~

.bazelrc

@@ -1,8 +1,15 @@
 # Global bazelrc file, see https://docs.bazel.build/versions/master/guide.html#bazelrc.
 
+# Use local Cache directory if building on a VM:
+# On Chef VM, create a directory and comment in the following line:
+# build --disk_cache=</tmp/bazel/> # Optional for multi-user cache: Make this directory owned by a group name e.g. "bazelcache"
+
 # Use strict action env to prevent leaks of env vars.
 build --incompatible_strict_action_env
 
+# Use cache
+# build --disk_cache=/tmp/bazel/cache # must not be merged dev only settng
+
 # Only pass through GH_API_KEY for stamped builds.
 # This is still not ideal as it still busts the cache of stamped builds.
 build:stamp --stamp

.github/workflows/build_and_test.yaml

@@ -35,36 +35,36 @@ jobs:
     with:
       image-base-name: "dev_image_with_extras"
       ref: ${{ needs.env-protect-setup.outputs.ref }}
-  clang-tidy:
-    runs-on: oracle-16cpu-64gb-x86-64
-    needs: [authorize, env-protect-setup, get-dev-image]
-    container:
-      image: ${{ needs.get-dev-image.outputs.image-with-tag }}
-    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-      with:
-        fetch-depth: 0
-        ref: ${{ needs.env-protect-setup.outputs.ref }}
-    - name: Add pwd to git safe dir
-      run: git config --global --add safe.directory `pwd`
-    - name: get bazel config
-      uses: ./.github/actions/bazelrc
-      with:
-        BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
-    - name: Save Diff Info
-      run: ./ci/save_diff_info.sh
-    - name: Run Clang Tidy
-      shell: bash
-      run: |
-        diff_file="diff_origin_main_cc"
-        if [[ "${{ github.event_name }}" == "push" ]] || [[ "${{ github.event_name }}" == "schedule" ]]; then
-          diff_file="diff_head_cc"
-        fi
-        ./ci/run_clang_tidy.sh -f "${diff_file}"
+  # clang-tidy:
+  #   runs-on: oracle-vm-16cpu-64gb-x86-64
+  #   needs: [authorize, env-protect-setup, get-dev-image]
+  #   container:
+  #     image: ${{ needs.get-dev-image.outputs.image-with-tag }}
+  #   steps:
+  #   - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+  #     with:
+  #       fetch-depth: 0
+  #       ref: ${{ needs.env-protect-setup.outputs.ref }}
+  #   - name: Add pwd to git safe dir
+  #     run: git config --global --add safe.directory `pwd`
+  #   - name: get bazel config
+  #     uses: ./.github/actions/bazelrc
+  #     with:
+  #       BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
+  #   - name: Save Diff Info
+  #     run: ./ci/save_diff_info.sh
+  #   - name: Run Clang Tidy
+  #     shell: bash
+  #     run: |
+  #       diff_file="diff_origin_main_cc"
+  #       if [[ "${{ github.event_name }}" == "push" ]] || [[ "${{ github.event_name }}" == "schedule" ]]; then
+  #         diff_file="diff_head_cc"
+  #       fi
+  #       ./ci/run_clang_tidy.sh -f "${diff_file}"
   code-coverage:
     if: github.event_name == 'push'
     needs: [authorize, env-protect-setup, get-dev-image]
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
     steps:
@@ -85,10 +85,10 @@ jobs:
       run: |
         # Github actions container runner creates a docker network without IPv6 support. We enable it manually.
         sysctl -w net.ipv6.conf.lo.disable_ipv6=0
-        ./ci/collect_coverage.sh -u -b main -c "$(git rev-parse HEAD)" -r pixie-io/pixie
+        ./ci/collect_coverage.sh -u -b main -c "$(git rev-parse HEAD)" -r k8sstormcenter/pixie
   generate-matrix:
     needs: [authorize, env-protect-setup, get-dev-image]
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
     outputs:
@@ -120,7 +120,7 @@ jobs:
           bazel_tests_*
   build-and-test:
     needs: [authorize, env-protect-setup, get-dev-image, generate-matrix]
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     permissions:
       contents: read
       actions: read
@@ -154,12 +154,27 @@ jobs:
           ${{ matrix.args }} \
           --target_pattern_file=target_files/${{ matrix.buildables }} \
           2> >(tee bazel_stderr)
+    - name: Debug Docker networking
+      if: ${{ matrix.tests }}
+      shell: bash
+      run: |
+        docker info
+        docker network inspect bridge
+        docker run --rm postgres:13.3 echo "pull works"
+        CID=$(docker run -d --rm -e POSTGRES_PASSWORD=secret postgres:13.3)
+        sleep 2
+        docker inspect "$CID" --format '{{json .NetworkSettings}}' | jq '{Gateway: .Gateway, IPAddress: .IPAddress, Bridge: .Bridge, Networks: .Networks}'
+        docker stop "$CID"
     - name: Test ${{ matrix.name }}
       if: ${{ matrix.tests }}
       shell: bash
       run: |
         # Github actions container runner creates a docker network without IPv6 support. We enable it manually.
         sysctl -w net.ipv6.conf.lo.disable_ipv6=0
+
+        # Our qemu builds require unprivileged user namespaces to run.
+        sysctl -w kernel.unprivileged_userns_clone=1
+        sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
         ./scripts/bazel_ignore_codes.sh test ${{ matrix.args }} --target_pattern_file=target_files/${{ matrix.tests }} \
           2> >(tee bazel_stderr)
     - name: Parse junit reports
@@ -181,19 +196,18 @@ jobs:
       shell: bash
   build-and-test-status:
     if: always()
-    needs: [build-and-test, clang-tidy, generate-matrix]
+    needs: [build-and-test, generate-matrix]
     runs-on: ubuntu-latest
     steps:
-    - if: needs.build-and-test.result == 'success' && needs.clang-tidy.result == 'success'
+    - if: needs.build-and-test.result == 'success'
       run: echo "Build and Test complete ✓"
     - if: >
-        needs.generate-matrix.result == 'success' && needs.clang-tidy.result == 'success'
+        needs.generate-matrix.result == 'success'
         && needs.build-and-test.result == 'skipped'
       run: echo "Build and Test skipped no matrix configs generated ✓"
     - if: >
-        !(needs.build-and-test.result == 'success' && needs.clang-tidy.result == 'success') &&
+        !(needs.build-and-test.result == 'success') &&
         !(needs.generate-matrix.result == 'success' &&
-          needs.clang-tidy.result == 'success' &&
           needs.build-and-test.result == 'skipped')
       run: |
         echo "Build and Test failed"

