urunc-dev · cmainas · Aug 10, 2026
diff --git a/.github/linters/urunc-dict.txt b/.github/linters/urunc-dict.txt
@@ -429,3 +429,4 @@ hyperlight
 Hyperlight
 Odysseas
 Kalaitsidis
+archs
diff --git a/.github/workflows/build-latest.yml b/.github/workflows/build-latest.yml
@@ -3,18 +3,12 @@ name: 🍜 Build/publish urunc-deploy image
 on:
   workflow_call:
     inputs:
-      runner:
-        type: string
-        default: '["base", "dind", "2204"]'
       runner-archs:
         type: string
         default: '["amd64", "aarch64"]'
       dockerfiles:
         type: string
         default: '["Dockerfile"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64", "aarch64":"aarch64", "armv7l":"armv7l"}]'
       registry:
         type: string
         default: 'ghcr.io'
@@ -57,9 +51,6 @@ jobs:
       - name: Checkout the repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set short SHA
-        run: echo "SHA_SHORT=${GITHUB_SHA::7}" >> $GITHUB_ENV
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
@@ -78,36 +69,6 @@ jobs:
           tags: |
             type=sha,prefix=${{ env.ARCH }}-
 
-      - name: Get revision SHA and branch (safe)
-        id: get-rev
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          IS_MERGED: ${{ github.event.pull_request.merged }}
-          GITHUB_SHA: ${{ github.sha }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          if [ "$EVENT_NAME" == "pull_request" ]; then
-            if [ "$IS_MERGED" == "true" ]; then
-              sha="$GITHUB_SHA"
-              branch="$PR_BASE_REF"
-              echo "PR merged. SHA: ${sha}, Branch: ${branch}"
-            else
-              sha="$PR_HEAD_SHA"
-              branch="$PR_HEAD_REF"
-              echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}"
-            fi
-          else
-            sha="$GITHUB_SHA"
-            branch="$REF_NAME"
-            echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}"
-          fi
-
-          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
-          echo "branch=${branch}" >> "$GITHUB_OUTPUT"
-
       - name: Build and push urunc-deploy-${{ matrix.arch}}
         id: build-and-push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # master
@@ -118,15 +79,9 @@ jobs:
           push: true
           file: ${{ inputs.dockerfiles }}
           build-args: |
-            BRANCH=${{ steps.get-rev.outputs.branch }}
+            BRANCH=${{ github.ref_name }}
             REPO=${{ github.repository }}
           provenance: false
-
-      - name: Get image digest
-        run: |
-          echo "IMAGE_DIGEST=$(docker inspect \
-          ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.ARCH }}-${{ env.SHA_SHORT }} | \
-          jq -r '.[0].Id')" >> $GITHUB_ENV
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # main

diff --git a/.github/workflows/build-trigger.yml b/.github/workflows/build-trigger.yml
@@ -60,7 +60,6 @@ jobs:
     uses: ./.github/workflows/build-latest.yml
     secrets: inherit
     with:
-      runner: '["base", "dind", "2204"]'
       runner-archs: '["amd64", "arm64"]'
       dockerfiles: 'deployment/urunc-deploy/Dockerfile'
       version-tag: ${{ needs.get-changed-files.outputs.version == 'true' }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -52,36 +52,6 @@ jobs:
       run: |
         go version
 
-    - name: Get revision SHA and branch (safe)
-      id: get-rev
-      env:
-        EVENT_NAME: ${{ github.event_name }}
-        IS_MERGED: ${{ github.event.pull_request.merged }}
-        GITHUB_SHA: ${{ github.sha }}
-        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-        PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-        REF_NAME: ${{ github.ref_name }}
-      run: |
-        if [ "$EVENT_NAME" == "pull_request" ]; then
-          if [ "$IS_MERGED" == "true" ]; then
-            sha="$GITHUB_SHA"
-            branch="$PR_BASE_REF"
-            echo "PR merged. SHA: ${sha}, Branch: ${branch}"
-          else
-            sha="$PR_HEAD_SHA"
-            branch="$PR_HEAD_REF"
-            echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}"
-          fi
-        else
-          sha="$GITHUB_SHA"
-          branch="$REF_NAME"
-          echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}"
-        fi
-
-        echo "sha=${sha}" >> "$GITHUB_OUTPUT"
-        echo "branch=${branch}" >> "$GITHUB_OUTPUT"
-
     - name: Build urunc binaries
       id: build-urunc-binaries
       run: |

