Use SDK Store for launch and refresh

.github/workflows/build-deps.yaml

@@ -2,13 +2,16 @@ name: Build Dependencies
 on:
   workflow_call:
     secrets:
-      GH_SDKCRAFT:
+      SDKCRAFT_STORE_CREDENTIALS:
         required: true
     outputs:
       snap_workshop:
         description: "Workshop snap filename"
         value: ${{ jobs.build-workshop.outputs.snap_workshop }}
 
+permissions:
+  contents: read
+
 jobs:
   build-workshop:
     runs-on: ubuntu-latest
@@ -42,45 +45,6 @@ jobs:
           name: snap_workshop
           path: ${{ steps.cache-workshop.outputs.cache-hit == 'true' && steps.snapcraft_workshop_cached.outputs.snap || steps.snapcraft_workshop.outputs.snap }}
 
-  build-sdkcraft:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Sdkcraft
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: canonical/sdkcraft
-          show-progress: true
-          token: ${{ secrets.GH_SDKCRAFT }} # zizmor: ignore[secrets-outside-env]
-          path: sdkcraft
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Get Sdkcraft commit hash
-        id: sdkcraft-sha
-        run: echo "sha=$(git -C sdkcraft rev-parse HEAD)" >> $GITHUB_OUTPUT
-      - name: Cache Sdkcraft snap
-        id: cache-sdkcraft
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-        with:
-          path: sdkcraft/sdkcraft_*.snap
-          key: sdkcraft-snap-${{ steps.sdkcraft-sha.outputs.sha }}
-      - name: Build Sdkcraft
-        if: steps.cache-sdkcraft.outputs.cache-hit != 'true'
-        uses: canonical/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
-        id: snapcraft_sdkcraft
-        with:
-          path: sdkcraft
-      - name: Set snap path from cache
-        if: steps.cache-sdkcraft.outputs.cache-hit == 'true'
-        id: snapcraft_sdkcraft_cached
-        run: |
-          snap_file=$(ls sdkcraft/sdkcraft_*.snap)
-          echo "snap=$snap_file" >> $GITHUB_OUTPUT
-      - name: Upload Sdkcraft
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: snap_sdkcraft
-          path: ${{ steps.cache-sdkcraft.outputs.cache-hit == 'true' && steps.snapcraft_sdkcraft_cached.outputs.snap || steps.snapcraft_sdkcraft.outputs.snap }}
-
   build-spread:
     runs-on: ubuntu-latest
     steps:
@@ -120,3 +84,83 @@ jobs:
         with:
           name: spread_binary
           path: spread/spread
+
+  detect-sdk-changes:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    outputs:
+      sdks: ${{ steps.detect.outputs.sdks }}
+    steps:
+      - name: Checkout Workshop
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          filter: 'tree:0'
+          persist-credentials: true
+
+      - name: Detect staged SDKs
+        id: detect
+        run: |
+          git fetch --filter=tree:0 origin "+${GITHUB_BASE_REF}:${GITHUB_BASE_REF}"
+          base=$(git merge-base "$GITHUB_BASE_REF" HEAD)
+
+          cd tests/lib/sdk
+          for path in */*/*/; do
+            if git diff --quiet "${base}..HEAD" -- "$path"; then
+              continue
+            fi
+            # TODO: enable this after merging https://github.com/canonical/workshop/pull/689
+            # if git cat-file -t "${base}:./${path}" &> /dev/null; then
+            #   printf '::error::%s SDK is immutable, create a new SDK instead.\n' "${path%/}"
+            #   exit 1
+            # fi
+          done
+          cd ..
+
+          sdks=()
+          if [ -d staging ]; then
+            cd staging
+            for path in */*/*/; do
+              if git cat-file -t "${base}:../sdk/${path}" &> /dev/null; then
+                printf '::error::%s SDK is immutable, create a new SDK instead.\n' "${path%/}"
+                exit 1
+              fi
+              sdks+=("${path%/}")
+            done
+          fi
+
+          {
+            printf 'sdks='
+            for sdk in "${sdks[@]}"; do
+              IFS='/' read -r -a parts <<<"$sdk"
+
+              platforms='["amd64"]'
+              if [ -f "${sdk}/platforms.json" ]; then
+                platforms=$(< "${sdk}/platforms.json")
+              fi
+
+              jq --null-input \
+                --arg path "tests/lib/staging/$sdk" \
+                --arg track "${parts[1]}" \
+                --arg risk "${parts[2]}" \
+                --argjson platforms "$platforms" \
+                '$ARGS.named'
+            done | jq --compact-output --slurp .
+          } >> "$GITHUB_OUTPUT"
+        shell: bash
+
+  build-test-sdk:
+    needs: detect-sdk-changes
+    if: needs.detect-sdk-changes.outputs.sdks != '[]'
+    strategy:
+      matrix:
+        include: ${{ fromJSON(needs.detect-sdk-changes.outputs.sdks) }}
+      fail-fast: false
+    uses: canonical/sdkcraft-actions/.github/workflows/upload.yml@92f5df60c0878aea4844a7380fdfd24063f89ac9
+    with:
+      platforms: ${{ toJSON(matrix.platforms) }}
+      subdirectory: ${{ matrix.path }}
+      track: ${{ matrix.track }}
+      risk: ${{ matrix.risk }}
+    secrets:
+      SDKCRAFT_STORE_CREDENTIALS: ${{ secrets.SDKCRAFT_STORE_CREDENTIALS }}

