ci: Make ci system read-only on the git work tree #17423

1. 
   MarcoFalke commented at 10:39 pm on November 8, 2019: member

   Running the ci completely in a docker, without leaving any traces on the host system is not possible right now because the ccache and depends dir needs to be propagated back and picked up by the host for caching.

   Fixes #17372

2. fanquake added the label Tests on Nov 8, 2019
3. MarcoFalke force-pushed on Nov 8, 2019
4. MarcoFalke force-pushed on Nov 8, 2019
5. 
   DrahtBot commented at 0:14 am on November 9, 2019: member

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   Conflicts

   Reviewers, this pull request conflicts with the following ones:

   • #17202 (Travis CI bug in macOS environment #17178 workaround by sadrasabouri)

   If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

6. ci: Make all filesystem operations inside docker fa00393bce
7. ci: Remove git from required packages on host fab1333292
8. ci: Make ci system read-only on the git work tree fa493ef088
9. MarcoFalke force-pushed on Nov 9, 2019
10. 
    JeremyRubin commented at 11:18 pm on November 9, 2019: contributor

    Concept Ack!
11. 
    laanwj commented at 12:28 pm on November 10, 2019: member

    I know nothing about docker but Concept ACK, making things that can be made read-only read-only tends to be a good idea both for determinism and to avoid build steps generating clutter in unexpected places.
12. ci: Extend docs fa7523d3aa
13. 
    MarcoFalke commented at 5:53 pm on November 20, 2019: member

    This should be easy to review. All it does it add some DOCKER_EXEC, which means “execute everything that follows in this line in our docker thing”. Also, it mounts the source dir readonly into the docker.
14. 
    laanwj commented at 7:02 pm on November 20, 2019: member

    @JeremyRubin you brought this up, can you please give a tested ACK?
15. 
    MarcoFalke commented at 7:06 pm on November 20, 2019: member

    It was on my list of thing to improve either way. A code review should be sufficient, it is really straightforward. (And travis is testing it to some extend already)
16. 
    JeremyRubin commented at 8:48 pm on November 20, 2019: contributor

    Testing now…

    Looks like you still need to run a make distclean before running? Would there be any reason to not have travis (now that it’s RO on host) run make distclean first in case it’s a dirty dir?

17. 
    JeremyRubin commented at 9:37 pm on November 20, 2019: contributor

    tested ACK fa7523d3aa75b0266015af59901c2397b52265b5

    Ran make distclean and FILE_ENV=ci/test/00_setup_env_amd64_trusty.sh ./ci/test_run_all.sh

    and was able to re-run

    ./autogen.sh && ./configure && make without hitting permissions errors.

    Would prefer, as noted, if the distclean could happen in the copied dir.

18. MarcoFalke referenced this in commit 41162c0ba0 on Nov 20, 2019
19. MarcoFalke merged this on Nov 20, 2019
20. MarcoFalke closed this on Nov 20, 2019

    ---

21. 
    MarcoFalke commented at 9:45 pm on November 20, 2019: member

    Thanks for testing. I’ve merged this and left the suggestion as a follow up, see #17544.
22. MarcoFalke deleted the branch on Nov 20, 2019
23. sidhujag referenced this in commit f813bb5e43 on Nov 21, 2019
24. sidhujag referenced this in commit 064f7896af on Nov 10, 2020
25. MarcoFalke locked this on Dec 16, 2021

Contributors
MarcoFalke DrahtBot JeremyRubin laanwj

Labels
Tests