ci/crosvm: Use structured tagging for crosvm

Structured tagging captures a checksum of the component we think we're
building, and verifies this through the chain.

Signed-off-by: Valentine Burley <valentine.burley@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/34813>

.gitlab-ci/common/export-gitlab-job-env-for-dut.sh

@@ -31,6 +31,7 @@ VARS=(
     CI_SERVER_URL
     CROSVM_GALLIUM_DRIVER
     CROSVM_GPU_ARGS
+    CROSVM_TAG
     CURRENT_SECTION
     DEQP_BIN_DIR
     DEQP_FORCE_ASAN

.gitlab-ci/conditional-build-image-tags.yml

@@ -1,4 +1,5 @@
 variables:
   CONDITIONAL_BUILD_ANGLE_TAG: 384145a4023315dae658259bee07c43a
+  CONDITIONAL_BUILD_CROSVM_TAG: bb7f75d912ef43be8c9204385d79820a
   CONDITIONAL_BUILD_FLUSTER_TAG: f1af06c34ccdbb5b44f78adaeb63603c
   CONDITIONAL_BUILD_PIGLIT_TAG: 6d869cd388a6ecd3d1ee246056bb796a

.gitlab-ci/container/build-crosvm.sh

@@ -5,6 +5,10 @@
 # .gitlab-ci/image-tags.yml tags:
 # DEBIAN_BASE_TAG
 
+# Do a very early check to make sure the tag is correct without the need of
+# setting up the environment variables locally
+ci_tag_build_time_check "CROSVM_TAG"
+
 set -uex
 
 section_start crosvm "Building crosvm"

.gitlab-ci/container/gitlab-ci.yml

@@ -68,6 +68,18 @@
   variables:
     ANGLE_TAG: "${CONDITIONAL_BUILD_ANGLE_TAG}"
 
+.container-builds-crosvm:
+  variables:
+    CROSVM_TAG: "${CONDITIONAL_BUILD_CROSVM_TAG}"
+
+.container-builds-fluster:
+  variables:
+    FLUSTER_TAG: "${CONDITIONAL_BUILD_FLUSTER_TAG}"
+
+.container-builds-piglit:
+  variables:
+    PIGLIT_TAG: "${CONDITIONAL_BUILD_PIGLIT_TAG}"
+
 .container-builds-android:
   extends:
     - .container-builds-angle
@@ -78,13 +90,11 @@
     # should make CI_BUILD_COMPONENTS="angle piglit"
     CI_BUILD_COMPONENTS: "angle"
 
-.container-builds-fluster:
+.container-builds-base:
+  extends:
+    - .container-builds-crosvm
   variables:
-    FLUSTER_TAG: "${CONDITIONAL_BUILD_FLUSTER_TAG}"
-
-.container-builds-piglit:
-  variables:
-    PIGLIT_TAG: "${CONDITIONAL_BUILD_PIGLIT_TAG}"
+    CI_BUILD_COMPONENTS: "crosvm"
 
 .container-builds-video:
   extends:
@@ -362,6 +372,7 @@ debian/x86_64_test-base:
   extends:
     - .debian-container
     - .firmware_x86_64
+    - .container-builds-base
   variables:
     MESA_IMAGE_TAG: &debian-x86_64_test-base "${DEBIAN_BASE_TAG}--${PKG_REPO_REV}--${KERNEL_TAG}"
     LLVM_VERSION: *debian-x86_64-llvm
@@ -387,6 +398,7 @@ debian/arm32_test-base:
   extends:
     - .debian-container
     - .firmware_arm32
+    - .container-builds-base
   variables:
     MESA_IMAGE_TAG: &debian-arm32_test-base "${DEBIAN_BASE_TAG}--${PKG_REPO_REV}"
     LLVM_VERSION: *debian-arm64-llvm
@@ -414,6 +426,7 @@ debian/arm64_test-base:
   extends:
     - .debian-container
     - .firmware_arm64
+    - .container-builds-base
   variables:
     MESA_IMAGE_TAG: &debian-arm64_test-base "${DEBIAN_BASE_TAG}--${PKG_REPO_REV}"
     LLVM_VERSION: *debian-arm64-llvm

.gitlab-ci/crosvm-runner.sh

@@ -3,6 +3,14 @@
 
 set -ue
 
+if [ -z "$CROSVM_TAG" ]; then
+    echo "CROSVM_TAG must be set to the conditional build tag"
+    exit 1
+fi
+
+# Are we using the right crosvm version?
+ci_tag_test_time_check "CROSVM_TAG"
+
 # Instead of starting one dEQP instance per available CPU core, pour our
 # concurrency at llvmpipe threads instead. This is mostly useful for VirGL and
 # Venus, which serialise quite a bit at the host level. So instead of smashing

.gitlab-ci/image-tags.yml

@@ -19,7 +19,7 @@ include:
   - .gitlab-ci/conditional-build-image-tags.yml
 
 variables:
-  DEBIAN_BASE_TAG: "20250502-igt"
+  DEBIAN_BASE_TAG: "20250505-crosvm"
 
   DEBIAN_BUILD_TAG: "20250422-ci-fairy"
 

.gitlab-ci/test/gitlab-ci.yml

@@ -183,6 +183,10 @@ yaml-toml-shell-py-test:
   variables:
     ANGLE_TAG: ${CONDITIONAL_BUILD_ANGLE_TAG}
 
+.test-crosvm:
+  variables:
+    CROSVM_TAG: ${CONDITIONAL_BUILD_CROSVM_TAG}
+
 .test-fluster:
   variables:
     FLUSTER_TAG: ${CONDITIONAL_BUILD_FLUSTER_TAG}

src/gallium/drivers/virgl/ci/gitlab-ci-inc.yml

@@ -60,6 +60,7 @@
 .virgl-test:
   extends:
     - .test-gl
+    - .test-crosvm
     - .virgl-rules
   timeout: 15m
   variables:
@@ -73,6 +74,7 @@
   extends:
     - .lava-x86_64-piglit-traces
     - .lava-acer-cp514-2h-1130g7-volteer:x86_64
+    - .test-crosvm
   variables:
     HWCI_KERNEL_MODULES: vhost_vsock
     HWCI_KVM: "true"

src/gallium/drivers/zink/ci/gitlab-ci.yml

@@ -28,6 +28,7 @@ zink-venus-lvp:
     - .test-gl
     - .deqp-test
     - .zink-venus-lvp-test
+    - .test-crosvm
     - .test-piglit
   timeout: 15min  # base run time = 8min, but it's on the shared runners so it can go up
   variables:

src/virtio/ci/gitlab-ci-inc.yml

@@ -20,6 +20,7 @@
 .venus-lavapipe-test:
   extends:
     - .test-vk
+    - .test-crosvm
     - .venus-rules
   timeout: 15m
   variables: