container-device-interface 1.1.1

CDI (Container Device Interface), is a specification, for container-runtimes, to support third-party devices.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

name: CDI E2E
on:
  # Use pull_request (not pull_request_target) so the workflow definition is
  # taken from the PR itself. This lets us validate changes to these YAML files
  # in the PR instead of only discovering breakage after merge. The 'ok-to-test'
  # label gate below is what protects the self-hosted runner; pull_request also
  # runs fork PRs with a read-only token and no secrets, which is safer.
  pull_request:
    branches:
      - 'main'
    types:
      # Adding 'labeled' to the list of activity types that trigger this event
      # (default: opened, synchronize, reopened) so that we can run this
      # workflow when the 'ok-to-test' label is added.
      # Reference: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request
      - opened
      - synchronize
      - reopened
      - labeled

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # Detect if only docs changed - skip CI if so
  # Only run if ok-to-test label present (security gate for self-hosted runner)
  changes:
    name: Detect changes (e2e)
    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # Check out the PR head (not the merge commit) to detect changes
          ref: ${{ github.event.pull_request.head.sha }}
          # Fetch enough history to compare with base
          fetch-depth: 0
          persist-credentials: false
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          # Explicitly specify base and ref to compare PR head against base
          base: ${{ github.event.pull_request.base.sha }}
          ref: ${{ github.event.pull_request.head.sha }}
          filters: |
            code:
              - '**/*.rs'
              - '**/*.toml'
              - '**/*.lock'
              - 'Cargo.lock'
              - '.cargo/**'
              # Action/workflow bumps must run the E2E too - a broken or
              # malicious action update would otherwise merge untested.
              - '.github/workflows/**'
              - '.github/actions/**'

  ci:
    needs: changes
    # Only run on self-hosted runner if: 1) ok-to-test label present (security), 2) code changed (efficiency)
    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') && needs.changes.outputs.code == 'true' }}
    permissions:
      contents: read
    uses: ./.github/workflows/ci.yaml
    with:
      commit-hash: ${{ github.event.pull_request.head.sha }}
      pr-number: ${{ github.event.pull_request.number }}
      tag: ${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
      target-branch: ${{ github.event.pull_request.base.ref }}

  # Gate job for branch protection - set "CI Complete" as required status check
  # Passes when: CI succeeded OR no code changes (docs-only PR)
  ci-complete:
    name: CI Complete
    needs: [changes, ci]
    if: always() && contains(github.event.pull_request.labels.*.name, 'ok-to-test')
    runs-on: ubuntu-latest
    steps:
      - name: Check CI result
        env:
          CODE_CHANGED: ${{ needs.changes.outputs.code }}
          CI_RESULT: ${{ needs.ci.result }}
        run: |
          # Only an explicit "false" from the changes job counts as a
          # docs-only PR. An empty value means the changes job itself failed,
          # and the gate must fail rather than let the PR merge untested.
          if [[ "${CODE_CHANGED}" == "false" ]]; then
            echo "✓ No code changes - CI skipped"
            exit 0
          fi
          if [[ "${CI_RESULT}" == "success" ]]; then
            echo "✓ CI passed"
            exit 0
          fi
          echo "✗ CI failed: ${CI_RESULT} (code changed: '${CODE_CHANGED}')"
          exit 1