diff --git a/.github/workflows/ci_main.yml b/.github/workflows/ci_main.yml
@@ -28,8 +28,6 @@ jobs:
     name: Upload
     needs: build
     uses: ./.github/workflows/upload_s3.yml
-    with:
-      ref: ${{ github.sha }}
     secrets:
       AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

diff --git a/.github/workflows/kind_test.yml b/.github/workflows/kind_test.yml
@@ -5,15 +5,6 @@ on:
       ref:
         type: string
         default: ''
-      runner:
-        type: string
-        default: '["base", "dind", "2204"]'
-      runner-archs:
-        type: string
-        default: '["amd64", "arm64"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]'
       firecracker_version:
         type: string
         required: true
@@ -23,10 +14,6 @@ on:
       runc_version:
         required: true
         type: string
-    secrets:
-      GIT_CLONE_PAT:
-        required: false
-  workflow_dispatch:     
 permissions:
   contents: read
 
@@ -50,11 +37,9 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ inputs.ref }}
 
-    - name: Install base dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y git wget build-essential libseccomp-dev pkg-config bc make 
     - name: Install kind
       run: |
         ARCH=$(uname -m)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ inputs.ref }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ inputs.go_version }}

diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml
@@ -51,8 +51,6 @@ jobs:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           PR_BRANCH: ${{ github.event.pull_request.base.ref }}
         run: |
-          PR_BRANCH=${{ github.event.pull_request.base.ref }}
-
           # Create the pull request
           PR_URL=$(gh pr create \
             --head "$PR_BRANCH" \

diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml
@@ -37,7 +37,7 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ inputs.ref }}
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:

diff --git a/.github/workflows/upload_s3.yml b/.github/workflows/upload_s3.yml
@@ -2,25 +2,12 @@ name: Upload to S3
 
 on:
   workflow_call:
-    inputs:
-      ref:
-        required: true
-        type: string
-        default: ''
     secrets:
       AWS_ACCESS_KEY:
         required: true
       AWS_SECRET_ACCESS_KEY:
         required: true
 
-
-  workflow_dispatch:
-    inputs:
-      ref:
-        required: true
-        type: string
-        default: ''
-
 permissions:
   contents: read
 
@@ -42,36 +29,6 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Get revision SHA and branch (safe)
-      id: get-rev
-      env:
-        EVENT_NAME: ${{ github.event_name }}
-        IS_MERGED: ${{ github.event.pull_request.merged }}
-        GITHUB_SHA: ${{ github.sha }}
-        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-        PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-        REF_NAME: ${{ github.ref_name }}
-      run: |
-        if [ "$EVENT_NAME" == "pull_request" ]; then
-          if [ "$IS_MERGED" == "true" ]; then
-            sha="$GITHUB_SHA"
-            branch="$PR_BASE_REF"
-            echo "PR merged. SHA: ${sha}, Branch: ${branch}"
-          else
-            sha="$PR_HEAD_SHA"
-            branch="$PR_HEAD_REF"
-            echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}"
-          fi
-        else
-          sha="$GITHUB_SHA"
-          branch="$REF_NAME"
-          echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}"
-        fi
-
-        echo "sha=${sha}" >> "$GITHUB_ENV"
-        echo "branch=${branch}" >> "$GITHUB_ENV"
-
     - name: Download urunc artifact
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
@@ -91,7 +48,7 @@ jobs:
         access-key: ${{ secrets.AWS_ACCESS_KEY }}
         secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         local-path: urunc_static_${{ matrix.arch }}
-        remote-path: nbfc-assets/github/urunc/dist/${{ env.branch }}/${{ matrix.arch }}/
+        remote-path: nbfc-assets/github/urunc/dist/${{ github.ref_name }}/${{ matrix.arch }}/
         policy: 1
 