.github/workflows/cacher.yaml

@@ -12,7 +12,7 @@ jobs:
     with:
       image-base-name: "dev_image"
   populate-caches:
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}

.github/workflows/cli_release.yaml

@@ -15,7 +15,7 @@ jobs:
       image-base-name: "dev_image_with_extras"
   build-release:
     name: Build Release
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
@@ -42,18 +42,13 @@ jobs:
         BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
       run: |
         echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
-    - id: gcloud-creds
-      uses: ./.github/actions/gcloud_creds
-      with:
-        SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
     - name: Build & Push Artifacts
       env:
         REF: ${{ github.event.ref }}
         BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         BUILD_NUMBER: ${{ github.run_attempt }}
         JOB_NAME: ${{ github.job }}
-        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
       shell: bash
       run: |
         export TAG_NAME="${REF#*/tags/}"
@@ -66,13 +61,6 @@ jobs:
       with:
         name: linux-artifacts
         path: artifacts/
-    - name: Update GCS Manifest
-      env:
-        ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
-        # Use the old style versions file instead of the new updates for the gcs manifest.
-        MANIFEST_UPDATES: ""
-        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
-      run: ./ci/update_artifact_manifest.sh
     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
       with:
         name: artifact-upload-log
@@ -131,18 +119,13 @@ jobs:
         BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
       run: |
         echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
-    - id: gcloud-creds
-      uses: ./.github/actions/gcloud_creds
-      with:
-        SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
     - name: Add pwd to git safe dir
       run: |
         git config --global --add safe.directory `pwd`
     - name: Upload signed CLI
       env:
         REF: ${{ github.event.ref }}
         BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
-        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
         ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
       shell: bash
       run: |
@@ -188,7 +171,7 @@ jobs:
           --notes $'Pixie CLI Release:\n'"${changelog}"
         gh release upload "${TAG_NAME}" linux-artifacts/* macos-artifacts/*
   update-gh-artifacts-manifest:
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: [get-dev-image, create-github-release]
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
@@ -217,8 +200,8 @@ jobs:
       env:
         BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
       run: |
-        git config --global user.name 'pixie-io-buildbot'
-        git config --global user.email 'build@pixielabs.ai'
+        git config --global user.name 'k8sstormcenter-buildbot'
+        git config --global user.email 'info@fusioncore.ai'
         git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
         git config --global commit.gpgsign true
     - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0