.github/workflows/cover.yaml

@@ -25,8 +25,8 @@ jobs:
   spread:
     uses: ./.github/workflows/spread.yaml
     secrets:
-      GH_SDKCRAFT: ${{ secrets.GH_SDKCRAFT }}
       STORE_CREDENTIALS: ${{ secrets.STORE_CREDENTIALS }}
+      SDKCRAFT_STORE_CREDENTIALS: ${{ secrets.SDKCRAFT_STORE_CREDENTIALS_PROD }}
   unit-tests:
     uses: ./.github/workflows/unit-tests.yaml
 

.github/workflows/lxd-candidate-check.yaml

@@ -11,7 +11,7 @@ jobs:
   build-deps:
     uses: ./.github/workflows/build-deps.yaml
     secrets:
-      GH_SDKCRAFT: ${{ secrets.GH_SDKCRAFT }}
+      SDKCRAFT_STORE_CREDENTIALS: ${{ secrets.SDKCRAFT_STORE_CREDENTIALS_PROD }}
   snap-tests:
     needs: [build-deps]
     strategy:
@@ -43,11 +43,6 @@ jobs:
         with:
           name: snap_workshop
           path: ${{ github.workspace }}/tests/
-      - name: Download Sdkcraft Snap
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: snap_sdkcraft
-          path: ${{ github.workspace }}/tests/
       - name: Download spread binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

.github/workflows/spread.yaml

@@ -2,10 +2,10 @@ name: Workshop end-to-end tests
 on:
   workflow_call:
     secrets:
-      GH_SDKCRAFT:
-        required: true
       STORE_CREDENTIALS:
         required: true
+      SDKCRAFT_STORE_CREDENTIALS:
+        required: true
   workflow_dispatch:
 
 permissions:
@@ -15,7 +15,7 @@ jobs:
   build-deps:
     uses: ./.github/workflows/build-deps.yaml
     secrets:
-      GH_SDKCRAFT: ${{ secrets.GH_SDKCRAFT }}
+      SDKCRAFT_STORE_CREDENTIALS: ${{ secrets.SDKCRAFT_STORE_CREDENTIALS }}
   snap-tests:
     needs: [build-deps]
     strategy:
@@ -57,11 +57,6 @@ jobs:
         with:
           name: snap_workshop
           path: ${{ github.workspace }}/tests/
-      - name: Download Sdkcraft Snap
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: snap_sdkcraft
-          path: ${{ github.workspace }}/tests/
       - name: Download spread binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

