Merge branch 'master' into changelogs-2.67.1

.github/actions/combine-results/action.yaml

@@ -0,0 +1,38 @@
+name: Combine results
+description: | 
+  Determines a single result from one or more results. A single skipped or
+  failed will cause the action to fail. Details for each job will be output 
+  as part of a results summary.
+
+inputs:
+  needs-json:
+    description: Job outputs in JSON format
+    required: true
+    type: string
+
+runs:
+  using: composite
+  steps:
+  - name: Summarise and combine results
+    shell: bash
+    run: |
+      # Possible results are success, failed, cancelled, and skipped
+      needs_results=$(echo '${{ inputs.needs-json }}' | jq -r 'to_entries[] | "\(.key) \(.value.result)"')
+
+      echo "Summary:"
+      failed="false"
+      while IFS=" " read -r job result; do
+        if [[ "$result" != "success" ]]; then
+          failed="true"
+          echo "- ❌ Job \"$job\" returned result \"$result\""
+        else
+          echo "- ✅ Job \"$job\" returned result \"$result\""
+        fi
+      done <<< "$needs_results"
+      
+      if [[ "$failed" == "false" ]]; then
+        echo "Overall result: success"
+      else
+        echo "Overall result: failure"
+        exit 1
+      fi 

.github/workflows/actions/download-install-debian-deps/action.yaml → .github/actions/download-install-debian-deps/action.yaml

@@ -26,3 +26,4 @@ runs:
     run: |
         sudo apt update
         sudo apt build-dep -y "${{ inputs.snapd-src-dir }}"
+        rm -rf ./debian-deps

.github/actions/resolve-go-channels/action.yaml

@@ -0,0 +1,158 @@
+name: Resolve Go snap channels
+description: |
+  Compiles a list of Go snap channels with unique versions according to the
+  given optional input flags and specific channels. Looks up the snapd build
+  and snapd FIPS build Go channels from build-aux/snap/snapcraft.yaml. Assumes
+  risk stable if not specified.
+
+inputs:
+  include-snapd-build-go-channel:
+    description: Flag instructing to include the channel of Go snap used to build Snapd snap
+    required: false
+    type: boolean
+  include-snapd-build-fips-go-channel:
+    description: Flag instructing to include the channel of Go snap used to build Snapd snap for FIPS
+    required: false
+    type: string
+  include-latest-go-channel: 
+    description: Flag instructing to include the latest channel of Go snap
+    required: false
+    type: boolean
+  specific-go-channels:
+    description: Space separated list of required Go snap channels
+    required: false
+    type: string     
+
+outputs:
+  go-channels:
+    description: JSON list of Go snap channels
+    value: ${{ steps.resolve-go-channels.outputs.go-channels }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve Go snap channels
+      id: resolve-go-channels
+      shell: bash
+      run: |
+        # Get the Go snap version corresponding to a channel format <version>[/<risk>]
+        # - If optional risk is omitted, default stable will be assumed
+        # - Assumes both device and snap architecture amd64
+        go_version_from_channel() {
+          channel=$1
+          risk_default="stable"
+          arch_default="amd64"
+
+          # channel=<track>/<risk>
+          if [[ "$channel" =~ ^([0-9]+\.[0-9]+|[0-9]+\.[0-9]+-fips|latest)/(stable|candidate|beta|edge)$ ]]; then
+            track=${channel%%/*}
+            risk=${channel##*/}
+          # channel=<track>
+          elif [[ "$channel" =~ ^([0-9]+\.[0-9]+|[0-9]+\.[0-9]+-fips|latest)$ ]]; then
+            track=$channel
+            risk=$risk_default
+          # Not supported
+          else
+            echo "Cannot use Go channel \"$channel\""
+            return 1
+          fi
+
+          # Query params
+          device_arch="Snap-Device-Architecture: $arch_default"
+          channel_arch="$arch_default"
+          device_series="Snap-Device-Series: 16"
+          endpoint="https://api.snapcraft.io/v2/snaps/info/go"
+
+          # Query store
+          if ! result="$(curl -s --fail -H "$device_arch" -H "$device_series" -X GET "$endpoint")"; then
+            echo "Cannot use endpoint \"$endpoint\": $result"
+              return 1
+          else
+            version="$(jq -r ".\"channel-map\"[] \
+            | select ( .channel.track == \"$track\" and .channel.risk == \"$risk\" and .channel.architecture == \"$channel_arch\" ) \
+            | .version" <<< "$result")"
+            if [ -z "$version" ] || [ "$version" = "null" ]; then
+              echo "Cannot find version corresponding to: arch=$channel_arch, track=$track, risk=$track"
+              return 1
+            else
+              # Return the version
+              echo "$version"
+            fi
+          fi
+        }
+
+        go_channels=()
+        echo "Gathering required Go channels"
+
+        # Optional Go channel used to build Snapd snap
+        if [ "${{ inputs.include-snapd-build-go-channel }}" = "true" ]; then
+          echo "> Require Go channel used to build Snapd snap"
+          yaml="build-aux/snap/snapcraft.yaml"
+          if ! channel="$(yq '.parts.snapd.build-snaps[]' $yaml | grep "go/.*/.*")"; then
+            echo "Error: Cannot find valid Snapd build Go channel"
+            exit 1
+          fi
+          channel="$(yq '.parts.snapd.build-snaps[] | select(. == "go/*/*") | sub("^go/", "")' $yaml)" 
+          echo "> Adding Go channel \"$channel\""
+          go_channels+=("$channel")
+        fi
+
+        # Optional Go channel used to build Snapd snap for FIPS
+        if [ "${{ inputs.include-snapd-build-fips-go-channel }}" = "true" ]; then
+          echo "> Require Go channel used to build Snapd snap for FIPS"
+          yaml="build-aux/snap/snapcraft.yaml"
+          if ! channel="$(yq '.parts.snapd.override-build' $yaml | grep "GO_TOOLCHAIN_FIPS_CHANNEL=\".*\"")"; then
+            echo "Error: Cannot find valid Snapd FIPS build Go channel"
+            exit 1
+          fi
+          channel="$(echo "$channel" | sed -n 's/^GO_TOOLCHAIN_FIPS_CHANNEL="\([^"]*\)"/\1/p')"
+          echo "> Adding Go channel \"$channel\""
+          go_channels+=("$channel")
+        fi
+
+        # Optional latest stable Go channel
+        if [ "${{ inputs.include-latest-go-channel }}" = "true" ]; then
+          echo "> Require latest stable Go channel"
+          channel="latest/stable"
+          echo "> Adding Go channel \"$channel\""
+          go_channels+=("$channel")
+        fi
+  
+        # Optional specific Go channel(s)
+        if [ -n "${{ inputs.specific-go-channels }}" ]; then
+          echo "> Require specific Go channel(s)"
+          for channel in ${{ inputs.specific-go-channels }}; do
+            echo "> Adding Go channel \"$channel\""
+            go_channels+=("$channel")
+          done
+        fi
+
+        declare -A go_versions
+        go_channels_with_unique_version=()
+        echo "Dropping Go channels that duplicates Go versions"
+
+        # Iterate all the required channels and create list of 
+        # channels with unique versions.
+        for channel in "${go_channels[@]}"; do
+          if ! output="$(go_version_from_channel "$channel")"; then
+            echo "Error: $output"
+          else
+            if [[ -v go_versions["$output"] ]]; then
+               echo "> Dropping channel \"$channel\": same Go version as channel \"${go_versions[$output]}\""
+            else
+               echo "> Keeping channel \"$channel\" with unique Go version \"$output\""
+               go_versions["$output"]="$channel"
+               go_channels_with_unique_version+=("$channel")
+            fi
+          fi
+        done
+
+        # Convert to single line JSON array and remove duplicates
+        go_channels_output="[]"
+        if [[ ${#go_channels_with_unique_version[@]} -gt 0 ]]; then
+          go_channels_output="$(printf '%s\n' "${go_channels_with_unique_version[@]}" | jq -R . | jq -s -c .)"
+        fi
+        echo "Unique Go channels: $go_channels_output"
+
+        # Output the single line JSON array
+        echo "go-channels=$go_channels_output" >> "$GITHUB_OUTPUT"

