From b01a091856e19c6cea3b183b5ce60516111a4247 Mon Sep 17 00:00:00 2001
From: Valentine Burley <valentine.burley@collabora.com>
Date: Thu, 1 May 2025 12:32:59 +0200
Subject: [PATCH] ci/fluster: Use structured tagging for Fluster

Structured tagging captures a checksum of the component we think we're
building, and verifies this through the chain.

Signed-off-by: Valentine Burley <valentine.burley@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/34787>
---
 .gitlab-ci/common/export-gitlab-job-env-for-dut.sh |  1 +
 .gitlab-ci/conditional-build-image-tags.yml        |  1 +
 .gitlab-ci/container/build-fluster.sh              |  4 ++++
 .gitlab-ci/container/gitlab-ci.yml                 | 11 +++++++++++
 .gitlab-ci/fluster-runner.sh                       |  8 ++++++++
 .gitlab-ci/test/gitlab-ci.yml                      |  1 +
 6 files changed, 26 insertions(+)

diff --git a/.gitlab-ci/common/export-gitlab-job-env-for-dut.sh b/.gitlab-ci/common/export-gitlab-job-env-for-dut.sh
index de6ddede4b0..324f0d43ae9 100755
--- a/.gitlab-ci/common/export-gitlab-job-env-for-dut.sh
+++ b/.gitlab-ci/common/export-gitlab-job-env-for-dut.sh
@@ -49,6 +49,7 @@ VARS=(
     FLAKES_CHANNEL
     FLUSTER_CODECS
     FLUSTER_FRACTION
+    FLUSTER_TAG
     FREEDRENO_HANGCHECK_MS
     GALLIUM_DRIVER
     GALLIVM_PERF
diff --git a/.gitlab-ci/conditional-build-image-tags.yml b/.gitlab-ci/conditional-build-image-tags.yml
index 35abe1ac27b..8cbdfeaae03 100644
--- a/.gitlab-ci/conditional-build-image-tags.yml
+++ b/.gitlab-ci/conditional-build-image-tags.yml
@@ -1,3 +1,4 @@
 variables:
   CONDITIONAL_BUILD_ANGLE_TAG: 384145a4023315dae658259bee07c43a
+  CONDITIONAL_BUILD_FLUSTER_TAG: 3cef43c49c9aa9cda3cc1584ea43cb8b
   CONDITIONAL_BUILD_PIGLIT_TAG: a19e424b8a3f020dbf1b9dd29f220a4f
diff --git a/.gitlab-ci/container/build-fluster.sh b/.gitlab-ci/container/build-fluster.sh
index 28e7a16dc8a..051d438f7af 100644
--- a/.gitlab-ci/container/build-fluster.sh
+++ b/.gitlab-ci/container/build-fluster.sh
@@ -10,6 +10,10 @@
 
 # Install fluster in /fluster.
 
+# Do a very early check to make sure the tag is correct without the need of
+# setting up the environment variables locally
+ci_tag_build_time_check "FLUSTER_TAG"
+
 set -uex
 
 section_start fluster "Installing fluster"
diff --git a/.gitlab-ci/container/gitlab-ci.yml b/.gitlab-ci/container/gitlab-ci.yml
index 92b5482b954..ae8bf351c49 100644
--- a/.gitlab-ci/container/gitlab-ci.yml
+++ b/.gitlab-ci/container/gitlab-ci.yml
@@ -78,10 +78,20 @@
     # should make CI_BUILD_COMPONENTS="angle piglit"
     CI_BUILD_COMPONENTS: "angle"
 
+.container-builds-fluster:
+  variables:
+    FLUSTER_TAG: "${CONDITIONAL_BUILD_FLUSTER_TAG}"
+
 .container-builds-piglit:
   variables:
     PIGLIT_TAG: "${CONDITIONAL_BUILD_PIGLIT_TAG}"
 
+.container-builds-video:
+  extends:
+    - .container-builds-fluster
+  variables:
+    CI_BUILD_COMPONENTS: "fluster"
+
 .container-builds-x86_64:
   extends:
     - .container-builds-angle
@@ -492,6 +502,7 @@ debian/x86_64_test-android:
 debian/x86_64_test-video:
   extends:
     - .use-debian/x86_64_test-base
+    - .container-builds-video
     - .export-container
   variables:
     MESA_IMAGE_TAG: &debian-x86_64_test-video ${DEBIAN_TEST_VIDEO_TAG}
diff --git a/.gitlab-ci/fluster-runner.sh b/.gitlab-ci/fluster-runner.sh
index 3ea57648b33..8c0464a9202 100755
--- a/.gitlab-ci/fluster-runner.sh
+++ b/.gitlab-ci/fluster-runner.sh
@@ -18,6 +18,14 @@ if [ -z "$FLUSTER_CODECS" ]; then
    exit 1
 fi
 
+if [ -z "$FLUSTER_TAG" ]; then
+    echo "FLUSTER_TAG must be set to the conditional build tag"
+    exit 1
+fi
+
+# Are we using the right fluster version?
+ci_tag_test_time_check "FLUSTER_TAG"
+
 INSTALL="$PWD/install"
 
 # Set up the driver environment.
diff --git a/.gitlab-ci/test/gitlab-ci.yml b/.gitlab-ci/test/gitlab-ci.yml
index f69f61b87f3..be8db3fd0d0 100644
--- a/.gitlab-ci/test/gitlab-ci.yml
+++ b/.gitlab-ci/test/gitlab-ci.yml
@@ -185,6 +185,7 @@ yaml-toml-shell-py-test:
 
 .test-fluster:
   variables:
+    FLUSTER_TAG: ${CONDITIONAL_BUILD_FLUSTER_TAG}
     FLUSTER_RESULTS: "${GPU_VERSION}-${FLUSTER_CODEC}"
     HWCI_TEST_SCRIPT: install/fluster-runner.sh