.github/workflows/staging.yaml

@@ -0,0 +1,25 @@
+name: Check for staged SDKs
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check for staged SDKs
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Check for staged SDKs
+        run: |
+          if [ -d tests/lib/staging ]; then
+            printf '::error::Found staged SDKs, please move them to tests/lib/sdk before merging.\n'
+            exit 1
+          fi

.github/workflows/zizmor.yaml

@@ -23,3 +23,5 @@ jobs:
         uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
         with:
           advanced-security: false
+          # TODO: enable this when we go public
+          online-audits: false

.spread.yaml

@@ -6,8 +6,6 @@ environment:
   PATH: $PATH:~/go/bin
   PROJECT_PATH: /workshop
   TESTSLIB: $PROJECT_PATH/tests/lib
-  TESTS_SDKS: $PROJECT_PATH/tests/lib/sdk
-  SDK_STORE_BUCKET_DIR: /data/sdkstore
   IMAGE_SERVER: $(HOST:echo -n $WORKSHOP_IMAGE_SERVER)
 repack: |
   test -f tests/workshop_*.snap || snapcraft pack -o tests/
@@ -24,12 +22,16 @@ suites:
       . "$TESTSLIB"/utils.sh
       prepare_environment
       setup_workshop
+      install_sdkcraft
+    prepare-each: |
+      date --rfc-3339=seconds > /tmp/spread-job-start
     restore: |
       . "$TESTSLIB"/utils.sh
       cleanup_workshop
-    debug: |
+    debug-each: |
       lxc list --project workshop.ubuntu
       sudo -u ubuntu 2>&1 -- workshop list --global
+      journalctl --since="$(</tmp/spread-job-start)" --unit=snap.workshop.workshopd.service
     kill-timeout: 30m
   tests/integration/:
     summary: LXD integration tests
@@ -45,21 +47,29 @@ suites:
     prepare: |
       . "$TESTSLIB"/utils.sh
       prepare_environment
-      setup_workshop true  # use real store
+      setup_workshop
       install_sdkcraft
+    prepare-each: |
+      date --rfc-3339=seconds > /tmp/spread-job-start
     restore: |
       . "$TESTSLIB"/utils.sh
-      cleanup_workshop true  # used real store, no need to clean it
+      cleanup_workshop
+    debug-each: |
+      journalctl --since="$(</tmp/spread-job-start)" --unit=snap.workshop.workshopd.service
     kill-timeout: 30m
   tests/docs-how-to/:
     summary: Documentation how-to tests
     prepare: |
       . "$TESTSLIB"/utils.sh
       prepare_environment
-      setup_workshop true  # use real store
+      setup_workshop
+    prepare-each: |
+      date --rfc-3339=seconds > /tmp/spread-job-start
     restore: |
       . "$TESTSLIB"/utils.sh
-      cleanup_workshop true  # used real store, no need to clean it
+      cleanup_workshop
+    debug-each: |
+      journalctl --since="$(</tmp/spread-job-start)" --unit=snap.workshop.workshopd.service
     kill-timeout: 20m
 exclude:
   - .git

.workshop/dev.yaml

@@ -29,9 +29,3 @@ actions:
     /opt/snapd-testing-tools/utils/spread-shellcheck tests/integration
   cover: |
     go test -covermode=count -coverpkg=./... -coverprofile=coverage.out ./...
-  fake-store: |
-    STORE_DIR=/tmp/sdkstore
-    source tests/lib/utils.sh
-    rm -rf "$STORE_DIR"
-    publish_test_sdks ./tests/lib/sdk "$STORE_DIR"
-    fake-gcs-server -data /tmp -backend memory -scheme http -port 8080 -host 127.0.0.1 -public-host localhost:8080

.workshop/tools/hooks/check-health

@@ -3,9 +3,4 @@ if ! golangci-lint --version; then
   exit 1
 fi
 
-if ! fake-gcs-server --help 2> /dev/null; then
-  workshopctl set-health error "fake-gcs-server is not installed"
-  exit 1
-fi
-
 workshopctl set-health okay