.github/workflows/cloud_release.yaml

@@ -15,8 +15,11 @@ jobs:
       image-base-name: "dev_image_with_extras"
   build-release:
     name: Build Release
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
+    permissions:
+      contents: read
+      packages: write
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
     steps:
@@ -30,15 +33,13 @@ jobs:
       with:
         download_toplevel: 'true'
         BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
-    - id: gcloud-creds
-      uses: ./.github/actions/gcloud_creds
-      with:
-        SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
     - name: Import GPG key
       env:
         BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
       run: |
         echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
+    - name: Login to GHCR
+      run: echo "${{ github.token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
     - name: Build & Push Artifacts
       env:
         REF: ${{ github.event.ref }}
@@ -47,7 +48,6 @@ jobs:
         GH_API_KEY: ${{ secrets.GITHUB_TOKEN }}
         COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
         COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
-        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
         BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
       shell: bash
       run: |

.github/workflows/codeql.yaml

@@ -28,7 +28,7 @@ jobs:
       with:
         category: "/language:go"
   analyze-python:
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     permissions:
       actions: read
       contents: read
@@ -42,7 +42,7 @@ jobs:
       with:
         category: "/language:python"
   analyze-javascript:
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     permissions:
       actions: read
       contents: read

.github/workflows/operator_release.yaml

@@ -15,8 +15,11 @@ jobs:
       image-base-name: "dev_image_with_extras"
   build-release:
     name: Build Release
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
+    permissions:
+      contents: read
+      packages: write
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
     env:
@@ -33,23 +36,20 @@ jobs:
       with:
         download_toplevel: 'true'
         BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
-    - id: gcloud-creds
-      uses: ./.github/actions/gcloud_creds
-      with:
-        SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
     - name: Import GPG key
       env:
         BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
       run: |
         echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
+    - name: Login to GHCR
+      run: echo "${{ github.token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
     - name: Build & Push Artifacts
       env:
         REF: ${{ github.event.ref }}
         BUILD_NUMBER: ${{ github.run_attempt }}
         JOB_NAME: ${{ github.job }}
         COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
         COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
-        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
         GH_REPO: ${{ github.repository }}
         BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
       shell: bash
@@ -60,13 +60,6 @@ jobs:
         mkdir -p "${ARTIFACTS_DIR}"
         ./ci/save_version_info.sh
         ./ci/operator_build_release.sh
-    - name: Update GCS Manifest
-      env:
-        ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
-        # Use the old style versions file instead of the new updates for the gcs manifest.
-        MANIFEST_UPDATES: ""
-        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
-      run: ./ci/update_artifact_manifest.sh
     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
       with:
         name: manifest-updates
@@ -127,8 +120,8 @@ jobs:
       env:
         GIT_SSH_COMMAND: "ssh -i /tmp/ssh.key"
       run: |
-        git config --global user.name 'pixie-io-buildbot'
-        git config --global user.email 'build@pixielabs.ai'
+        git config --global user.name 'k8sstormcenter-buildbot'
+        git config --global user.email 'info@fusioncore.ai'
     - name: Push Helm YAML to gh-pages
       shell: bash
       env:
@@ -142,7 +135,7 @@ jobs:
         git commit -s -m "Release Helm chart ${VERSION}"
         git push origin "gh-pages"
   update-gh-artifacts-manifest:
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: [get-dev-image, create-github-release]
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
@@ -171,8 +164,8 @@ jobs:
       env:
         BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
       run: |
-        git config --global user.name 'pixie-io-buildbot'
-        git config --global user.email 'build@pixielabs.ai'
+        git config --global user.name 'k8sstormcenter-buildbot'
+        git config --global user.email 'info@fusioncore.ai'
         git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
         git config --global commit.gpgsign true
     - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0

.github/workflows/pr_genfiles.yml

@@ -13,7 +13,7 @@ jobs:
     with:
       image-base-name: "dev_image"
   run-genfiles:
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}