Patrick Lodder da0732ebd5
ci: containerize Continuous Integration jobs
This frees us from GitHub actions brownouts and early deprecation
by no longer using Microsoft-maintained images in favor of bare
images from Docker Hub. The latter keeps images available for a
longer time, regardless of whether or not Canonical directly
supports them.

Benefits:
- Decouples our release cycle from what Microsoft is willing to
  spend support effort on.
- Reduces bloat in base images

Because the bare ubuntu images contain a lot less pre-installed
tooling, some changes in orchestration need to be made for this
to be successful, as well as some workarounds can be removed:

- All GitHub Actions base operating systems are set to
  ubuntu-24.04, as all we use from this now is containerd.
- All docker images remain ubuntu:20.04 for now, as this is
  needed for symbol compatibility (and for now, we use the same
  version in Gitian builds)
- Until the base image used for GitHub Actions and the provided
  containerd is providing sandboxed mounting on /proc, every
  process that needs custom binfmts needs to be ran privileged.
  Currently this means all windows builds need this.
  see: https://lore.kernel.org/all/20211028103114.2849140-2-brauner@kernel.org/
- Staying on custom binfmts, the Microsoft-maintained image
  contained mono runtimes and reduced compatibility with wine,
  for which we had workarounds in place. These are no longer
  needed and have been removed.
- For future troubleshooting, the currently installed binfmts
  and the kernel version are verbosely displayed inside jobs
- Because GitHub Actions does not allow us to pass zero
  arguments to container options, whenever there are none a
  dummy environment value 1DOGE is set to 1DOGE.
- For macOS, the libbz2-dev library was missing from our system
  dependencies, this was masked by it being installed by default
  in the Microsoft-maintained image.
- Bare containers do not come configured with a timezone, so this
  needed to be added to container initialization before any apt
  calls are made.
- Because Microsoft runs the container under uid 1001, which does
  not exist in the bare ubuntu:20.04 image, a special cleanup
  step for the qa/cache needed to be made, or else the build
  caches would fail to upload at the end of the CI run.
2025-02-25 17:37:16 -05:00
..