.github/dependabot.yaml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      non-breaking:
+        applies-to: version-updates
+        patterns:
+        - "*"
+        update-types:
+        - "minor"
+        - "patch"
+      breaking:
+        applies-to: version-updates
+        patterns:
+        - "*"
+        update-types:
+        - "major"

.github/workflows/nightly-spread.yaml

@@ -0,0 +1,83 @@
+name: Nightly spread executions
+
+# See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onschedule
+on:
+  schedule:
+    # usual nitghtly run
+    - cron: '0 2 * * *'
+    # from current
+    - cron: '0 3 * * *'
+    # experimental features and openstack
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+    inputs:
+      job:
+        type: choice
+        description: Job to run
+        options:
+          - spread-nightly
+          - spread-test-build-from-current
+          - spread-test-experimental
+          - spread-test-openstack
+
+jobs:
+
+  spread-nightly:
+    if: ${{ github.event.schedule == '0 2 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-nightly') }}
+    uses: ./.github/workflows/spread-tests.yaml
+    with:
+      runs-on: '["self-hosted", "spread-enabled"]'
+      group: google
+      backend: google
+      systems: 'ALL'
+      tasks: 'tests/nightly/...'
+      rules: ''
+      use-snapd-snap-from-master: true
+
+  spread-test-build-from-current:
+    if: ${{ github.event.schedule == '0 6 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-test-build-from-current') }}
+    uses: ./.github/workflows/spread-tests.yaml
+    with:
+      runs-on: '["self-hosted", "spread-enabled"]'
+      group: ${{ matrix.group }}
+      backend: ${{ matrix.backend }}
+      systems: ${{ matrix.systems }}
+      tasks: 'tests/...'
+      rules: ''
+      use-snapd-snap-from-master: true
+      spread-snapd-deb-from-repo: false
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - group: google
+            backend: google
+            systems: 'ubuntu-18.04-64 ubuntu-20.04-64 ubuntu-22.04-64 ubuntu-24.04-64'
+          - group: debian-not-req
+            backend: google-distro-1
+            systems: 'debian-11-64 debian-12-64 debian-sid-64'
+
+  spread-test-experimental:
+    if: ${{ github.event.schedule == '0 3 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-test-experimental') }}
+    uses: ./.github/workflows/spread-tests.yaml
+    with:
+      runs-on: '["self-hosted", "spread-enabled"]'
+      group: 'google'
+      backend: 'google'
+      systems: 'ubuntu-18.04-64 ubuntu-20.04-64 ubuntu-21.10-64 ubuntu-core-20-64'
+      tasks: 'tests/...'
+      rules: ''
+      use-snapd-snap-from-master: true
+      spread-experimental-features: gate-auto-refresh-hook
+
+  spread-test-openstack:
+    if: ${{ github.event.schedule == '0 3 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-test-openstack') }}
+    uses: ./.github/workflows/spread-tests.yaml
+    with:
+      runs-on: '["self-hosted", "spread-enabled"]'
+      group: 'openstack'
+      backend: 'openstack'
+      systems: 'ALL'
+      tasks: 'tests/main/...'
+      rules: ''
+      use-snapd-snap-from-master: true