Skip to content

fix(ci): install kind directly on Windows to avoid docker-desktop dep #261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
skevetter merged 12 commits into from
May 8, 2026
Merged

fix(ci): install kind directly on Windows to avoid docker-desktop dep #261

Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
88f75d2
fix(ci): install kind directly on Windows to avoid docker-desktop dep
skevetter May 7, 2026
2f0dd0b
fix(ci): install podman via direct MSI download instead of Chocolatey
skevetter May 7, 2026
489821d
fix(ci): download kind.exe to temp dir and use direct GitHub releases…
skevetter May 7, 2026
aac5b71
fix(ci): place kind.exe in RUNNER_TEMP and generate UUID inline on Wi…
skevetter May 7, 2026
0b8bc97
fix(ci): use Docker for Windows kind cluster and fix podman install f…
skevetter May 7, 2026
b360d87
fix(ci): use redhat-actions/podman-install for Windows CI
skevetter May 7, 2026
0ae2e91
fix(ci): use MSI with INSTALLDIR and verbose logging for podman install
skevetter May 7, 2026
2f55697
fix(ci): add SHA256 checksum verification for podman and kind downloads
skevetter May 7, 2026
0b13136
fix(ci): use pinned SHA256 hash for podman MSI checksum verification
skevetter May 7, 2026
a26fb82
fix(ci): use correct named pipe for Podman 5.x rootful mode on Windows
skevetter May 7, 2026
b6317bd
fix(ci): pin kind SHA256 hash and strip backslash from sha256sum output
skevetter May 7, 2026
5b15df4
fix(ci): use sed to strip leading backslash from sha256sum on Windows
skevetter May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 47 additions & 6 deletions .github/workflows/pr-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,21 +394,62 @@ jobs:
UUID=$(python -c "import uuid; print(uuid.uuid4().hex)")
echo "result=$UUID" >> "$GITHUB_OUTPUT"

- name: install and start podman (Windows)
if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
shell: pwsh
run: |
$msiUrl = "https://github.com/containers/podman/releases/download/v5.8.2/podman-installer-windows-amd64.msi"
$msiPath = "$env:RUNNER_TEMP\podman.msi"
Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath
Comment thread
coderabbitai[bot] marked this conversation as resolved.

$expectedHash = "eda54f26f9695d198d9a679fa45ae24ba35b78444f432b5fe0c122c5a3624c57"
$actualHash = (Get-FileHash -Path $msiPath -Algorithm SHA256).Hash.ToLower()
if ($actualHash -ne $expectedHash) {
throw "SHA256 mismatch for podman MSI! Expected: $expectedHash, Got: $actualHash"
}
Write-Host "Podman MSI checksum verified: $actualHash"

$installDir = "C:\Program Files\RedHat\Podman"
$logFile = "$env:RUNNER_TEMP\podman-install.log"
$proc = Start-Process msiexec.exe -Wait -PassThru -ArgumentList "/i `"$msiPath`" /qn /norestart /l*v `"$logFile`" INSTALLDIR=`"$installDir`""
Write-Host "MSI exit code: $($proc.ExitCode)"

if (!(Test-Path "$installDir\podman.exe")) {
Write-Host "--- MSI install log (last 50 lines) ---"
Get-Content $logFile -Tail 50
Write-Host "--- Searching for podman.exe ---"
Get-ChildItem "C:\" -Filter "podman.exe" -Recurse -Depth 4 -ErrorAction SilentlyContinue | ForEach-Object { Write-Host $_.FullName }
throw "podman.exe not found at $installDir"
}

echo "$installDir" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8

wsl --set-default-version 2
& "$installDir\podman.exe" machine init
& "$installDir\podman.exe" machine set --rootful
& "$installDir\podman.exe" machine start
Comment on lines +414 to +430

@coderabbitai coderabbitai Bot May 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Native command failures don't fail this step in PowerShell.