.workshop/tools/hooks/setup-base

@@ -1,6 +1,5 @@
 apt-get update
 apt-get install make python3-venv shellcheck
 
-curl -L https://github.com/fsouza/fake-gcs-server/releases/download/v1.52.3/fake-gcs-server_1.52.3_Linux_amd64.tar.gz | tar -xz -C /usr/local/bin fake-gcs-server
 curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b /usr/local/bin v2.11.3
 git clone --depth 1 https://github.com/canonical/snapd-testing-tools.git /opt/snapd-testing-tools

cmd/sdk/info.go

@@ -118,7 +118,7 @@ func (c *CmdInfo) Run(cmd *cobra.Command, av []string) error {
 	tpl := "  %s\t%s\t%s\t" + baseTpl + archTpl + "%*s\t%*s\n"
 	if len(tracks) > 0 {
 		fmt.Fprintln(w)
-		fmt.Fprintf(w, "%s%s%s  (%s%s%s: %s)\n", esc.Bold, "CHANNELS", esc.End, esc.BrightYellow, "SDK Store preview", esc.End, "Workshop won't see these revisions yet")
+		fmt.Fprintf(w, "%s%s%s\n", esc.Bold, "CHANNELS", esc.End)
 		fmt.Fprintf(w, tpl, "CHANNEL", "VERSION", "BUILD", "BASE", "ARCH", maxRev, "REV", maxSize, "SIZE")
 	}
 	for _, track := range tracks {

cmd/sdk/info_test.go

@@ -190,7 +190,7 @@ license:    Apache-2.0
 Longer description
 can be multiline.
 
-CHANNELS  (SDK Store preview: Workshop won't see these revisions yet)
+CHANNELS
   CHANNEL           VERSION      BUILD       BASE          ARCH     REV      SIZE
   latest/stable     2.1-084c8c8  2024-11-25  ubuntu@22.04  amd64     88  123.46kB
                                                            arm64     89    1.23MB
@@ -223,7 +223,7 @@ license:    Apache-2.0
 Longer description
 can be multiline.
 
-CHANNELS  (SDK Store preview: Workshop won't see these revisions yet)
+CHANNELS
   CHANNEL           VERSION      BUILD       BASE          REV      SIZE
   latest/stable     2.1-084c8c8  2024-11-25  ubuntu@22.04   88  123.46kB
                                              ubuntu@20.04   85      123B
@@ -253,7 +253,7 @@ license:    Apache-2.0
 Longer description
 can be multiline.
 
-CHANNELS  (SDK Store preview: Workshop won't see these revisions yet)
+CHANNELS
   CHANNEL           VERSION      BUILD       BASE          REV     SIZE
   latest/stable     2.2-c8c8084  2024-11-27  ubuntu@22.04   90  12.35MB
                     2.1-084c8c8  2024-11-25  ubuntu@20.04   87  12.35kB
@@ -280,7 +280,7 @@ license:    Apache-2.0
 Longer description
 can be multiline.
 
-CHANNELS  (SDK Store preview: Workshop won't see these revisions yet)
+CHANNELS
   CHANNEL           VERSION      BUILD       ARCH     REV      SIZE
   latest/stable     2.1-084c8c8  2024-11-25  amd64     88  123.46kB
                                              arm64     89    1.23MB
@@ -309,7 +309,7 @@ license:    Apache-2.0
 Longer description
 can be multiline.
 
-CHANNELS  (SDK Store preview: Workshop won't see these revisions yet)
+CHANNELS
   CHANNEL           VERSION      BUILD       REV     SIZE
   latest/stable     2.1-084c8c8  2024-11-25   85     123B
   latest/candidate  ^                             

docs/.custom_wordlist.txt

@@ -51,7 +51,6 @@ fixup
 fmt
 func
 GCP
-gcs
 Gencodo
 gendocs
 GH