     - name: Upload containerd-shim-urunc-v2 to S3
@@ -101,5 +58,5 @@ jobs:
         access-key: ${{ secrets.AWS_ACCESS_KEY }}
         secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         local-path: containerd-shim-urunc-v2_static_${{ matrix.arch }}
-        remote-path: nbfc-assets/github/urunc/dist/${{ env.branch }}/${{ matrix.arch }}/
+        remote-path: nbfc-assets/github/urunc/dist/${{ github.ref_name }}/${{ matrix.arch }}/
         policy: 1
diff --git a/.github/workflows/urunc-deploy-test.yml b/.github/workflows/urunc-deploy-test.yml
@@ -5,12 +5,6 @@ on:
       ref:
         type: string
         default: ""
-      runner-archs:
-        type: string
-        default: '["amd64", "arm64"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64","arm64":"aarch64"}]'
       runc_version:
         required: true
         type: string

diff --git a/.github/workflows/vm_test.yml b/.github/workflows/vm_test.yml
@@ -8,15 +8,9 @@ on:
       go_version:
         required: true
         type: string
-      runner:
-        type: string
-        default: '["base", "dind", "2204"]'
       runner-archs:
         type: string
         default: '["amd64"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]'
       runc_version:
         required: true
         type: string
@@ -44,11 +38,6 @@ on:
       hyperlight_unikraft_version:
         required: true
         type: string
-    secrets:
-      GIT_CLONE_PAT:
-        required: false
-
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -82,18 +71,9 @@ jobs:
         SOLO5_VERSION: ${{ inputs.solo5_version }}
         HYPERLIGHT_UNIKRAFT_VERSION: ${{ inputs.hyperlight_unikraft_version }}
       run: |
-        SAFE_GO_VERSION="$GO_VERSION"
-        SAFE_RUNC_VERSION="$RUNC_VERSION"
-        SAFE_CONTAINERD_VERSION="$CONTAINERD_VERSION"
-        SAFE_CNI_VERSION="$CNI_VERSION"
-        SAFE_NERDCTL_VERSION="$NERDCTL_VERSION"
-        SAFE_CRICTL_VERSION="$CRICTL_VERSION"
-        SAFE_FIRECRACKER_VERSION="$FIRECRACKER_VERSION"
-        SAFE_CLOUD_HYPERVISOR_VERSION="$CLOUD_HYPERVISOR_VERSION"
-        SAFE_SOLO5_VERSION="$SOLO5_VERSION"
-        SAFE_HYPERLIGHT_UNIKRAFT_VERSION="$HYPERLIGHT_UNIKRAFT_VERSION"
-
-        for var in SAFE_GO_VERSION SAFE_RUNC_VERSION SAFE_CONTAINERD_VERSION SAFE_CNI_VERSION SAFE_NERDCTL_VERSION SAFE_CRICTL_VERSION SAFE_FIRECRACKER_VERSION SAFE_CLOUD_HYPERVISOR_VERSION SAFE_SOLO5_VERSION SAFE_HYPERLIGHT_UNIKRAFT_VERSION; do
+        for var in GO_VERSION RUNC_VERSION CONTAINERD_VERSION CNI_VERSION \
+                   NERDCTL_VERSION CRICTL_VERSION FIRECRACKER_VERSION \
+                   CLOUD_HYPERVISOR_VERSION SOLO5_VERSION HYPERLIGHT_UNIKRAFT_VERSION; do
           value="${!var}"
           if ! [[ "$value" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
             echo "Invalid format for $var: $value"
@@ -108,6 +88,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ inputs.ref }}
 
     - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
@@ -293,14 +275,13 @@ jobs:
         syslog = true
         EOF
 
-    - name: Add runner user to KVM group
+    - name: Grant access to /dev/kvm
       if: ${{ matrix.arch == 'amd64' }}
       id: kvm-setup
       run: |
         echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
         sudo udevadm control --reload-rules
         sudo udevadm trigger --name-match=kvm
-        sudo usermod -a -G kvm $USER
 
     - name: Prepare urunc folder
       id: prepare