veristat: split kernel and meta jobs into independent workflows

.github/workflows/kernel-build-test.yml

@@ -100,9 +100,21 @@ jobs:
       continue_on_error: ${{ toJSON(matrix.continue_on_error) }}
       timeout_minutes: ${{ matrix.timeout_minutes }}
 
-  veristat:
+  veristat-kernel:
     if: ${{ inputs.run_veristat }}
-    uses: ./.github/workflows/kernel-veristat.yml
+    uses: ./.github/workflows/veristat-kernel.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain: ${{ inputs.toolchain }}
+      runs_on: ${{ inputs.runs_on }}
+
+  veristat-meta:
+    if: ${{ inputs.run_veristat && github.repository_owner == 'kernel-patches' }}
+    uses: ./.github/workflows/veristat-meta.yml
     needs: [build]
     permissions:
       id-token: write

.github/workflows/veristat-kernel.yml

@@ -0,0 +1,65 @@
+name: veristat_kernel
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+
+jobs:
+  veristat:
+    name: ${{ inputs.arch }}-${{ inputs.toolchain }} veristat_kernel
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain }}
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+
+      - name: Untar artifacts
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Run veristat
+        uses: libbpf/ci/run-vmtest@v2
+        with:
+          arch: x86_64
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          max-cpu: 8
+          kernel-test: 'run_veristat_kernel'
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.kernel.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-kernel
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-kernel
+

.github/workflows/kernel-veristat.yml → .github/workflows/veristat-meta.yml

@@ -1,4 +1,4 @@
-name: Reusable veristat workflow
+name: veristat_meta
 
 on:
   workflow_call:
@@ -26,7 +26,7 @@ on:
 
 jobs:
   veristat:
-    name: veristat on ${{ inputs.arch }} with ${{ inputs.toolchain }}
+    name: ${{ inputs.arch }}-${{ inputs.toolchain }} veristat_meta
     runs-on: ${{ fromJSON(inputs.runs_on) }}
     timeout-minutes: 100
     permissions:
@@ -38,35 +38,34 @@ jobs:
       REPO_PATH: ""
       KBUILD_OUTPUT: kbuild-output/
       ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain }}
+
     steps:
+
       - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
       - uses: actions/download-artifact@v4
         with:
           name: vmlinux-${{ env.ARCH_AND_TOOL }}
           path: .
+
       - name: Untar artifacts
-        # zstd is installed by default in the runner images.
         run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
 
       - name: Configure AWS Credentials
-        # Disabling BPF objects download and veristat-meta benchmark for PRs
-        # created from fork repositories. These won't have access to required
-        # enviroment variables and secrets, and otherwise would consistently fail
-        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         uses: aws-actions/configure-aws-credentials@v2
         with:
           aws-region: ${{ inputs.aws_region }}
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           role-session-name: github-action-bpf-ci
 
       - name: Download BPF objects
-        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         run: |
-          set -eux
-          if [ -n "$AWS_ROLE_ARN" ]; then
-            mkdir ./bpf_objects
-            aws s3 sync s3://veristat-bpf-binaries ./bpf_objects
-          fi
+          mkdir ./bpf_objects
+          aws s3 sync s3://veristat-bpf-binaries ./bpf_objects
         env:
           AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
 
@@ -77,19 +76,12 @@ jobs:
           vmlinuz: '${{ github.workspace }}/vmlinuz'
           kernel-root: '.'
           max-cpu: 8
-          # Don't run meta's veristat from forked repo.
-          kernel-test: ${{ github.event.pull_request.head.repo.full_name == github.repository && 'run_veristat_kernel,run_veristat_meta' || 'run_veristat_kernel' }}
+          kernel-test: 'run_veristat_meta'
           output-dir: '${{ github.workspace }}'
 
-      - name: Compare and save veristat.kernel.csv
-        uses: ./.github/actions/veristat_baseline_compare
-        with:
-          veristat_output: veristat-kernel
-          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-kernel
-
       - name: Compare and save veristat.meta.csv
-        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         uses: ./.github/actions/veristat_baseline_compare
         with:
           veristat_output: veristat-meta
           baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-meta
+