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since I'd like to start using ci-kernels for other projects, and I know some folks in the community (inspektor, elastic, ..) have been relying on these for a few years, this is my proposal for making the whole experience a little more user-friendly. This includes a GHA workflow for driving a vimto test matrix.
matrixaction lets other repos drive vimto test matrices from versions.json, filterable by channelv7,v7.3,v7.3.<ts>) so callers can pin and let Dependabot track updates-selfteststags may trail and failures are surfaced in the CI summaryLarge parts of this PR are AIL:4 but heavily edited and iterated on by me.