By default, PowerShell does not propagate non-zero exit codes from native executables (msiexec, wsl, podman) into terminating errors, and $ErrorActionPreference = 'Stop' does not cover them either. As a result:

  • Line 414: $proc.ExitCode is only printed; an MSI failure (e.g., 1603/1618) is recovered only because Test-Path happens to catch missing podman.exe.
  • Lines 427–430: wsl --set-default-version 2, podman machine init, podman machine set --rootful, and podman machine start can all fail silently, leaving subsequent CI steps to fail with confusing downstream errors.

Check $LASTEXITCODE after each native invocation (or wrap in a small helper) so failures abort the job with a clear cause.

🛠️ Suggested hardening 
           $proc = Start-Process msiexec.exe -Wait -PassThru -ArgumentList "/i `"$msiPath`" /qn /norestart /l*v `"$logFile`" INSTALLDIR=`"$installDir`""
           Write-Host "MSI exit code: $($proc.ExitCode)"
+          if ($proc.ExitCode -ne 0) {
+            Get-Content $logFile -Tail 100
+            throw "Podman MSI install failed with exit code $($proc.ExitCode)"
+          }

           if (!(Test-Path "$installDir\podman.exe")) {
             ...
           }

           echo "$installDir" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8

-          wsl --set-default-version 2
-          & "$installDir\podman.exe" machine init
-          & "$installDir\podman.exe" machine set --rootful
-          & "$installDir\podman.exe" machine start
+          function Invoke-Native {
+            param([string]$Description, [scriptblock]$Cmd)
+            & $Cmd
+            if ($LASTEXITCODE -ne 0) { throw "$Description failed with exit code $LASTEXITCODE" }
+          }
+          Invoke-Native "wsl --set-default-version 2" { wsl --set-default-version 2 }
+          Invoke-Native "podman machine init"        { & "$installDir\podman.exe" machine init }
+          Invoke-Native "podman machine set --rootful" { & "$installDir\podman.exe" machine set --rootful }
+          Invoke-Native "podman machine start"       { & "$installDir\podman.exe" machine start }
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-ci.yml around lines 414 - 430, The PowerShell step
currently prints $proc.ExitCode and relies on Test-Path to catch an MSI failure
and does not abort on failures from native commands (msiexec, wsl, podman), so
change the step to check and fail on non-zero exit codes: after the msiexec
Start-Process block inspect $proc.ExitCode and throw/exit if non-zero (instead
of only logging), and after each native invocation (wsl --set-default-version, &
"$installDir\podman.exe" machine init, set --rootful, start) check $LASTEXITCODE
and fail immediately with a clear message; optionally factor this into a small
helper function (e.g., Assert-LastExitCode or Invoke-And-EnsureSuccess) to run
the command and abort on failure to keep the script DRY.

Comment thread
coderabbitai[bot] marked this conversation as resolved.

- name: setup kind (Windows)
if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
shell: bash
env:
KIND_EXPERIMENTAL_PROVIDER: podman
DOCKER_HOST: npipe:////./pipe/podman-machine-default
run: |
wsl --set-default-version 2
choco install podman-cli kind -y
curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64"
expected="6f724188289cc79395f45afae0f2b85e0d220c2b84c6ed2f5047d9d0c9a67028"
actual=$(sha256sum "$RUNNER_TEMP/kind.exe" | awk '{print $1}' | sed 's/^[^a-f0-9]*//')
if [ "$actual" != "$expected" ]; then
echo "SHA256 mismatch for kind.exe! Expected: $expected, Got: $actual"
exit 1
fi
echo "kind.exe checksum verified: $actual"

podman machine init
podman machine set --rootful
podman machine start
export PATH="$RUNNER_TEMP:$PATH"
echo "$RUNNER_TEMP" >> "$GITHUB_PATH"

kind create cluster --name "${{ steps.uuid.outputs.result }}" --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
CLUSTER_NAME=$(python -c "import uuid; print(uuid.uuid4().hex)")
kind create cluster --name "$CLUSTER_NAME" --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a

# NOTE: skevetter/setup-kind does not work on Windows runners
- name: setup kind
Expand Down
Loading